What is pup.optional.conduittb.gen?

Question

I came home from an overnight trip and saw my PC screen moving around. I hoped it was just some ad animation but as I sat down I realised someone was opening 30+ tabs in my Chrome to an Apple gift card order... presumably readying them to execute all at once so I couldn't stop it once I saw the emails. Chrome has my paypal / ebay etc all saved (which I've since removed).In any case, I unplugged my ethernet immediately. I checked whether Teamviewer was running since that's what my brain just jumped to first, and it was, so I shut it down... and then started an AVG antivirus & malwarebytes anti malware scans. AVG came up blank and malwarebytes found the following. None look particularly alarming but I have quarantined and deleted them all.Processes: 0(No malicious items detected)Modules: 0(No malicious items detected)Registry Keys: 3PUP.Optional.ConduitTB.Gen, HKLM\SOFTWARE\CLASSES\Toolbar.CT2790392, Quarantined, [75e390d383160a2c20f0c20dae55ee12], PUP.Optional.ConduitTB.Gen, HKLM\SOFTWARE\WOW6432NODE\CLASSES\Toolbar.CT2790392, Quarantined, [ca8ebfa417828aac8b85d5fade250ef2], PUP.Optional.BitTorrentBar, HKU\S-1-5-21-400733698-2722910543-856138190-1000\SOFTWARE\APPDATALOW\SOFTWARE\BitTorrentBar, Quarantined, [6bed1251e9b0c0769c3e01d8d33045bb], Registry Values: 4PUP.Optional.BitTorrentBar, HKU\S-1-5-21-400733698-2722910543-856138190-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TOOLBAR\WEBBROWSER\{88C7F2AA-F93F-432C-8F0E-B7D85967A527}, Quarantined, [b7a1ce95277247efb137029d10f25aa6], PUP.Optional.BitTorrentBar, HKU\S-1-5-21-400733698-2722910543-856138190-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TOOLBAR\WEBBROWSER|{88C7F2AA-F93F-432C-8F0E-B7D85967A527}, ªòÇˆ?ù,C ·ØYg¥', Quarantined, [b7a1ce95277247efb137029d10f25aa6]PUP.Optional.BitTorrentBar, HKU\S-1-5-21-400733698-2722910543-856138190-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\URLSEARCHHOOKS|{88C7F2AA-F93F-432C-8F0E-B7D85967A527}, Quarantined, [b7a1ce95277247efb137029d10f25aa6], PUP.Optional.BitTorrentBar, HKU\S-1-5-21-400733698-2722910543-856138190-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\URLSEARCHHOOKS\{88c7f2aa-f93f-432c-8f0e-b7d85967a527}, Quarantined, [eb6d174c5c3d2d0995535b4404fefc04], Registry Data: 0(No malicious items detected)Folders: 10PUP.Optional.ConduitTB.Gen, C:\Users\Andrew\AppData\LocalLow\Conduit\Community Alerts, Quarantined, [98c098cb613863d3f11159aa62a1fe02], PUP.Optional.ConduitTB.Gen, C:\Users\Andrew\AppData\LocalLow\Conduit\Community Alerts\Dialogs, Quarantined, [98c098cb613863d3f11159aa62a1fe02], PUP.Optional.ConduitTB.Gen, C:\Users\Andrew\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog, Quarantined, [98c098cb613863d3f11159aa62a1fe02], PUP.Optional.ConduitTB.Gen, C:\Users\Andrew\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images, Quarantined, [98c098cb613863d3f11159aa62a1fe02], PUP.Optional.ConduitTB.Gen, C:\Users\Andrew\AppData\LocalLow\Conduit\Community Alerts\Feeds, Quarantined, [98c098cb613863d3f11159aa62a1fe02], PUP.Optional.ConduitTB.Gen, C:\Users\Andrew\AppData\LocalLow\Conduit\Community Alerts\LanguagePacks, Quarantined, [98c098cb613863d3f11159aa62a1fe02], PUP.Optional.ConduitTB.Gen, C:\Users\Andrew\AppData\LocalLow\Conduit\Community Alerts\Log, Quarantined, [98c098cb613863d3f11159aa62a1fe02], PUP.Optional.ConduitTB.Gen, C:\Users\Andrew\AppData\LocalLow\Conduit, Quarantined, [98c098cb613863d3f11159aa62a1fe02], PUP.Optional.ConduitTB.Gen, C:\Users\Andrew\AppData\LocalLow\Conduit\Toolbar, Quarantined, [98c098cb613863d3f11159aa62a1fe02], PUP.Optional.ConduitTB.Gen, C:\Users\Andrew\AppData\LocalLow\Conduit\Toolbar\Facebook, Quarantined, [98c098cb613863d3f11159aa62a1fe02], Files: 25PUP.Optional.ConduitTB.Gen, C:\Users\Andrew\AppData\LocalLow\Conduit\Community Alerts\DynamicDialogs.zip, Quarantined, [98c098cb613863d3f11159aa62a1fe02], PUP.Optional.ConduitTB.Gen, C:\Users\Andrew\AppData\LocalLow\Conduit\Community Alerts\Dialogs\DialogsAPI.js, Quarantined, [98c098cb613863d3f11159aa62a1fe02], PUP.Optional.C…

Anil Jha · Accepted Answer

You asked - What is pup.optional.conduittb.gen, the answer is - First, disconnecting the Ethernet was a wise choice. I'd also disconnect your router for the time being. As far as figuring out how they got in, running an IDS/IPS and looking at those logs would be valuable in the future; looking back, the offline scans below will at least point out some possible infection vectors, as well as checking for router vulnerabilities. I recommend you do the following:Unplug your router from the Internet in addition to your PC: Buy a new one Or give it a hard reset, and use a non-compromised machine on another network to download any firmware updates for it. If there aren't any because it's old... see "Buy a new one" If they were able to use a computer inside your LAN, they were able to try and, or successfully, log into your router Also check to see if your router has one of many vulnerabilities; if so, see "Buy a new one"Consider a serious router/firewall, like running pfSense free software on an old machine with 2 NICs, or their own devices, or a fitlet tiny fanless PC, or whatever. Then install the Snort or Suricata package - those are IDS/IPS packages which have a chance of noticing attacks in progress and optionally blocking IPs for a period of time - in your case, I'd say block for a few days and watch your logs very carefully for them to try and get back in. Or at least a Ubiquiti Edgerouter Lite - much cheaper, but very limited in the GUI (all the really advanced stuff is in the command line, and it's definitely not for running an IDS/IPS).Change all your passwords everywhere Use something like KeePass to generate long random ones for each service. Don't forget to go to Database Settings, Security, hit the "1 second delay" link or button, and then increase it - taking 3 or 4 or 7 seconds to open KeePass is a small price to pay for making attackers have to work incredibly much harder than the defaults. Keep your computer off (in case of ransomware, possibly on a time) and unplugged while you: Buy a new hard drive Plug in power but NOT networking (and especially not Wifi; physically remove/turn off all wifi)Install Windows from scratch Install your AV package with an offline installer downloaded on a non compromised computer and network Run Windows patches offline possibly by using WSUS Offline Update from that non compromised computer and network Purchase a sledgehammer, a box of gallon Ziplock bags, and a small kitchen towel. Wrap the compromised hard drive in the small kitchen towel Put the wrapped HD in at least 6 Ziplock bags, each sealed Smash the drive with the sledgehammer until glass shards are leaking through the towelRestore your valuable data from existing backups Or, much riskier if you don't replaced the compromised HD: run several different offline, bootable/live/livecd/rescue antivirus/antimalware/antirootkit products- Regardless, do these offline scans for all other machines on your network! - Use several because no one product covers everything, but by using several different products, you reduce the uncovered space significantly. I'd recommend: - at least one of AVG and Avira (or both) - at least one of Dr. Web and Kaspersky (preferably both), to get some Russian involvement. - Comodo Rescue Disk (it advertises rootkit scanning, too) - Pick another couple of your favourites. PCSupport.about.com has a pretty good top 15 list as of Feb 2016 If you're truly worried, do this on every machine on the network. It won't really take much more time - you can put AVG in one, Avira in another, Kaspersky in a third, Dr.Web in a fourth, and then simply move them to the machine on the right when they're done in round-robin fashion. They're almost certainly going to find tracking cookies - that's normal, and nothing to be concerned about, though I'd always delete them. Set up Teamviewer Two Factor Authentication, which uses the TOTP protocol (time based one time passwords); RFC6238. After all of this, once you're fully online…

What is pup.optional.conduittb.gen?

About this question

Your answer

1 Answer

More Cyber Security discussions

Learn & Explore

Cyber Security Tutorials

Cyber Security Interview Q&A

Latest Cyber Security Blogs

Want answers to more Cyber Security questions?

Stay in the loop — it’s free

You’re on the list!