{"id":1538,"date":"2014-08-25T09:37:57","date_gmt":"2014-08-25T09:37:57","guid":{"rendered":"http:\/\/www.freefixer.com\/b\/?p=1538"},"modified":"2018-05-29T12:02:46","modified_gmt":"2018-05-29T12:02:46","slug":"orbiter-orbtr-sppd-sys-searchprotect-clientconnect-ltd","status":"publish","type":"post","link":"https:\/\/www.freefixer.com\/b\/orbiter-orbtr-sppd-sys-searchprotect-clientconnect-ltd\/","title":{"rendered":"Orbiter, ORBTR, SPPD.sys and SearchProtect by ClientConnect LTD."},"content":{"rendered":"

I was playing around with a download this morning to see if it bundled some software. When running the installer\u00a0“Search Protect by Conduit<\/strong>” was offered. The installer also displayed a few links – as shown in the screenshot below – to learn more about the SearchProtect<\/strong> software and to the EULA and the privacy policy, but for some unknown reason, no browser popped up when clicking the links.<\/p>\n

\"Conduit<\/a><\/p>\n

Search Protect is designed to change search settings in Firefox, Chrome and Internet Explorer to trovi.com<\/strong> and pop up a notification window when these settings are changed.<\/p>\n

Since I more or less on a daily basis look on what’s being bundled with various downloads, I’m used to see Search Protect, but this was a new variant that I had not seen before. It also installed something called Orbiter<\/strong> in “c:\\Program Files (x86)\\ORBTR<\/strong>” or “c:\\Program Files\\ORBTR”. <\/strong>The files were\u00a0named\u00a0Orbiter.dll<\/a> and Orbt.ext<\/a>. A new driver name SPPD.sys<\/a> also appeared on the hard drive located in “c:\\Windows\\System32\\drivers<\/strong>“. All these files were digitally signed by\u00a0ClientConnect LTD<\/strong>.<\/p>\n

I was curious to see if the anti-virus programs over at VirusTotal detected the orbiter.dll file, and some of them did. As shown in the screenshot, 10 of the 55 anti-virus scanners detected the orbiter.dll file, under various detection names, such as PUP.Optional.Conduit.A<\/strong> and Adware.Orbiter<\/strong>.<\/p>\n

\"orbiter.dll<\/a><\/p>\n

If you’d like to remove SearchProtect and Orbiter, you can do so from the Add\/Remove programs dialog, by right-clicking on the\u00a0Search Protect icon and selecting Uninstall. This also uninstalled the\u00a0Orbiter software.<\/p>\n

\"orbiter<\/a><\/p>\n

Did you also get SearchProtect and\u00a0Orbiter on your machine? Any idea how it was installed? Did the uninstaller work successfully?<\/p>\n","protected":false},"excerpt":{"rendered":"

I was playing around with a download this morning to see if it bundled some software. When running the installer\u00a0“Search Protect by Conduit” was offered. The installer also displayed a few links – as shown in the screenshot below – to learn more about the SearchProtect software and to the EULA and the privacy policy, … Continue reading Orbiter, ORBTR, SPPD.sys and SearchProtect by ClientConnect LTD.<\/span> →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[1],"tags":[151,149,22,150],"_links":{"self":[{"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/posts\/1538"}],"collection":[{"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/comments?post=1538"}],"version-history":[{"count":2,"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/posts\/1538\/revisions"}],"predecessor-version":[{"id":1543,"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/posts\/1538\/revisions\/1543"}],"wp:attachment":[{"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/media?parent=1538"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/categories?post=1538"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/tags?post=1538"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}