How to Remove Conduit Engine Search from Firefox 3.x
Posted by keith on December 8th, 2010
I know this isn’t a tecchie blog, but sometimes I come across a problem to which there isn’t a solution listed and have to work it out for myself. In this case I (ill-advisedly as it turned out) upgraded BitTorrent to version 7 (7.1 and 7.2 at present). This is sort of pertinent to The Unsuitablog as I have been recently accessing a number of Wikileaks files via BitTorrent (other torrent software is available) for – ahem – research purposes.
Anyhow, upon upgrading BitTorrent, I found three things had happened, all of which greatly annoyed me.
1) A couple of new toolbar widgety-type things had ensconced themselves in Firefox
2) The search box had been hijacked
3) The URL bar search facility had also been hijacked
It turned out that the makers of BitTorrent had been a little foolish, using something called Conduit Engine to create a toolbar. The problem with this is that when you use Conduit Engine then it stays used: you have to accept (or rather your users have to accept) all the crap that comes along with it, screwing up your search options seemingly forever; or at least until you completely uninstall Firefox and reinstall it. And even then it will probably still be around.
Fortunately there are a few simple fixes which I have worked out, none of which (thankfully) involve hacking the Windows Registry, and all of which are neatly isolated within the Firefox domain. This is just for Windows Vista and Windows 7, although the operations are very similar for Windows XP. You’ll have to work it out for yourself if you have a Mac or Linux, although some of the tips might be relevant.
1) To get rid of the Toolbar / widget things, you need to go to Tools > Add-ons > Plugins, and uninstall the two entries pertaining to BitTorrent and Conduit. You will need to restart Firefox twice for this. Check that they are both gone when you have restarted.
2) To remove the Search Box hijack, click on the down-arrow next to the search box (it will probably have a Google symbol next to it) and select Manage Search Engines. Then select any search engine you don’t like the look of or recognise – you will be surprised how many there are – and for each one click Remove.
3) They were the easy bits. Now to remove the Conduit Engine itself.
You need to have Firefox shut down for this, as it restores some of the files upon shutdown to prevent corruption. First, locate you Roaming Application Profiles. You will need to be an administrator to do this, but assuming you are, in Explorer select Tools > Folder Options > View tab (if Tools is not visible, hit Alt) and ensure the radio button for “Show hidden files, folders and drives” is selected and “Hide protected operating system files (Recommended)” is unchecked (you will be asked to confirm this).
Find your profile. This will be located in your home drive (probably C:) in the “Users” or “Documents and Settings” (for XP) folder, so in my case it is C:\Users\Keith. Ensuring you have Folder View open, click on the {profile} folder and in the right-hand pane locate AppData (or Local Settings\Application Data for XP). Within this is the folder “Roaming”, within which is the Firefox Profile folder, e.g. {profile}\AppData\Roaming\Mozilla\Firefox\Profiles.
Beneath that is your random profile ID folder, which will be something like “1234abcd.default”. This folder I will call {fprofile}.
First, locate the pesky Conduit Engine folders, which contain most of the gubbins associated with this monster. Delete the folders {fprofile}\conduit and {fprofile}\CT2790392 (I can’t vouch for this exact number, but it seems to be standard at the moment).
Find the file {fprofile}\prefs.js and save a copy of this with a .backup extension. Right click on prefs.js and select “Edit”; this will (should) open the javascript file in Notepad.
You need to remove all references to Conduit:
First, delete every line beginning with the following:
user_pref("CT2790392.
user_pref("CommunityToolbar.
Second, locate the following line:
user_pref("browser.search.defaulturl", "http://search.conduit.com/ResultsExt.aspx?ctid=CT2790392&SearchSource=3&q={searchTerms}");
Change it to (for Google search):
user_pref("browser.search.defaulturl", "http://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=");
You will need to find the relevant command line for your own search engine, or just leave the second quotes empty for no URL bar searching.
Finally, locate the line:
user_pref("keyword.URL", "http://search.conduit.com/ResultsExt.aspx?ctid=CT2790392&q=");
and change it to (for Google):
user_pref("keyword.URL", "http://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=");
Again, you will need to find your own code for different search engines: I’m not a huge fan of Google, but at least you can just delete the cookie to remove your search history, or use Private Browsing.
Save the file, and restart Firefox.
As far as I know, that’s it. Any comments and additions, please say your piece below.
UPDATE: Have been experimenting with Internet Explorer, and suffice to say because of the closed source nature of IE, removing Conduit is a complete pain. First you must uninstall all Toolbars that you are not 100% confident are safe; ALL OF THEM. After this, all I could do was to scour the registry for “conduit”, ignore the Apple keys, and delete every key and sole-containing folder. Then it was a case of deleting the relevant “conduit” folders in Program Files. Good Luck!
December 14th, 2010 at 4:53 am
Thank you soo munch that was annoying the shit out off me
December 14th, 2010 at 12:36 pm
That was awesomely simple it worked
January 3rd, 2011 at 9:51 am
Thanks, great work, simple and quick.
Much appreciated.
January 4th, 2011 at 9:37 am
Thanks a bunch ….
I was running Norton Security but it didn’t protect me from letting this VERY VERY annoying thing installing itself whilst installing Bittorent.
Norton hadn’t heard of it apparently and one of their engineers played about with my machine remotely for an hour without sucsess…
In also stopped me opening sites telling me how to remove it when using Firefox. WHAT A SELFPROTECTING VIRUS!!!
So started IE and was then able to open the sites …. including this one …
THANKS AGAIN …. it’s now GONE …
and NEVER again Bittorrent …
use PIRATEBAY only
January 12th, 2011 at 7:09 am
Thx a lot ;) work fine
February 19th, 2011 at 1:01 pm
Thanks!! Conduit didn’t hijack my search engines but it did put up a window which was not sized correctly so I couldn’t close it. I finally figured out that I could Tab down thru the dialog and finally get to close/uninstall. But I still had stuff in my profile and it reloaded itself even after an uninstall of FF.
Thanks again.
~L
March 5th, 2011 at 10:21 pm
Thanks much for sharing this. uTorrent pulled a nasty trick adding the Conduit crapware with a deceptive opt-out. Watch out for the upgrade if you are a uTorrent user. They can burn in hell for wasting 1/2 an hour of my life rooting out this garbage.
March 7th, 2011 at 3:43 pm
Fantastic – well worth the effort of you adding this – Great help and well explained – Cheers!!
April 9th, 2011 at 10:52 am
Great!
I had this problem since I installed utorrent… no more…
there are other options…
THANKS!!!!!!!!!!!!
May 25th, 2011 at 1:45 am
I’m using FF4, but this still worked great!
The only notable difference was my CTID was CT2786678 instead of CT2790392. Maybe FF4 the determining factor?
THANK YOU Keith!!!
May 25th, 2011 at 2:27 am
Pleasure. I think the CT number might be the build of Conduit, or the serial number, so it depends where you got the infection from.
K.
June 2nd, 2011 at 1:15 pm
I too downloaded BitTorrent 7 for exactly the same reason. Used two P.C.s to download WikiLeaks thinking it would be faster and keep me from being eye-balled by “big brother” which ever one they use to spy on us now. It didn’t work, using WireShark I was able to see them searching my files. If you’re a little savvy, you can stop that too using Netsh.
June 14th, 2011 at 1:11 am
Thanx, it worked! :)
June 23rd, 2011 at 10:25 am
Thnx man !
June 23rd, 2011 at 6:04 pm
Thanks buddy .. great help :D
June 24th, 2011 at 8:44 pm
You rock! This worked perfectly!
June 25th, 2011 at 3:29 pm
Thank you very much, very helpful in removing these annoying pests to my browser…
July 5th, 2011 at 1:16 pm
There is a very easy solution for the 3rd problem. Type “about:config” in Firefox address bar. Search “keyword.URL” in the filter. Double click the result. In that enter this for setting Google as your default address bar search:
e.g. “http://www.google.co.in/search?q=”
July 7th, 2011 at 12:55 am
Thank you so much for this guide, just wanted to let you know that if you click the start button and type %appdata% into the search field and hit enter it automatically takes you to the ./roaming/appdata older under your current profile. Once again thank you for this tutorial.
July 9th, 2011 at 6:10 pm
Great guide man. I am so furious that they don’t provide a proper uninstallation of their crap software. Thanks for helping all of us out with this guide.
July 21st, 2011 at 1:54 am
I had uninstalled Free Coder from Tools->Add ons Manager -> Extensins and cleared default url from about:config and it worked for me.
July 22nd, 2011 at 4:18 am
You can also type in the address bar of Mozzila firefox : about:config then search for the browser.search.defaultenginename key and Set it to google – right click on that key. The rest folowing assume you can operate into the registry base, have admin right… still your own risk, you are warned.Do not forget to delete also the key Conduit and Conduit engine into your registry base (HKLM\Software\Conduit and HKLM\Software\Conduitengine and and/or HKLU\Software\Conduit HKLU\Software\Conduitengine)but – Backup your registry base first – , and of course the two folder it does create into your PC (usually C:\program files\Conduit and C:\program files\Conduit Engine). That should do it.
September 23rd, 2011 at 9:44 am
just reinstall firefox. the very best way to fix this problem. :P
October 19th, 2011 at 4:55 pm
This is a simple fix and worked for me:
Type about:config into browser address bar and press Enter.
Type conduit in the filter box.
Right-click on the items listed, and choose Reset from the menu.
October 20th, 2011 at 9:45 am
WORKED 100%
Great advice. I know it looks alot of instruction, but follow it to the letter and you’ll be fine