Conduit in registry

[alhazred]

Hi folks,

 

Just thought I'd let you know that MBAM missed a PUP in the registry:  HKCU\Software\Conduit and might be worth adding to the detections.  It did successfully find all Conduit traces in the Temporary Internet Files and TEMP locations though.  The program I installed came bundled with Conduit, and I wisely chose to opt out of having Conduit installed.  Now, I'm not a computer genius but I'm guessing it had to create the TEMP files in preparation for if you do choose to install it.

[AdvancedSetup]

Thank you for the feedback but without very detailed logs of what was installed and where we would not be able to add an entry.  We can't just blindly remove registry keys or that could cause all type of harm to a computer.

[alhazred]

Hi Ron,

 

The program in question was Divx 10.  I'm not sure how I'd go about producing and submitting those detailed logs though! 

[AdvancedSetup]

That's okay.  Its always an ongoing issue and we update around the clock. If we don't catch it now we will soon from someone else.

 

Thanks again

[alhazred]

This is why I have four licenses of MBAM for myself and family members; it is not just the excellent programs you create but also the strong community of malware hunters on these forums which deserve praise for the work they do!

 

Cheers Ron! 

[Firefox]

I have Divx on my rig, and it was installed with Roxio Creator Suite, it told me there was an update for it and if I wanted to install it. I went ahead and started the install. During the install process it wanted to install a toolbar (conduit) and I unchecked it. It did however download to a temp folder the install files for conduit, and during my next scheduled scan of MBAM, it picked up those as PUP.

Wonder it its the same thing for you?

[alhazred]

Hi Firefox,

 

Yes, that is exactly what happened with me.  There were two boxes pre-checked.  One was for opting in to install the Divx Toolbar, and the other was for opting in to install and have Conduit as the default search engine.  I unchecked them, but when I ran MBAM it detected Conduit in the temp folder.  It was like the files were waiting gleefully for when an unsuspecting user would choose to install the bundled PUP's and they could begin the nefarious installation.  Many users on the Divx forums are expressing their dissatisfaction with this bundle of PUPS.  I wouldn't mind so much if on choosing not to install said PUP's all the Conduit files were then automatically deleted from the temp folder and registry, but they aren't, and that to me is unacceptable.

[AdvancedSetup]

The files still get extracted from the installer regardless if you check or do not check the option to install.  If you check do not install it won't install but the files have to extract because that is just how the installer process works.  Then when done a good installer would clean up after itself (but typically almost no installer will). 

 

Thanks

[Firefox]

Yeah all mine were found only in the temp folders, and I did not find any in the registry though. The Divx update borked and did not install successfully on my computer so I just installed the older version once again. I will skip that update I suppose.

[AdvancedSetup]

I stopped doing the Divx thing a long time ago.  I even purchased it at one time.  Now days I typically install VLC and there just isn't much content I've run into that it can't play.

[Firefox]

Yeah I have never bought it, it just came bundled with my Roxio software and I went with the default install which installed it, I really do not use the player, I also use VLC for most of my video watching....