Malwarebyte missed Search Project Conduit

[ukbirdflu]

Found this on my laptop and found it was from the installation of a free Specsoft Audio Converter. By mistake I clicked express installation which installed this browser hijacker. I have version 1.75.0.1300 and the signature updater was set to run every other night. All protection was fully turned on.

 

Was quite disappointed to see Malwarebytes did not even whisper a sound when Search Project Conduit was being installed. I installed this software purely to stop these toolbars being installed and it failed to perform.

 

The only thing was this search project conduit was quite straight forward to remove, so not much time was wasted.

[shadowwar]

Can you provide the file that caused this here so we can get this added? A zipped file attached or the link would be needed.

[Guest 0x30000030]

shadowwar,

 

Malware lab - look

[David H. Lipman]

shadowwar,

 

Malware lab - look

 

Rich has enough of a job creating signatures for the Malwarebytes signature product. 

 

Please help him out by POSTING the file in;  Research Center --> Newest Malware Threats  And not asking him to use up his valuable time by searching for them.

[shadowwar]

David.

 

Thats what he did.

 

Thanks 0x3000030

[David H. Lipman]

Awesome. 

Thanx for the update Rich.

 

EDIT:

 

I see I mistakenly inferred the wrong information from the words "Malware lab" which were used instead of "posted in the  Research Center"

 

My mistake - my apologies.

[ukbirdflu]

Thanks for replying. The sodtware I got the malware from can be found on this site:

 

http://www.spesoft.com/spesoftaudioconverter.aspx

 

When you install the converter, you will come to a window where it asks you to use express or custom, to be fair it says expressly what it will be installed, I just did not look.

 

I have clened up my laptop complete so I am unable to send you anything. Sorry.

[ukbirdflu]

One thing more, I didn't know where to report this. A few days ago a window pop up (completely dodged Firefox's pop up blocker), It says on this window "There is a new codec pack version, install new version now for better performance". The address of this page is:

 

http://www.codwide.com/lp/codecperformer/v18/?v=18&cid=4499&clickid=00007584p7297054153

If you look up codwide.com on google you will see a host of warning saying all the downloads from this site is full of browser hijacking malwares. One of the warning site is this:

 

http://www.onlinethreatalerts.com/article/2014/1/31/the-website-www-codwide-com-software-contain-potentially-unwanted-programs/

 

I think Malwarebyte can put codwide.com on its page blocking database.

 

Thanks

[shadowwar]

Ok thanks. We will look into this.  I have let our blocklist Researcher know about the url.