PUA.Win32.Conduit.GS

Publish Date: 07 Januar 2020

Analyse von: Arvin Roi Macaraeg

Riskware/Conduit(FORTINET); HEUR:AdWare.Win32.Conduit.gen(KASPERSKY)

Plattform:

Windows

Risikobewertung (gesamt):

Schadenspotenzial::

Verteilungspotenzial::

reportedInfection:

Trend Micro Lösungen:

Niedrig

Mittel

Hoch

Kritisch

Malware-Typ:
Potentially Unwanted Application
Zerstrerisch?:
Nein
Verschlsselt?:
In the wild::
Ja

Überblick

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Technische Details

Übertragungsdetails

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

Schleust die folgenden Dateien ein:

%Application Data%\Mozilla\Firefox\Profiles\{Random Characters}.default\extensions\{51a86bb3-6602-4c85-92a5-130ee4864f13}\setup.ini
%Application Data%\Mozilla\Firefox\Profiles\{Random Characters}.default\extensions\{51a86bb3-6602-4c85-92a5-130ee4864f13}\chrome.manifest
%Application Data%\Mozilla\Firefox\Profiles\{Random Characters}.default\extensions\{51a86bb3-6602-4c85-92a5-130ee4864f13}\install.rdf
%Application Data%\Mozilla\Firefox\Profiles\{Random Characters}.default\extensions\{51a86bb3-6602-4c85-92a5-130ee4864f13}\version.txt
%Application Data%\Mozilla\Firefox\Profiles\{Random Characters}.default\extensions\{51a86bb3-6602-4c85-92a5-130ee4864f13}\chrome\brothersoft_extreme.jar
%Application Data%\Mozilla\Firefox\Profiles\{Random Characters}.default\extensions\{51a86bb3-6602-4c85-92a5-130ee4864f13}\components\ConduitAutoCompleteSearch.js
%Application Data%\Mozilla\Firefox\Profiles\{Random Characters}.default\extensions\{51a86bb3-6602-4c85-92a5-130ee4864f13}\components\ConduitAutoCompleteSearch.xpt
%Application Data%\Mozilla\Firefox\Profiles\{Random Characters}.default\extensions\{51a86bb3-6602-4c85-92a5-130ee4864f13}\components\ConduitToolbar.idl
%Application Data%\Mozilla\Firefox\Profiles\{Random Characters}.default\extensions\{51a86bb3-6602-4c85-92a5-130ee4864f13}\components\ConduitToolbar.js
%Application Data%\Mozilla\Firefox\Profiles\{Random Characters}.default\extensions\{51a86bb3-6602-4c85-92a5-130ee4864f13}\components\ConduitToolbar.xpt
%Application Data%\Mozilla\Firefox\Profiles\{Random Characters}.default\extensions\{51a86bb3-6602-4c85-92a5-130ee4864f13}\components\FFExternalAlert.dll
%Application Data%\Mozilla\Firefox\Profiles\{Random Characters}.default\extensions\{51a86bb3-6602-4c85-92a5-130ee4864f13}\components\FFExternalAlert.xpt
%Application Data%\Mozilla\Firefox\Profiles\{Random Characters}.default\extensions\{51a86bb3-6602-4c85-92a5-130ee4864f13}\components\RadioWMPCore.dll
%Application Data%\Mozilla\Firefox\Profiles\{Random Characters}.default\extensions\{51a86bb3-6602-4c85-92a5-130ee4864f13}\components\RadioWMPCore.xpt
%Application Data%\Mozilla\Firefox\Profiles\{Random Characters}.default\extensions\{51a86bb3-6602-4c85-92a5-130ee4864f13}\defaults\alertSettingsComponent.xml
%Application Data%\Mozilla\Firefox\Profiles\{Random Characters}.default\extensions\{51a86bb3-6602-4c85-92a5-130ee4864f13}\defaults\appContextMenu.xml
%Application Data%\Mozilla\Firefox\Profiles\{Random Characters}.default\extensions\{51a86bb3-6602-4c85-92a5-130ee4864f13}\defaults\default_radio_skin.xml
%Application Data%\Mozilla\Firefox\Profiles\{Random Characters}.default\extensions\{51a86bb3-6602-4c85-92a5-130ee4864f13}\defaults\engineContextMenu.xml
%Application Data%\Mozilla\Firefox\Profiles\{Random Characters}.default\extensions\{51a86bb3-6602-4c85-92a5-130ee4864f13}\defaults\engineSettings.json
%Application Data%\Mozilla\Firefox\Profiles\{Random Characters}.default\extensions\{51a86bb3-6602-4c85-92a5-130ee4864f13}\defaults\fbAlert.js
%Application Data%\Mozilla\Firefox\Profiles\{Random Characters}.default\extensions\{51a86bb3-6602-4c85-92a5-130ee4864f13}\defaults\getAppsContextMenu.xml
%Application Data%\Mozilla\Firefox\Profiles\{Random Characters}.default\extensions\{51a86bb3-6602-4c85-92a5-130ee4864f13}\defaults\postAppsContextMenu.xml
%Application Data%\Mozilla\Firefox\Profiles\{Random Characters}.default\extensions\{51a86bb3-6602-4c85-92a5-130ee4864f13}\defaults\toolbarContextMenu.xml
%Application Data%\Mozilla\Firefox\Profiles\{Random Characters}.default\extensions\{51a86bb3-6602-4c85-92a5-130ee4864f13}\defaults\unsharedAppsContextMenu.xml
%Application Data%\Mozilla\Firefox\Profiles\{Random Characters}.default\extensions\{51a86bb3-6602-4c85-92a5-130ee4864f13}\lib\xpcom.js
%Application Data%\Mozilla\Firefox\Profiles\{Random Characters}.default\extensions\{51a86bb3-6602-4c85-92a5-130ee4864f13}\META-INF\manifest.mf
%Application Data%\Mozilla\Firefox\Profiles\{Random Characters}.default\extensions\{51a86bb3-6602-4c85-92a5-130ee4864f13}\META-INF\zigbert.rsa
%Application Data%\Mozilla\Firefox\Profiles\{Random Characters}.default\extensions\{51a86bb3-6602-4c85-92a5-130ee4864f13}\META-INF\zigbert.sf
%Application Data%\Mozilla\Firefox\Profiles\{Random Characters}.default\extensions\{51a86bb3-6602-4c85-92a5-130ee4864f13}\searchplugin\conduit.gif
%Application Data%\Mozilla\Firefox\Profiles\{Random Characters}.default\extensions\{51a86bb3-6602-4c85-92a5-130ee4864f13}\searchplugin\conduit.ico
%Application Data%\Mozilla\Firefox\Profiles\{Random Characters}.default\extensions\{51a86bb3-6602-4c85-92a5-130ee4864f13}\searchplugin\conduit.PNG
%Application Data%\Mozilla\Firefox\Profiles\{Random Characters}.default\extensions\{51a86bb3-6602-4c85-92a5-130ee4864f13}\searchplugin\conduit.src
%Application Data%\Mozilla\Firefox\Profiles\{Random Characters}.default\extensions\{51a86bb3-6602-4c85-92a5-130ee4864f13}\searchplugin\conduit.xml
%Program Files%\BrotherSoft_Extreme\UNWISE.EXE
%Program Files%\BrotherSoft_Extreme\toolbar.cfg
%Program Files%\BrotherSoft_Extreme\BrotherSoft_ExtremeToolbarHelper.exe
%Program Files%\BrotherSoft_Extreme\tbBrot.dll
%Program Files%\BrotherSoft_Extreme\GottenAppsContextMenu.xml
%Program Files%\BrotherSoft_Extreme\OtherAppsContextMenu.xml
%Program Files%\BrotherSoft_Extreme\SharedAppsContextMenu.xml
%Program Files%\BrotherSoft_Extreme\ToolbarContextMenu.xml
%Program Files%\ConduitEngine\toolbar.cfg
%Program Files%\ConduitEngine\ConduitEngineUninstall.exe
%Program Files%\ConduitEngine\appContextMenu.xml
%Program Files%\ConduitEngine\engineContextMenu.xml
%Program Files%\ConduitEngine\EngineSettings.json
%Program Files%\ConduitEngine\ConduitEngineHelper.exe
%Program Files%\ConduitEngine\ConduitEngine.dll
%Program Files%\ConduitEngine\INSTALL.LOG
%User Temp%\BrotherSoft_Extreme.exe

(Hinweis: %Application Data% ist der Ordner 'Anwendungsdaten' für den aktuellen Benutzer, normalerweise C:\Windows\Profile\{Benutzername}\Anwendungsdaten unter Windows 98 und ME, C:\WINNT\Profile\{Benutzername}\Anwendungsdaten unter Windows NT, C:\Dokumente und Einstellungen\{Benutzername}\Lokale Einstellungen\Anwendungsdaten unter Windows 2000(32-bit), XP und Server 2003(32-bit) und C:\Users\{Benutzername}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) und 10(64-bit).. %Program Files%ist der Standardordner 'Programme', normalerweise C:\Programme.. %User Temp% ist der Ordner 'Temp' des aktuellen Benutzers, normalerweise C:\Dokumente und Einstellungen\{Benutzername}\Lokale Einstellungen\Temp unter Windows 2000(32-bit), XP und Server 2003(32-bit) und C:\Users\{Benutzername}\AppData\Local\Temp unter Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) und 10(64-bit).)

Andere Details

It connects to the following possibly malicious URL:

brothersoftextreme.{BLOCKED}lbar.com

Es macht Folgendes:

It adds the following lines:
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BrotherSoft_Extreme Toolbar
  DisplayName = BrotherSoft_Extreme Toolbar
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BrotherSoft_Extreme Toolbar
  UninstallString = %Program Files%\BROTHE~1\UNWISE.EXE /U %Program Files%\BROTHE~1\INSTALL.LOG
- HKEY_CURRENT_USER\Software\AppDataLow\Software\BrotherSoft_Extreme\toolbar\IE5
  CabinetVisible = FALSE
- HKEY_CURRENT_USER\Software\AppDataLow\Software\BrotherSoft_Extreme\toolbar\IE5
  ExplorerVisible = FALSE
- HKEY_CURRENT_USER\Software\AppDataLow\Software\BrotherSoft_Extreme\toolbar\IE5
  FirstTime = TRUE
- HKEY_CURRENT_USER\Software\AppDataLow\Software\BrotherSoft_Extreme\toolbar\IE5
  Visible = TRUE
- HKEY_CURRENT_USER\Software\AppDataLow\Software\BrotherSoft_Extreme\toolbar\settings
  EnableSearchFromAdress = TRUE
- HKEY_CURRENT_USER\Software\AppDataLow\Software\BrotherSoft_Extreme\toolbar\settings
  FixPageNotFoundError = 1
- HKEY_CURRENT_USER\Software\AppDataLow\Software\BrotherSoft_Extreme\toolbar\settings
  SearchFromAdressUrl = http://search.conduit.com/ResultsExt.aspx?ctid=CT2776682&q=MYSEARCHTERM
- HKEY_CURRENT_USER\Software\AppDataLow\Software\BrotherSoft_Extreme\toolbar\settings\LanguagePack
  LanguagePackServerUrl = http://translation.users.conduit.com/Translation.ashx
- HKEY_CURRENT_USER\Software\AppDataLow\Software\BrotherSoft_Extreme\toolbar
  GroupingServerURL = http://grouping.services.conduit.com/
- HKEY_CURRENT_USER\Software\AppDataLow\Software\BrotherSoft_Extreme\toolbar
  SearchServerUrl = http://search.conduit.com
- HKEY_CURRENT_USER\Software\AppDataLow\Software\BrotherSoft_Extreme\toolbar
  Server = users.conduit.com
- HKEY_CURRENT_USER\Software\AppDataLow\Software\BrotherSoft_Extreme\toolbar
  ShouldPerformGroupByOS = FALSE
- HKEY_CURRENT_USER\Software\AppDataLow\Software\BrotherSoft_Extreme\toolbar
  UsageURL = http://usage.users.conduit.com/UsersWebService.asmx/UsersRequests
- HKEY_CURRENT_USER\Software\AppDataLow\Software\BrotherSoft_Extreme\toolbar
  WebServerUrl = http://BrotherSoftExtreme.OurToolbar.com/
- HKEY_CURRENT_USER\Software\AppDataLow\Software\BrotherSoft_Extreme\toolbar
  Write us link = forrest@brothersoft.com
- HKEY_CURRENT_USER\Software\AppDataLow\Software\BrotherSoft_Extreme\toolbar\settings
  ShouldSendReferalCookie = TRUE
- HKEY_LOCAL_MACHINE\SOFTWARE\BrotherSoft_Extreme\Communicator
  Url = http://servicemap.conduit-services.com/Toolbar/
- HKEY_LOCAL_MACHINE\SOFTWARE\BrotherSoft_Extreme\toolbar
  ComId = {51a86bb3-6602-4c85-92a5-130ee4864f13}
- HKEY_LOCAL_MACHINE\SOFTWARE\BrotherSoft_Extreme\toolbar
  DisplayName = BrotherSoft Extreme
- HKEY_LOCAL_MACHINE\SOFTWARE\BrotherSoft_Extreme\toolbar
  DisplayTitle = BrotherSoft_Extreme Toolbar
- HKEY_LOCAL_MACHINE\SOFTWARE\BrotherSoft_Extreme\toolbar
  GroupingEnabled = FALSE
- HKEY_LOCAL_MACHINE\SOFTWARE\BrotherSoft_Extreme\toolbar
  InstallationId = integrated_brothersoft_extrme.exe
- HKEY_LOCAL_MACHINE\SOFTWARE\BrotherSoft_Extreme\toolbar
  InstallationType = conduitintegration
- HKEY_LOCAL_MACHINE\SOFTWARE\BrotherSoft_Extreme\toolbar
  MultiCommunityEnabled = FALSE
- HKEY_LOCAL_MACHINE\SOFTWARE\BrotherSoft_Extreme\toolbar
  Path = %Program Files%\BrotherSoft_Extreme
- HKEY_LOCAL_MACHINE\SOFTWARE\BrotherSoft_Extreme\toolbar
  Server = users.conduit.com
- HKEY_LOCAL_MACHINE\SOFTWARE\BrotherSoft_Extreme\toolbar
  ShouldPerformGroupByOS = FALSE
- HKEY_LOCAL_MACHINE\SOFTWARE\BrotherSoft_Extreme\toolbar
  ShouldShowPersonalComponentDlg = TRUE
- HKEY_LOCAL_MACHINE\SOFTWARE\BrotherSoft_Extreme\toolbar
  SponsorId = CT2776682
- HKEY_LOCAL_MACHINE\SOFTWARE\BrotherSoft_Extreme\toolbar
  ToolbarHelperFileName = %Program Files%\BrotherSoft_Extreme\BrotherSoft_ExtremeToolbarHelper.exe
- HKEY_LOCAL_MACHINE\SOFTWARE\Conduit\Platforms\{51a86bb3-6602-4c85-92a5-130ee4864f13}
  Name = BrotherSoft_Extreme
- HKEY_LOCAL_MACHINE\SOFTWARE\BrotherSoft_Extreme\toolbar
  PlatformType = ConduitToolbar
- HKEY_LOCAL_MACHINE\SOFTWARE\BrotherSoft_Extreme\toolbar
  IsEngineHost = TRUE
- HKEY_LOCAL_MACHINE\SOFTWARE\BrotherSoft_Extreme\toolbar
  AllowToUninstallFromEngine = FALSE
- HKEY_LOCAL_MACHINE\SOFTWARE\BrotherSoft_Extreme\toolbar
  ForceEngineUninstall = TRUE
- HKEY_LOCAL_MACHINE\SOFTWARE\BrotherSoft_Extreme\toolbar
  IphoneUpdateURL = {Default}
- HKEY_LOCAL_MACHINE\SOFTWARE\BrotherSoft_Extreme\toolbar
  ShouldSendToolbarAge = TRUE
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\conduitEngine
  DisplayName = Conduit Engine
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\conduitEngine
  UninstallString = %Program Files%\ConduitEngine\ConduitEngineUninstall.exe
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\conduitEngine
  DisplayIcon = %Program Files%\ConduitEngine\ConduitEngineUninstall.exe
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\conduitEngine
  DisplayVersion = 6.1.0.7
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\conduitEngine
  Publisher = Conduit Ltd.
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\conduitEngine
  Comments = {Default}
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\conduitEngine
  Contact = {Default}
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\conduitEngine
  DisplayIcon = %Program Files%\CONDUI~1\ConduitEngineUninstall.exe
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\conduitEngine
  DisplayVersion = {Default}
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\conduitEngine
- HelpLink = {Default}
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\conduitEngine
  UninstallString = %Program Files%\CONDUI~1\ConduitEngineUninstall.exe
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\conduitEngine
  URLInfoAbout = {Default}

Lösungen

Mindestversion der Scan Engine: 9.850

SSAPI Pattern-Datei: 2.243.00

SSAPI Pattern veröffentlicht am: 19 Dezember 2019

Step 1

Für Windows ME und XP Benutzer: Stellen Sie vor einer Suche sicher, dass die Systemwiederherstellung deaktiviert ist, damit der gesamte Computer durchsucht werden kann.

Step 2

Note that not all files, folders, and registry keys and entries are installed on your computer during this malware's/spyware's/grayware's execution. This may be due to incomplete installation or other operating system conditions. If you do not find the same files/folders/registry information, please proceed to the next step.

Step 3

Diesen Registrierungswert löschen

[ learnMore ]

Wichtig: Eine nicht ordnungsgemäße Bearbeitung der Windows Registrierung kann zu einer dauerhaften Fehlfunktion des Systems führen. Führen Sie diesen Schritt nur durch, wenn Sie mit der Vorgehensweise vertraut sind oder wenn Sie Ihren Systemadministrator um Unterstützung bitten können. Lesen Sie ansonsten zuerst diesen Microsoft Artikel, bevor Sie die Registrierung Ihres Computers ändern.

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BrotherSoft_Extreme Toolbar
- DisplayName = BrotherSoft_Extreme Toolbar
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BrotherSoft_Extreme Toolbar
- UninstallString = %Program Files%\BROTHE~1\UNWISE.EXE /U %Program Files%\BROTHE~1\INSTALL.LOG
In HKEY_CURRENT_USER\Software\AppDataLow\Software\BrotherSoft_Extreme\toolbar\IE5
- CabinetVisible = FALSE
In HKEY_CURRENT_USER\Software\AppDataLow\Software\BrotherSoft_Extreme\toolbar\IE5
- ExplorerVisible = FALSE
In HKEY_CURRENT_USER\Software\AppDataLow\Software\BrotherSoft_Extreme\toolbar\IE5
- FirstTime = TRUE
In HKEY_CURRENT_USER\Software\AppDataLow\Software\BrotherSoft_Extreme\toolbar\IE5
- Visible = TRUE
In HKEY_CURRENT_USER\Software\AppDataLow\Software\BrotherSoft_Extreme\toolbar\settings
- EnableSearchFromAdress = TRUE
In HKEY_CURRENT_USER\Software\AppDataLow\Software\BrotherSoft_Extreme\toolbar\settings
- FixPageNotFoundError = 1
In HKEY_CURRENT_USER\Software\AppDataLow\Software\BrotherSoft_Extreme\toolbar\settings
- SearchFromAdressUrl = http://search.conduit.com/ResultsExt.aspx?ctid=CT2776682&q=MYSEARCHTERM
In HKEY_CURRENT_USER\Software\AppDataLow\Software\BrotherSoft_Extreme\toolbar\settings\LanguagePack
- LanguagePackServerUrl = http://translation.users.conduit.com/Translation.ashx
In HKEY_CURRENT_USER\Software\AppDataLow\Software\BrotherSoft_Extreme\toolbar
- GroupingServerURL = http://grouping.services.conduit.com/
In HKEY_CURRENT_USER\Software\AppDataLow\Software\BrotherSoft_Extreme\toolbar
- SearchServerUrl = http://search.conduit.com
In HKEY_CURRENT_USER\Software\AppDataLow\Software\BrotherSoft_Extreme\toolbar
- Server = users.conduit.com
In HKEY_CURRENT_USER\Software\AppDataLow\Software\BrotherSoft_Extreme\toolbar
- ShouldPerformGroupByOS = FALSE
In HKEY_CURRENT_USER\Software\AppDataLow\Software\BrotherSoft_Extreme\toolbar
- UsageURL = http://usage.users.conduit.com/UsersWebService.asmx/UsersRequests
In HKEY_CURRENT_USER\Software\AppDataLow\Software\BrotherSoft_Extreme\toolbar
- WebServerUrl = http://BrotherSoftExtreme.OurToolbar.com/
In HKEY_CURRENT_USER\Software\AppDataLow\Software\BrotherSoft_Extreme\toolbar
- Write us link = forrest@brothersoft.com
In HKEY_CURRENT_USER\Software\AppDataLow\Software\BrotherSoft_Extreme\toolbar\settings
- ShouldSendReferalCookie = TRUE
In HKEY_LOCAL_MACHINE\SOFTWARE\BrotherSoft_Extreme\Communicator
- Url = http://servicemap.conduit-services.com/Toolbar/
In HKEY_LOCAL_MACHINE\SOFTWARE\BrotherSoft_Extreme\toolbar
- ComId = {51a86bb3-6602-4c85-92a5-130ee4864f13}
In HKEY_LOCAL_MACHINE\SOFTWARE\BrotherSoft_Extreme\toolbar
- DisplayName = BrotherSoft Extreme
In HKEY_LOCAL_MACHINE\SOFTWARE\BrotherSoft_Extreme\toolbar
- DisplayTitle = BrotherSoft_Extreme Toolbar
In HKEY_LOCAL_MACHINE\SOFTWARE\BrotherSoft_Extreme\toolbar
- GroupingEnabled = FALSE
In HKEY_LOCAL_MACHINE\SOFTWARE\BrotherSoft_Extreme\toolbar
- InstallationId = integrated_brothersoft_extrme.exe
In HKEY_LOCAL_MACHINE\SOFTWARE\BrotherSoft_Extreme\toolbar
- InstallationType = conduitintegration
In HKEY_LOCAL_MACHINE\SOFTWARE\BrotherSoft_Extreme\toolbar
- MultiCommunityEnabled = FALSE
In HKEY_LOCAL_MACHINE\SOFTWARE\BrotherSoft_Extreme\toolbar
- Path = %Program Files%\BrotherSoft_Extreme
In HKEY_LOCAL_MACHINE\SOFTWARE\BrotherSoft_Extreme\toolbar
- Server = users.conduit.com
In HKEY_LOCAL_MACHINE\SOFTWARE\BrotherSoft_Extreme\toolbar
- ShouldPerformGroupByOS = FALSE
In HKEY_LOCAL_MACHINE\SOFTWARE\BrotherSoft_Extreme\toolbar
- ShouldShowPersonalComponentDlg = TRUE
In HKEY_LOCAL_MACHINE\SOFTWARE\BrotherSoft_Extreme\toolbar
- SponsorId = CT2776682
In HKEY_LOCAL_MACHINE\SOFTWARE\BrotherSoft_Extreme\toolbar
- ToolbarHelperFileName = %Program Files%\BrotherSoft_Extreme\BrotherSoft_ExtremeToolbarHelper.exe
In HKEY_LOCAL_MACHINE\SOFTWARE\Conduit\Platforms\{51a86bb3-6602-4c85-92a5-130ee4864f13}
- Name = BrotherSoft_Extreme
In HKEY_LOCAL_MACHINE\SOFTWARE\BrotherSoft_Extreme\toolbar
- PlatformType = ConduitToolbar
In HKEY_LOCAL_MACHINE\SOFTWARE\BrotherSoft_Extreme\toolbar
- IsEngineHost = TRUE
In HKEY_LOCAL_MACHINE\SOFTWARE\BrotherSoft_Extreme\toolbar
- AllowToUninstallFromEngine = FALSE
In HKEY_LOCAL_MACHINE\SOFTWARE\BrotherSoft_Extreme\toolbar
- ForceEngineUninstall = TRUE
In HKEY_LOCAL_MACHINE\SOFTWARE\BrotherSoft_Extreme\toolbar
- IphoneUpdateURL = {Default}
In HKEY_LOCAL_MACHINE\SOFTWARE\BrotherSoft_Extreme\toolbar
- ShouldSendToolbarAge = TRUE
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\conduitEngine
- DisplayName = Conduit Engine
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\conduitEngine
- UninstallString = %Program Files%\ConduitEngine\ConduitEngineUninstall.exe
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\conduitEngine
- DisplayIcon = %Program Files%\ConduitEngine\ConduitEngineUninstall.exe
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\conduitEngine
- DisplayVersion = 6.1.0.7
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\conduitEngine
- Publisher = Conduit Ltd.
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\conduitEngine
- Comments = {Default}
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\conduitEngine
- Contact = {Default}
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\conduitEngine
- DisplayIcon = %Program Files%\CONDUI~1\ConduitEngineUninstall.exe
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\conduitEngine
- DisplayVersion = {Default}
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\conduitEngine
- HelpLink = {Default}
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\conduitEngine
- UninstallString = %Program Files%\CONDUI~1\ConduitEngineUninstall.exe
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\conduitEngine
- URLInfoAbout = {Default}

Den Registrierungsschlüssel löschen, den diese Malware erstellt hat:

Öffnen Sie den Registrierungs-Editor. Klicken Sie dazu auf Start>Ausführen, geben Sie regedit in das Textfeld ein, und drücken Sie die Eingabetaste.
Doppelklicken Sie im linken Fensterbereich des Registrierungs-Editors auf:
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BrotherSoft_Extreme Toolbar
      DisplayName = BrotherSoft_Extreme Toolbar


   In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BrotherSoft_Extreme Toolbar
      UninstallString = %Program Files%\BROTHE~1\UNWISE.EXE /U %Program Files%\BROTHE~1\INSTALL.LOG


   In HKEY_CURRENT_USER\Software\AppDataLow\Software\BrotherSoft_Extreme\toolbar\IE5
      CabinetVisible = FALSE


   In HKEY_CURRENT_USER\Software\AppDataLow\Software\BrotherSoft_Extreme\toolbar\IE5
      ExplorerVisible = FALSE


   In HKEY_CURRENT_USER\Software\AppDataLow\Software\BrotherSoft_Extreme\toolbar\IE5
      FirstTime = TRUE


   In HKEY_CURRENT_USER\Software\AppDataLow\Software\BrotherSoft_Extreme\toolbar\IE5
      Visible = TRUE


   In HKEY_CURRENT_USER\Software\AppDataLow\Software\BrotherSoft_Extreme\toolbar\settings
      EnableSearchFromAdress = TRUE


   In HKEY_CURRENT_USER\Software\AppDataLow\Software\BrotherSoft_Extreme\toolbar\settings
      FixPageNotFoundError = 1


   In HKEY_CURRENT_USER\Software\AppDataLow\Software\BrotherSoft_Extreme\toolbar\settings
      SearchFromAdressUrl = http://search.conduit.com/ResultsExt.aspx?ctid=CT2776682&q=MYSEARCHTERM


   In HKEY_CURRENT_USER\Software\AppDataLow\Software\BrotherSoft_Extreme\toolbar\settings\LanguagePack
      LanguagePackServerUrl = http://translation.users.conduit.com/Translation.ashx


   In HKEY_CURRENT_USER\Software\AppDataLow\Software\BrotherSoft_Extreme\toolbar
      GroupingServerURL = http://grouping.services.conduit.com/


   In HKEY_CURRENT_USER\Software\AppDataLow\Software\BrotherSoft_Extreme\toolbar
      SearchServerUrl = http://search.conduit.com


   In HKEY_CURRENT_USER\Software\AppDataLow\Software\BrotherSoft_Extreme\toolbar
      Server = users.conduit.com


   In HKEY_CURRENT_USER\Software\AppDataLow\Software\BrotherSoft_Extreme\toolbar
      ShouldPerformGroupByOS = FALSE


   In HKEY_CURRENT_USER\Software\AppDataLow\Software\BrotherSoft_Extreme\toolbar
      UsageURL = http://usage.users.conduit.com/UsersWebService.asmx/UsersRequests


   In HKEY_CURRENT_USER\Software\AppDataLow\Software\BrotherSoft_Extreme\toolbar
Suchen und löschen Sie im rechten Fensterbereich den folgenden Eintrag:
WebServerUrl = http://BrotherSoftExtreme.OurToolbar.com/
Doppelklicken Sie im linken Fensterbereich des Registrierungs-Editors auf:
In HKEY_CURRENT_USER\Software\AppDataLow\Software\BrotherSoft_Extreme\toolbar
Suchen und löschen Sie im rechten Fensterbereich den folgenden Eintrag:
Write us link = forrest@brothersoft.com
Schließen Sie den Registrierungs-Editor.

Step 4

Diese Datei suchen und löschen

[ learnMore ]

Möglicherweise sind einige Komponentendateien verborgen. Aktivieren Sie unbedingt das Kontrollkästchen Versteckte Elemente durchsuchen unter Weitere erweiterte Optionen, um alle verborgenen Dateien und Ordner in den Suchergebnissen zu berücksichtigen.

%Application Data%\Mozilla\Firefox\Profiles\{Random Characters}.default\extensions\{51a86bb3-6602-4c85-92a5-130ee4864f13}\setup.ini
%Application Data%\Mozilla\Firefox\Profiles\{Random Characters}.default\extensions\{51a86bb3-6602-4c85-92a5-130ee4864f13}\chrome.manifest
%Application Data%\Mozilla\Firefox\Profiles\{Random Characters}.default\extensions\{51a86bb3-6602-4c85-92a5-130ee4864f13}\install.rdf
%Application Data%\Mozilla\Firefox\Profiles\{Random Characters}.default\extensions\{51a86bb3-6602-4c85-92a5-130ee4864f13}\version.txt
%Application Data%\Mozilla\Firefox\Profiles\{Random Characters}.default\extensions\{51a86bb3-6602-4c85-92a5-130ee4864f13}\chrome\brothersoft_extreme.jar
%Application Data%\Mozilla\Firefox\Profiles\{Random Characters}.default\extensions\{51a86bb3-6602-4c85-92a5-130ee4864f13}\components\ConduitAutoCompleteSearch.js
%Application Data%\Mozilla\Firefox\Profiles\{Random Characters}.default\extensions\{51a86bb3-6602-4c85-92a5-130ee4864f13}\components\ConduitAutoCompleteSearch.xpt
%Application Data%\Mozilla\Firefox\Profiles\{Random Characters}.default\extensions\{51a86bb3-6602-4c85-92a5-130ee4864f13}\components\ConduitToolbar.idl
%Application Data%\Mozilla\Firefox\Profiles\{Random Characters}.default\extensions\{51a86bb3-6602-4c85-92a5-130ee4864f13}\components\ConduitToolbar.js
%Application Data%\Mozilla\Firefox\Profiles\{Random Characters}.default\extensions\{51a86bb3-6602-4c85-92a5-130ee4864f13}\components\ConduitToolbar.xpt
%Application Data%\Mozilla\Firefox\Profiles\{Random Characters}.default\extensions\{51a86bb3-6602-4c85-92a5-130ee4864f13}\components\FFExternalAlert.dll
%Application Data%\Mozilla\Firefox\Profiles\{Random Characters}.default\extensions\{51a86bb3-6602-4c85-92a5-130ee4864f13}\components\FFExternalAlert.xpt
%Application Data%\Mozilla\Firefox\Profiles\{Random Characters}.default\extensions\{51a86bb3-6602-4c85-92a5-130ee4864f13}\components\RadioWMPCore.dll
%Application Data%\Mozilla\Firefox\Profiles\{Random Characters}.default\extensions\{51a86bb3-6602-4c85-92a5-130ee4864f13}\components\RadioWMPCore.xpt
%Application Data%\Mozilla\Firefox\Profiles\{Random Characters}.default\extensions\{51a86bb3-6602-4c85-92a5-130ee4864f13}\defaults\alertSettingsComponent.xml
%Application Data%\Mozilla\Firefox\Profiles\{Random Characters}.default\extensions\{51a86bb3-6602-4c85-92a5-130ee4864f13}\defaults\appContextMenu.xml
%Application Data%\Mozilla\Firefox\Profiles\{Random Characters}.default\extensions\{51a86bb3-6602-4c85-92a5-130ee4864f13}\defaults\default_radio_skin.xml
%Application Data%\Mozilla\Firefox\Profiles\{Random Characters}.default\extensions\{51a86bb3-6602-4c85-92a5-130ee4864f13}\defaults\engineContextMenu.xml
%Application Data%\Mozilla\Firefox\Profiles\{Random Characters}.default\extensions\{51a86bb3-6602-4c85-92a5-130ee4864f13}\defaults\engineSettings.json
%Application Data%\Mozilla\Firefox\Profiles\{Random Characters}.default\extensions\{51a86bb3-6602-4c85-92a5-130ee4864f13}\defaults\fbAlert.js
%Application Data%\Mozilla\Firefox\Profiles\{Random Characters}.default\extensions\{51a86bb3-6602-4c85-92a5-130ee4864f13}\defaults\getAppsContextMenu.xml
%Application Data%\Mozilla\Firefox\Profiles\{Random Characters}.default\extensions\{51a86bb3-6602-4c85-92a5-130ee4864f13}\defaults\postAppsContextMenu.xml
%Application Data%\Mozilla\Firefox\Profiles\{Random Characters}.default\extensions\{51a86bb3-6602-4c85-92a5-130ee4864f13}\defaults\toolbarContextMenu.xml
%Application Data%\Mozilla\Firefox\Profiles\{Random Characters}.default\extensions\{51a86bb3-6602-4c85-92a5-130ee4864f13}\defaults\unsharedAppsContextMenu.xml
%Application Data%\Mozilla\Firefox\Profiles\{Random Characters}.default\extensions\{51a86bb3-6602-4c85-92a5-130ee4864f13}\lib\xpcom.js
%Application Data%\Mozilla\Firefox\Profiles\{Random Characters}.default\extensions\{51a86bb3-6602-4c85-92a5-130ee4864f13}\META-INF\manifest.mf
%Application Data%\Mozilla\Firefox\Profiles\{Random Characters}.default\extensions\{51a86bb3-6602-4c85-92a5-130ee4864f13}\META-INF\zigbert.rsa
%Application Data%\Mozilla\Firefox\Profiles\{Random Characters}.default\extensions\{51a86bb3-6602-4c85-92a5-130ee4864f13}\META-INF\zigbert.sf
%Application Data%\Mozilla\Firefox\Profiles\{Random Characters}.default\extensions\{51a86bb3-6602-4c85-92a5-130ee4864f13}\searchplugin\conduit.gif
%Application Data%\Mozilla\Firefox\Profiles\{Random Characters}.default\extensions\{51a86bb3-6602-4c85-92a5-130ee4864f13}\searchplugin\conduit.ico
%Application Data%\Mozilla\Firefox\Profiles\{Random Characters}.default\extensions\{51a86bb3-6602-4c85-92a5-130ee4864f13}\searchplugin\conduit.PNG
%Application Data%\Mozilla\Firefox\Profiles\{Random Characters}.default\extensions\{51a86bb3-6602-4c85-92a5-130ee4864f13}\searchplugin\conduit.src
%Application Data%\Mozilla\Firefox\Profiles\{Random Characters}.default\extensions\{51a86bb3-6602-4c85-92a5-130ee4864f13}\searchplugin\conduit.xml
%Program Files%\BrotherSoft_Extreme\UNWISE.EXE
%Program Files%\BrotherSoft_Extreme\toolbar.cfg
%Program Files%\BrotherSoft_Extreme\BrotherSoft_ExtremeToolbarHelper.exe
%Program Files%\BrotherSoft_Extreme\tbBrot.dll
%Program Files%\BrotherSoft_Extreme\GottenAppsContextMenu.xml
%Program Files%\BrotherSoft_Extreme\OtherAppsContextMenu.xml
%Program Files%\BrotherSoft_Extreme\SharedAppsContextMenu.xml
%Program Files%\BrotherSoft_Extreme\ToolbarContextMenu.xml
%Program Files%\ConduitEngine\toolbar.cfg
%Program Files%\ConduitEngine\ConduitEngineUninstall.exe
%Program Files%\ConduitEngine\appContextMenu.xml
%Program Files%\ConduitEngine\engineContextMenu.xml
%Program Files%\ConduitEngine\EngineSettings.json
%Program Files%\ConduitEngine\ConduitEngineHelper.exe
%Program Files%\ConduitEngine\ConduitEngine.dll
%Program Files%\ConduitEngine\INSTALL.LOG
%User Temp%\BrotherSoft_Extreme.exe

Die Malware-/Grayware-/Spyware-Datei löschen:

Klicken Sie mit der rechten Maustaste auf Start und dann je nach Windows Version auf Suchen... oder Finden....
Geben Sie in das Feld Name Folgendes ein:

%Application Data%\Mozilla\Firefox\Profiles\{Random Characters}.default\extensions\{51a86bb3-6602-4c85-92a5-130ee4864f13}\setup.ini
%Application Data%\Mozilla\Firefox\Profiles\{Random Characters}.default\extensions\{51a86bb3-6602-4c85-92a5-130ee4864f13}\chrome.manifest
%Application Data%\Mozilla\Firefox\Profiles\{Random Characters}.default\extensions\{51a86bb3-6602-4c85-92a5-130ee4864f13}\install.rdf
%Application Data%\Mozilla\Firefox\Profiles\{Random Characters}.default\extensions\{51a86bb3-6602-4c85-92a5-130ee4864f13}\version.txt
%Application Data%\Mozilla\Firefox\Profiles\{Random Characters}.default\extensions\{51a86bb3-6602-4c85-92a5-130ee4864f13}\chrome\brothersoft_extreme.jar
%Application Data%\Mozilla\Firefox\Profiles\{Random Characters}.default\extensions\{51a86bb3-6602-4c85-92a5-130ee4864f13}\components\ConduitAutoCompleteSearch.js
%Application Data%\Mozilla\Firefox\Profiles\{Random Characters}.default\extensions\{51a86bb3-6602-4c85-92a5-130ee4864f13}\components\ConduitAutoCompleteSearch.xpt
%Application Data%\Mozilla\Firefox\Profiles\{Random Characters}.default\extensions\{51a86bb3-6602-4c85-92a5-130ee4864f13}\components\ConduitToolbar.idl
%Application Data%\Mozilla\Firefox\Profiles\{Random Characters}.default\extensions\{51a86bb3-6602-4c85-92a5-130ee4864f13}\components\ConduitToolbar.js
%Application Data%\Mozilla\Firefox\Profiles\{Random Characters}.default\extensions\{51a86bb3-6602-4c85-92a5-130ee4864f13}\components\ConduitToolbar.xpt
%Application Data%\Mozilla\Firefox\Profiles\{Random Characters}.default\extensions\{51a86bb3-6602-4c85-92a5-130ee4864f13}\components\FFExternalAlert.dll
%Application Data%\Mozilla\Firefox\Profiles\{Random Characters}.default\extensions\{51a86bb3-6602-4c85-92a5-130ee4864f13}\components\FFExternalAlert.xpt
%Application Data%\Mozilla\Firefox\Profiles\{Random Characters}.default\extensions\{51a86bb3-6602-4c85-92a5-130ee4864f13}\components\RadioWMPCore.dll
%Application Data%\Mozilla\Firefox\Profiles\{Random Characters}.default\extensions\{51a86bb3-6602-4c85-92a5-130ee4864f13}\components\RadioWMPCore.xpt
%Application Data%\Mozilla\Firefox\Profiles\{Random Characters}.default\extensions\{51a86bb3-6602-4c85-92a5-130ee4864f13}\defaults\alertSettingsComponent.xml
%Application Data%\Mozilla\Firefox\Profiles\{Random Characters}.default\extensions\{51a86bb3-6602-4c85-92a5-130ee4864f13}\defaults\appContextMenu.xml
%Application Data%\Mozilla\Firefox\Profiles\{Random Characters}.default\extensions\{51a86bb3-6602-4c85-92a5-130ee4864f13}\defaults\default_radio_skin.xml
%Application Data%\Mozilla\Firefox\Profiles\{Random Characters}.default\extensions\{51a86bb3-6602-4c85-92a5-130ee4864f13}\defaults\engineContextMenu.xml
%Application Data%\Mozilla\Firefox\Profiles\{Random Characters}.default\extensions\{51a86bb3-6602-4c85-92a5-130ee4864f13}\defaults\engineSettings.json
%Application Data%\Mozilla\Firefox\Profiles\{Random Characters}.default\extensions\{51a86bb3-6602-4c85-92a5-130ee4864f13}\defaults\fbAlert.js
%Application Data%\Mozilla\Firefox\Profiles\{Random Characters}.default\extensions\{51a86bb3-6602-4c85-92a5-130ee4864f13}\defaults\getAppsContextMenu.xml
%Application Data%\Mozilla\Firefox\Profiles\{Random Characters}.default\extensions\{51a86bb3-6602-4c85-92a5-130ee4864f13}\defaults\postAppsContextMenu.xml
%Application Data%\Mozilla\Firefox\Profiles\{Random Characters}.default\extensions\{51a86bb3-6602-4c85-92a5-130ee4864f13}\defaults\toolbarContextMenu.xml
%Application Data%\Mozilla\Firefox\Profiles\{Random Characters}.default\extensions\{51a86bb3-6602-4c85-92a5-130ee4864f13}\defaults\unsharedAppsContextMenu.xml
%Application Data%\Mozilla\Firefox\Profiles\{Random Characters}.default\extensions\{51a86bb3-6602-4c85-92a5-130ee4864f13}\lib\xpcom.js
%Application Data%\Mozilla\Firefox\Profiles\{Random Characters}.default\extensions\{51a86bb3-6602-4c85-92a5-130ee4864f13}\META-INF\manifest.mf
%Application Data%\Mozilla\Firefox\Profiles\{Random Characters}.default\extensions\{51a86bb3-6602-4c85-92a5-130ee4864f13}\META-INF\zigbert.rsa
%Application Data%\Mozilla\Firefox\Profiles\{Random Characters}.default\extensions\{51a86bb3-6602-4c85-92a5-130ee4864f13}\META-INF\zigbert.sf
%Application Data%\Mozilla\Firefox\Profiles\{Random Characters}.default\extensions\{51a86bb3-6602-4c85-92a5-130ee4864f13}\searchplugin\conduit.gif
%Application Data%\Mozilla\Firefox\Profiles\{Random Characters}.default\extensions\{51a86bb3-6602-4c85-92a5-130ee4864f13}\searchplugin\conduit.ico
%Application Data%\Mozilla\Firefox\Profiles\{Random Characters}.default\extensions\{51a86bb3-6602-4c85-92a5-130ee4864f13}\searchplugin\conduit.PNG
%Application Data%\Mozilla\Firefox\Profiles\{Random Characters}.default\extensions\{51a86bb3-6602-4c85-92a5-130ee4864f13}\searchplugin\conduit.src
%Application Data%\Mozilla\Firefox\Profiles\{Random Characters}.default\extensions\{51a86bb3-6602-4c85-92a5-130ee4864f13}\searchplugin\conduit.xml
%Program Files%\BrotherSoft_Extreme\UNWISE.EXE
%Program Files%\BrotherSoft_Extreme\toolbar.cfg
%Program Files%\BrotherSoft_Extreme\BrotherSoft_ExtremeToolbarHelper.exe
%Program Files%\BrotherSoft_Extreme\tbBrot.dll
%Program Files%\BrotherSoft_Extreme\GottenAppsContextMenu.xml
%Program Files%\BrotherSoft_Extreme\OtherAppsContextMenu.xml
%Program Files%\BrotherSoft_Extreme\SharedAppsContextMenu.xml
%Program Files%\BrotherSoft_Extreme\ToolbarContextMenu.xml
%Program Files%\ConduitEngine\toolbar.cfg
%Program Files%\ConduitEngine\ConduitEngineUninstall.exe
%Program Files%\ConduitEngine\appContextMenu.xml
%Program Files%\ConduitEngine\engineContextMenu.xml
%Program Files%\ConduitEngine\EngineSettings.json
%Program Files%\ConduitEngine\ConduitEngineHelper.exe
%Program Files%\ConduitEngine\ConduitEngine.dll
%Program Files%\ConduitEngine\INSTALL.LOG
%User Temp%\BrotherSoft_Extreme.exe
Wählen Sie im Listenfeld lt;i>Suchen in die Option Arbeitsplatz, und drücken Sie die Eingabetaste.
Markieren Sie die gefundene Datei, und drücken Sie UMSCHALT+ENTF, um sie endgültig zu löschen.

Step 5

Durchsuchen Sie Ihren Computer mit Ihrem Trend Micro Produkt, und löschen Sie Dateien, die als PUA.Win32.Conduit.GS entdeckt werden. Falls die entdeckten Dateien bereits von Ihrem Trend Micro Produkt gesäubert, gelöscht oder in Quarantäne verschoben wurden, sind keine weiteren Schritte erforderlich. Dateien in Quarantäne können einfach gelöscht werden. Auf dieser Knowledge-Base-Seite finden Sie weitere Informationen.

Nehmen Sie an unserer Umfrage teil

PUA.Win32.Conduit.GS

Überblick

Technische Details

Lösungen

Ressourcen

Support

Über Trend

Hauptniederlassung DACH

PUA.Win32.Conduit.GS

Überblick

Technische Details

Lösungen

Ressourcen

Support

Über Trend

Hauptniederlassung DACH

Nord-, Mittel- und Südamerika

Naher Osten und Afrika

Europa

Asien-Pazifik