Tap here to go to the mobile version of the site.
Your Firefox is out of date and may contain a security risk! Upgrade Firefox

Support Forum

How do I get rid of "search.conduit.com" on my new tab page


Somehow I got the search.conduit.com problem it was on my home page and I get it when I open a new tab. I have tried about:config changing the URL and I followed the steps for deleting User.JS and I found a User file (did not specify if it was a .JS ) but when I tried opening it I got and error. I also ran the SearchReset Addon but no luck. Well the only other option I see is reinstalling FireFox but I'm affraid I will loose all my bookmarks. Can you pleas help me?

Chosen solution

I had the very same issue. Even when I tried deleting it from both my firefox and chrome extensions it still came up when I started either browsers. The only way I've found that this can be fixed is by removing the program using your control panel. Sometimes these crappy mal ware tool bars install actual programs and Search conduit is no different. When you display all your programs (after clicking add or remove programs) you should see a magnifying glass icon next to a program name " search protect". That is the search conduit program and it needs to be deleted. After uninstalling it , restart your browser and everything should be fine.

Read this answer in context 224
Post a Reply

Additional System Details

Installed Plug-ins

  • Shockwave Flash 11.9 r900
  • VLC media player Web Plugin 2.1.0
  • Next Generation Java Plug-in 10.45.2 for Mozilla browsers
  • NPRuntime Script Plug-in Library for Java(TM) Deploy
  • Adobe PDF Plug-In For Firefox and Netscape 11.0.05
  • 5.1.20913.0
  • Unity Player 4.1.2f1
  • iTunes Detector Plug-in
  • Pando Web Plugin


  • Firefox 25.0.1
  • User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:25.0) Gecko/20100101 Firefox/25.0
  • Support URL: https://support.mozilla.org/1/firefox/25.0.1/WINNT/en-US/


  • Adblock Plus 2.4 ({d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d})
  • FirefoxAdKiller 0.87 ({b1df372d-8b32-4c7d-b6b4-9c5b78cf6fb1})
  • Troubleshooter 1.1a (troubleshooter@mozilla.org)


  • incrementalGCEnabled: True


  • adapterDescription: Intel(R) HD Graphics Family
  • adapterDescription2:
  • adapterDeviceID: 0x0126
  • adapterDeviceID2:
  • adapterDrivers: igdumd64 igd10umd64 igd10umd64 igdumdx32 igd10umd32 igd10umd32
  • adapterDrivers2:
  • adapterRAM: Unknown
  • adapterRAM2:
  • adapterVendorID: 0x8086
  • adapterVendorID2:
  • direct2DEnabled: True
  • directWriteEnabled: True
  • directWriteVersion: 6.2.9200.16571
  • driverDate: 11-12-2010
  • driverDate2:
  • driverVersion:
  • driverVersion2:
  • info: {u'AzureCanvasBackend': u'direct2d', u'AzureFallbackCanvasBackend': u'cairo', u'AzureContentBackend': u'direct2d', u'AzureSkiaAccelerated': 0}
  • isGPU2Active: False
  • numAcceleratedWindows: 1
  • numTotalWindows: 1
  • webglRenderer: Google Inc. -- ANGLE (Intel(R) HD Graphics Family Direct3D9Ex vs_3_0 ps_3_0)
  • windowLayerManagerRemote: False
  • windowLayerManagerType: Direct3D 10

Modified Preferences

  • accessibility.typeaheadfind.flashBar: 0
  • browser.cache.disk.capacity: 358400
  • browser.cache.disk.smart_size.first_run: False
  • browser.cache.disk.smart_size.use_old_max: False
  • browser.cache.disk.smart_size_cached_value: 358400
  • browser.places.smartBookmarksVersion: 4
  • browser.search.suggest.enabled: False
  • browser.search.useDBForOrder: True
  • browser.sessionstore.upgradeBackup.latestBuildID: 20131112160018
  • browser.startup.homepage: http://www.google.com/webhp?nord=1
  • browser.startup.homepage_override.buildID: 20131112160018
  • browser.startup.homepage_override.mstone: 25.0.1
  • browser.tabs.warnOnClose: False
  • dom.max_chrome_script_run_time: 0
  • dom.max_script_run_time: 0
  • dom.mozApps.used: True
  • dom.w3c_touch_events.expose: False
  • extensions.lastAppVersion: 25.0.1
  • font.internaluseonly.changed: True
  • gfx.direct3d.last_used_feature_level_idx: 0
  • gfx.direct3d.prefer_10_1: True
  • network.cookie.prefsMigrated: True
  • places.database.lastMaintenance: 1385494280
  • places.history.expiration.transient_current_max_pages: 104858
  • plugin.disable_full_page_plugin_for_types: application/pdf
  • plugin.importedState: True
  • privacy.cpd.sessions: False
  • privacy.sanitize.migrateFx3Prefs: True
  • privacy.sanitize.timeSpan: 0
  • security.warn_viewing_mixed: False
  • storage.vacuum.last.index: 1
  • storage.vacuum.last.places.sqlite: 1385248390


  • User JS: Yes
  • Accessibility: No
Aman Routh
  • Top 25 Contributor
37 solutions 284 answers

Helpful Reply

Hello please try this,

1. Type Ctrl+Shift+A.

2. On the Extensions and Plugin search for Conduit Community Toolbar and any suspicious add-ons and remove them if located. How to remove Search.Conduit.com from your home page (Stop start up)

  In Mozilla Firefox navigate to Tools > Options or click Firefox in the top left corner and click Options > Options. Under the General tab remove Search.conduit.com from the “Home Page:” field and replace it with your preferred home page URL.

How to remove the Search.Conduit.com search engine (Stop redirect)

  In Mozilla Firefox, click the small search magnify glass near the search box (not url/search field) and click “Manage Search Engines…”. Remove the http://search.conduit.com search engine from the list of search providers by highlighting the selections and clicking remove.
Was this helpful to you? 541

Question owner

Hi ,

Thank you for the suggestions they were successful but it is not completely removed. I have fixed my hompage and the other search thing. But I still get the search.Conduit when I open a new Tab I have tried about:config >and then Keyword and reset that but it does not work. Thanks for your help!

Was this helpful to you? 46
  • Top 25 Contributor
529 solutions 5045 answers

You need to delete a user.js file then using the instructions in the link below.

SEE: https://support.mozilla.org/en-US/kb/how-to-fix-preferences-wont-save#w_user-js-file-overriding-preferences

Was this helpful to you? 19
  • Top 10 Contributor
  • Moderator
10756 solutions 96800 answers

Note that you shouldn't double-click a user.js file to open it as that will give an error (it is not a JScript file), but use it via the right-click context menu (Open with) in a text editor.

Was this helpful to you? 13
parkur 1 solutions 1 answers

Chosen Solution

I had the very same issue. Even when I tried deleting it from both my firefox and chrome extensions it still came up when I started either browsers. The only way I've found that this can be fixed is by removing the program using your control panel. Sometimes these crappy mal ware tool bars install actual programs and Search conduit is no different. When you display all your programs (after clicking add or remove programs) you should see a magnifying glass icon next to a program name " search protect". That is the search conduit program and it needs to be deleted. After uninstalling it , restart your browser and everything should be fine.

Was this helpful to you? 224
raw.sock 0 solutions 4 answers

Type about:config




Also search Conduit in the about:config, and see the below post I made about 3-4 replies down on how to clean registry. I tried to clean it up and I added pictures on how to fix it ect. There is a control on the newtab function inside the registry, changing the about:config won't 100% fix the problem, and probably will continue on reboot after conduit re-writes.

Modified by raw.sock

Was this helpful to you? 93
MsBernice7 0 solutions 1 answers

Thank you so, so much Parkur. I followed your instructions - which were so very simple - I like that sort - and I have got rid of it.

There are several other places on support where this same question has been asked.

Was this helpful to you? 6
swibbo1 1 solutions 2 answers

Have you downloaded any software such as utorrent or bittorrent? Both of these are bundled with an OpenCandy EULA which you have to sign, and it automatically installs search conduit on your computer. I had the same problem a couple of months ago, and as a result I no longer use BitTorrent or Utorrent as my torrent program.

I now use Tixati, and haven't had any problems with it thus far.

Sadly, the only way I got rid of it was by formatting my computer, because it infected all four of my browsers. I was lucky that the malware only infected one computer on my network, and not the other two.

Modified by swibbo1

Was this helpful to you? 8
raw.sock 0 solutions 4 answers

@swibbo1, I recently just received the malware from "orbitz downloader" from the official website, and yeah it did have install request as part of the bundle for orbitz, although I am currently using uTorrent and I had never recieved request or infection with the malware from uTorrent, where abouts did you see that open candy EULA with uTorrent? Just curious, I don't think that program gave me any problems, it all started right after the open candy bundle with orbitz downloader for me personally, but I'm sure they have plenty of programs they pay to be bundled with I suppose.

You don't have to format though, its pretty easy to get rid of; I could infect myself and show video of how to clean it, but basically it does require a little advanced knowledge in registry, besides that a simple anti malware bytes program could clean the files off your computer themselves, but the real problem is Search Conduit has run once registry keys that it enters, which are not cleaned by the average user of a computer as they are not use to using the regedit function.

I know I typed alot of mumbo in that above reply a few posts ago and you were probably replying to main original poster not me, but for the future maybe you can take 5-10 minutes and become accustom with the registry, it is your computers brain basically, without it windows and the hardware would not beable to communicate beyond some minor voltage controls @ bios setup.

In the registry there are specific entries called "Run", and "RunOnce", these are entries written for the computer to auto boot all programs on the list with entries, automatically at start up. This is where Search Conduit causes the most problems for people, as uninstalling the software does not undo the registry keys, and managing engines on the firefox dropdown does nothing to clean the infected computer from re-writing the conduit executables upon restart, if not before restart.

For those reading and wanted to get better idea of how to clean your computer from these re-writing/installing malware programs I tossed a couple screenshots together to show what I am talking about, its quite simple to learn and it helps 100x with malware and stuff like that.

Open "Run", type "Regedit" (Pic below) http://imageshack.us/a/img138/4559/5yyb.png

This will open the Computers Registry, here is a Pic of the window below http://imageshack.us/a/img27/1152/gj1z.png

Okay, now we can see two main entries that we will work with out of the 5 folders, we will use only the 2nd and 3rd one or more specifically, HKEY_CURRENT_USER and HKEY_LOCAL_MACHINE.

Now we visualize the two folders that contain all the malwares behind the scene instructions, these are where the programs are directed to open and install things over and over again when you try to remove or delete them ect, so we can solve this now pretty easy if you are following for anyone reading this, this is universal for all malware/virus ect.

So, we know these two folders, we will start with the 2nd one or "HKEY_CURRENT_USER" on your computer, so we click the folder and expand it so we can see all the folders it holds inside it, easy? Okay, now you've opened the folder and it shows this below: http://img541.imageshack.us/img541/8872/yx25.png

Okay, this looks like yours, so your really following me now, this is good. You see software folder I highlighted, this is the next folder we will expand, not many steps left so stay with me please!

Open software, if you are on a infected computer you will right away see "Conduit" in the folder list, its alphabetical by the way, so it would be in the C named folders near the top! See below: http://imageshack.us/a/img36/8520/1yt.bmp

Okay you see the folder, you will delete "conduit" from the softwares list of folders, this is something you can feel comfortrable about doing, just don't delete anything but the specific "conduit" named folder, leave everything else. :D

So, we just deleted Conduits main software folder in the registry entry "HKEY_CURRENT_USER/Software" folder, so now we will go ahead and navigate further into the expanding folders, now that you are still in software, continue searching down to the Microsoft folder, near the M alphabetical order obviously.

Good you found Microsoft folder that is inside the software folder, now navigate to the folder called "Windows" inside the Microsoft folder which is inside the main software parent folder, you have expanded 3 folders, you see inside the "Windows" folder there is another folder called "CurrentVersion", and inside that folder is "Run" folder and "RunOnce" folder. You found the start up programs for the computers registry current user directory, congrats, this list inside the "Run" folder contains start up programs entries that tell the computer which application to start, and the location or target of the program its being told to start see pic below: http://imageshack.us/a/img22/9369/ja2b.png

You see on that list above in the picture, its 3 entries, 2 of them are for my legitimate programs, I created a Conduit one for you to visualize, this is where it will be on your computer, it will have Conduit as key name, and the data where it says EXAMPLE will just be a path to the conduit malware its starting!

You can safely delete that "Search Conduit" entry, or just "Conduit".

Okay we are 50% done, you did the main directory for "HKEY_CURRENT_USER" but we still need to do "HKEY_LOCAL MACHINE" folder, and expand that so we can do the SAME STEPS as above in current user directory, simple right? I made more pics just the same thing but this time in the 3rd folder, should be getting easy by now... There is the main folder here in LOCAL MACHINE: http://imageshack.us/a/img841/7205/3eew.png

Now you navigate to Software> and then Look for Conduit. http://imageshack.us/a/img593/4963/bc5c.png

under local machine and inside software folder, its called "conduit" on the list, delete Conduit as shown in the picture.

okay now we just gotta locate the same "Run" and "RunOnce" folders as we did before but this time we will stay under this new "LOCAL MACHINE" directory instead of being under CURRENT USER as before.

After deleting conduit on the list, move down to Microsoft folder again, expand, navigate to "Windows", expand it, and look for "Currentversion" folder. Inside the CurrentVersion folder locate "Run" folder, open it and inside it find "Conduit" or any related conduit seach protector entries as shown in the picture below: http://imageshack.us/a/img823/5093/uc9o.png

Delete only the conduit, now your registry is free of main conduit folders, and free of re-writing on restart of the malware!, now the only step left is to delete the physical files it was pointing to, how to do that easily you ask?

Use http://www.malwarebytes.org/mwb-download/

This antimalware program will clean all physical files, but you might want to check the registry yourself as it did not clean mine, but after I cleaned registry, then scanned with anti malware, it asked me to restart after quick scan finished, did so and it was 100% gone, I would recommend using the registry tips and guide I provided or else it will end up most likely re-writing on restart. I am on windows XP guys, but these steps are much the same on win8, the directories will be the same!

Good luck, I just removed this a few days ago, but for person who isn't used to using registry you don't have to formatt, you can follow the steps above to fix it. 100%.

Was this helpful to you? 82

Question owner

Thank you very much ! That was the solution! And also thanks to the other people that replied!

Was this helpful to you? 1
not_natalie_portman 0 solutions 1 answers

You have to manually reset the new tab settings in about:config.

Solution here.

Worked perfectly!

Modified by not_natalie_portman

Was this helpful to you? 19
tpersil 0 solutions 1 answers

to rawsock-thanks for the info. I searched for conduit in regedit and it finally ran out of contacts. I never knew that if regedit could not find an entry it could be still hidden. I kept a copy of your post just in case. I found NO entries in local machine only in current user so I guess that the conduit entries I deleted were in local machine. I have always believed to attack malware in the registery. the worse that can happen is to reinstall something or format and rebuild the whole machine or reinstall my backup or restore to a restore point. IT SURE SEEMS TO HAVE SOLVED THE PROBLEM. tpersil

Was this helpful to you? 2
jmstechjohn 0 solutions 1 answers


Used this and it fixed the problem!


Was this helpful to you? 5
Rich9778 0 solutions 1 answers

How I got this ...

I remember it perfectly, I googled Java,chose the first thing that came up and clicked download, accept, accept, accept and then realized it wasn't Java's site!!!! I knew better but was in a hurry. Why Google allows these sites to be on their search is beyond me.

Was this helpful to you? 3
itsashishyadav 0 solutions 1 answers

Just go to the Control Panel. uninstall the program name "search protect" . Restart your browser.

Was this helpful to you? 8
Neilfox 3 solutions 42 answers

Just a quick note that search conduit can also hijack Firefox's shortcut with an extra command line in the target field, so it would be a good idea to check this as well and fix it. See this:


Scanning your computer with Malwarebytes and AdwCleaner wouldn't hurt.




Was this helpful to you? 8
ssum 0 solutions 2 answers

Conduit added itself to my search engines.

Conduit hijacked my New Tab default.

I uninstalled conduit from Add/Remove programs.

I had not yet restarted Firefox.

I tried to uninstall search protect from Add/Remove programs.

I had not yet restarted Firefox or rebooted.

The uninstall process froze.

I used Process Explorer to examine the uninstall application and file location.

It was in the lower part (under explorer.exe I deleted it from memory. I think it was au.exe. Process Explorer shows the path.

Add-Remove process unfroze without restarting it.

I tried renaming it (in its location as shown by Process Explorer).

I tried uninstalling again and it froze Add/Remove again.

It saw from Process Explorer that it was recreated which meant there was a process still in memory. I search Process Explorer window above the explorer.exe applications and found conduit there (I don't remember the exact process names. There was a process tree, with sub-processes.

I deleted it from memory and then could continue with the Add/Remove uninstall process.

At this point I have not restarted Firefox so it still shows up in a New Tab.

I am writing now to give anyone it is useful too some insight.

If it is still hanging around after Firefox reboot I will add this to my account.here.

Was this helpful to you? 0
  • Top 10 Contributor
  • Moderator
10756 solutions 96800 answers

Try to boot the computer in Windows Safe Mode with network support (press F8 on the boot screen) as a test to see if that helps.

Was this helpful to you? 0
ssum 0 solutions 2 answers

When I rebooted Firefox and opened a New Tab the conduit search page was still happening.

I looked at the advice above to: You need to delete a user.js file then using the instructions in the link below.....

SEE: https://support.mozilla.org/en-US/kb/how-to-fix-preferences-wont-save#w_user-js-file-overriding-preferences

Which suggested deleting user.js....but there was no user.js in the Firefox Profiles subfolder it takes one to.

I opened pres.js in Notepad and did a search for "conduit".

I found it there with this statement:


user_pref("browser.newtab.url", "http://search.conduit.com/?ctid=CT3320691&octid=EB_ORIGINAL_CTID&SearchSource=69&CUI=&SSPV=&Lay=1&UM=4&UP=SPE6FFFC8C-BA28-44C9-BD57-81CD2E6BB63E");


I deleted the whole statement and this seems to have cured it. After rebooting Firefox another user_pref `newtab' statement that was immediately below it seem to also be deleted.

Do Not Delete The Whole File.

Modified by ssum

Was this helpful to you? 1
hroy80 1 solutions 3 answers

Hi dear,

Instructions for Opera browser:

Here is few instructions which can help you to maintain your default search and default homepage for your browser. And if in future too it happens you can follow this steps and get rid of such unnecessary involuntary attacks.

  1. Go to "Menu bar"
  2. Click on "Settings"
  3. Go to "Preferences"
  4. In 'General' tab select 'Start with home page' in "start up"
  5. And then in "Home page" mention your decided home page or which you looking for as your home page.
  6. Click "Ok" once you done with the above mentioned instructions

Finally restart your Browser and enjoy your home page with a smile These days an adware is very often attacks browser of many computer user "Conduit search protect" and if you want to get rid of it kindly follow this ||edit by a forum moderator. Please do not post links to sites advertising & providing paid for support to remove malware. ~J99||

Modified by John99

Was this helpful to you? 11
Ask a question

You must log in to your account to reply to posts. Please start a new question, if you do not have an account yet.