VisualBee or VB or Conduit Search are search “aids†for web browsers and a toolbar; but you should avoid these. They are rogue search engine redirectors that are included with downloads of various shareware installers (you have to be careful to unclick the “Install this along with…” button every time). The malware writers make money by sending your search links to commercial advertising sites instead of the one you chose. These sites could in turn redirect you to porn, virus or other sites.
In general, you cannot trust the uninstallers provided by software manufacturers who engage in these practices. Here is how to manually remove VisualBee, Conduit and other rogue search toolbars from your browsers.
First thing to try is see if AdwCleaner.exe can eradicate this browser toolbar/search engine http://www.bleepingcomputer.com/download/adwcleaner/ Some people have reported success, although parts of the malware may be left behind.
Here is how to manually remove Conduit, VisualBee and other rogue search toolbars from your browsers.
Firefox:
Go to Manage Search Engines in Firefox and remove any entries for Conduit or VisualBee or VB
http://support.mozilla.org/en-US/kb/search-bar-easily-choose-your-search-engine
Check if you have Conduit or VisualBee or VB Toolbar in your Firefox menu > Add Ons and remove any items for Scour. Check both the Plug ins tab and the Extensions tab (on older versions, Tools > Add-ons).
http://support.mozilla.org/en-US/kb/disable-or-remove-add-ons
Set the Home page to the search engine of your choice (the default Google search entry is http://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q= )
http://support.mozilla.org/en-US/kb/How%20to%20set%20the%20home%20page?s=Set+home+page&r=1&as=s
Remove Conduit or VisualBee or VB from the search engine default for unrecognized pages
In the address bar enter “about:config†and hit Enter
Bypass the warranty screen(s) by clicking
On the next screen enter “ Conduit†in the Filter window (a search in the config)
If Conduit or Searchconduit shows up, highlight each of these entries one at a time, right click and choose “resetâ€.
Repeat with the search terms “VisualBee” and “VB”
When finished, close the file.
Consider adding the NoScript extension to Firefox
Chrome
http://support.google.com/chrome/bin/answer.py?hl=en&answer=95653
Click on the wrench icon in the Google Chrome address bar and from the drop down menu select Settings > Extensions or Tools > Extensions — depending on your version
(or enter chrome://settings/extensions in the location bar)
Check if any items of Conduit or VisualBee or VB are listed in the browser Extensions. If so, click on uninstall to remove the toolbar(s) from the browser.
Close the window. Choose the wrench icon again and depending on your version choose Settings > Settings or Options from the drop down menu.
Check the Home Page setting under Basics to see if Conduit or VisualBee or VB is listed. Replace it with another search engine that you want to use for your home page.
Click Manage search engines, check if Conduit or VisualBee or VB is listed on the page. Hover your mouse over a Scour entry, click the X icon to uninstall it. Go back to the previous page and pick another available search engine as the default browser search engine.
Check the On Start Up entry in Settings, click on Go to a specific page… and enter http://www.Google.com or your preferred search engine.
Internet Explorer
(note, we no longer recommend the use of Internet Explorer)
If you don’t have any preferences and settings in Internet Explorer that you particularly want to keep, you can do a reset of the IE Settings http://www.microsoft.com/security/pc-security/browser-hijacking.aspx
Otherwise you can remove it manually
First delete any Conduit or VisualBee or VB items from Add Ons
Open Internet Explorer and click on “Toolsâ€.
Select “Manage Add Onsâ€, Click on Toolbars and Extensions, and search for Conduit or VisualBee or VB in the list of add-ons.
Right Click on the Conduit or VisualBee or VB entries and select “disable†(or highlight and click the Disable button).
Click on “Okâ€
Now select Search Providers.
Left click to highlight each Conduit or VisualBee or VB item and click Remove button to remove
Click on “Okâ€
Restart Internet Explorer
Next restore your home page to the one you want.
http://www.microsoft.com/security/pc-security/homepagerestore.aspx
Remove Conduit or VisualBee or VB from the search engine default for unrecognized pages (note this requires editing your Registry. Back it up first. If you are not confident, refer the work to someone experienced)
Open “RegEdit†through the launch menu.
Find this entry
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\About URLs\Tabs
Change any entry that points to Conduit or VisualBee or VB search, to the search engine you want (Google for example).
Finishing up
After removing and resetting, I would recommend starting in Safe mode (F8) and running Malwarebytes or SuperAntiSpyware to check the machine and registry. Running CCleaner to clean the registry wouldn’t hurt either. Then test your browser(s) by opening them and typing in some nonsense in the URL/location bar to make sure the defaults have been successfully changed.
You may have installers or uninstallers still remaining on your machine
Go to C:\Program Files\ and delete any folder related to Conduit or VisualBee or VB (Unless you are using Visual Basic, the programming language from Microsoft, if so then research to know which Visual Basic items you need to keep)
Go to C:\Program Files (X86) and delete any folder related to Conduit or VisualBee or VB
Restart the machine in Safe Mode (F8) and run CCleaner
Open CCleaner,
Click Tools,
If you see Conduit or VisualBee or VB entries, select them from the list,
Click Uninstall.
Run the Registry tool,
Run the cleaner.
Final Cleanup
After removing the malware, you may want to do a final cleaning. A little program callerd MiniToolBox allows you to purge DNS entries and other information that the malware may have changed. Quit from your browser program(s) before running MiniToolBox.
- Flush DNS
- Report IE Proxy Settings
- Reset IE Proxy Settings
- Report FF Proxy Settings
- Reset FF Proxy Settings
Pingback: Don’t fall for a parasite – watch your installers | CanadaRAM: Memory and Computer Q&A