Categories: PUA

About “PUP.Optional.SearchProtect” infection

The PUP.Optional.SearchProtect is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What PUP.Optional.SearchProtect virus can do?

SetUnhandledExceptionFilter detected (possible anti-debug)
Yara rule detections observed from a process memory dump/dropped files/CAPE
Guard pages use detected – possible anti-debugging.
Dynamic (imported) function loading detected
Enumerates running processes
Repeatedly searches for a not-found process, may want to run with startbrowser=1 option
Authenticode signature is invalid
Behavioural detection: Transacted Hollowing
Collects and encrypts information about the computer likely to send to C2 server
Creates a hidden or system file
Attempts to modify proxy settings

How to determine PUP.Optional.SearchProtect?


File Info:
name: 6754A50F7735BB364928.mlwpath: /opt/CAPEv2/storage/binaries/41f07fdf7f0661ce223cc016af85d11b0aa066266ce714b6f360f0121a09d76bcrc32: 8E089262md5: 6754a50f7735bb364928246230e1c2a3sha1: 91d91330a004de2bb3151090c9cbff99254cf25esha256: 41f07fdf7f0661ce223cc016af85d11b0aa066266ce714b6f360f0121a09d76bsha512: 75b44e7e23fbbed7182b53deb41d9896290f7ee58c1caf7d9d53f9ee4a34037890e26359669e6e3b28171215aba354d33d2d912c88276ba50aa87fe59a390565ssdeep: 49152:oV0lmp47WJI1ASZQIiqBjOvr11Vk0+fd/iia6T+h1W:o04p4QrWiqBjc11Vkbtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T120A5AE22B7C6C072E9A331B5406F637E947A7A70D72585C3A3C42E5D2E701D3A33AB56sha3_384: e98ae881451ce9d6565cc56a66c8ce69f0349b0ef772451e8a125df4ffee6f912112a6e99f79c1c07bf23bef0708964aep_bytes: e8e8af0000e97ffeffff558bec837d08timestamp: 2015-05-17 14:58:15
Version Info:
0: [No Data]

PUP.Optional.SearchProtect also known as:

Lionic	Trojan.Win32.Generic.4!c
DrWeb	Adware.Conduit.348
MicroWorld-eScan	Gen:Variant.Doina.7947
FireEye	Generic.mg.6754a50f7735bb36
ALYac	Gen:Variant.Doina.7947
Cylance	Unsafe
Sangfor	PUP.Win32.SearchProtect.8
K7AntiVirus	Adware ( 004b8b561 )
K7GW	Adware ( 004b8b561 )
Cybereason	malicious.f7735b
BitDefenderTheta	AI:Packer.5A8E6E0A1F
Symantec	Trojan.Gen.2
ESET-NOD32	a variant of Win32/Conduit.SearchProtect.Y potentially unwanted
Paloalto	generic.ml
Cynet	Malicious (score: 100)
Kaspersky	not-a-virus:AdWare.Win32.SearchProtect.wlg
BitDefender	Gen:Variant.Doina.7947
NANO-Antivirus	Riskware.Win32.Conduit.dryzoa
Avast	FileRepMalware
Rising	Trojan.Generic@ML.95 (RDML:0CDTcTJYlXugMLWE6TYnVA)
Ad-Aware	Gen:Variant.Doina.7947
Sophos	Generic PUA JB (PUA)
VIPRE	Trojan.Win32.Generic!BT
McAfee-GW-Edition	BehavesLike.Win32.CoinMiner.vh
Emsisoft	Gen:Variant.Doina.7947 (B)
Ikarus	PUA.Conduit.SearchProtect
GData	Win32.Application.SearchProtect.AK
MAX	malware (ai score=87)
Antiy-AVL	Trojan/Generic.ASMalwS.10D948B
Microsoft	PUAAdvertising:Win32/Conduit
McAfee	Artemis!6754A50F7735
VBA32	BScope.Adware.SearchProtect
Malwarebytes	PUP.Optional.SearchProtect
APEX	Malicious
Tencent	Win32.Adware.Searchprotect.Woga
Yandex	Riskware.SearchProtect!Y81Ae5e7/sE
eGambit	Unsafe.AI_Score_100%
Fortinet	Riskware/Conduit_SearchProtect
Webroot	Pua.Conduit
AVG	FileRepMalware
CrowdStrike	win/malicious_confidence_100% (D)