home

cltmngsvc.exe

Search Protect

ClientConnect LTD

The file belongs to the ClientConnect (Conduit/Perion) platform, a utility that bundles and monetizes search toolbars and browser add-ons. The application cltmngsvc.exe by ClientConnect has been detected as adware by 31 anti-malware scanners. It runs as a separate (within the context of its own process) windows Service named “Search Protect Service”. This file is typically installed with the program Search Protect by Client Connect LTD which is a potentially unwanted software program.
Publisher:
Client Connect LTD  (signed by ClientConnect LTD)

Product:
Search Protect

Version:
2.13.3.38

MD5:
cb963faf704f22473375856e3c2fcde3

SHA-1:
2e754553d4bedda70a308b6a87a84969bc27f842

SHA-256:
d6585c5d5f85e8289c9ee8e6eecbafd21b26b9daba8561eda12a91d5e484702c

Scanner detections:
31 / 68

Status:
Adware

Explanation:
Part of the Conduit/ClientConnect toolbar/extension distribution.

Analysis date:
4/26/2024 3:36:49 PM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Win32.Expiro.CM
366

AhnLab V3 Security
Win32/Expiro5.Gen
16.02.04

Avira AntiVirus
TR/Trash.Gen
7.11.30.172

avast!
Win32:Xpirat-A
2014.9-160204

AVG
SearchProtect
2017.0.2844

Baidu Antivirus
Adware.Win32.Conduit
4.0.3.1624

Bitdefender
Win32.Expiro.CM
1.0.20.175

Comodo Security
Virus.Win32.Expiro.BU
18279

Dr.Web
Trojan.Damaged.1
9.0.1.035

Emsisoft Anti-Malware
Win32.Expiro.CM
8.16.02.04.01

ESET NOD32
Win32/Conduit.SearchProtect (variant)
10.9741

F-Secure
Win32.Expiro.CM
11.2016-04-02_5

G Data
Win32.Application.SearchProtect.AA@gen
16.2.24

K7 AntiVirus
Virus
13.177.12095

Kaspersky
HEUR:Backdoor.Win32.Generic
14.0.0.715

Malwarebytes
PUP.Optional.SearchProtect.A
v2016.02.04.01

McAfee
Artemis!D67818E91EC4
5600.6500

Microsoft Security Essentials
Threat.Undefined
1.173.2153.0

MicroWorld eScan
Win32.Expiro.CM
17.0.0.105

NANO AntiVirus
Virus.Win32.Virut-Gen.bwpxnc
0.28.0.59911

Norman
Expiro.NEO
11.20160204

nProtect
Win32.Expiro.CM
14.05.15.01

Panda Antivirus
Trj/Genetic.gen
16.02.04.01

Reason Heuristics
PUP.Conduit.ClientConnect (M)
16.2.4.1

Sophos
W32/Expiro-X
4.98

SUPERAntiSpyware
Trojan.Agent/Gen-Nullo[Short]
9345

Total Defense
Win32/Expiro.BA
37.0.10939

Trend Micro House Call
PE_EXPIRO.A3
7.2.35

Trend Micro
PE_EXPIRO.A3
10.465.04

Vba32 AntiVirus
SScope.Virus.Expiro.gen
3.12.26.0

VIPRE Antivirus
Conduit
29242

File size:
2.4 MB (2,497,856 bytes)

Product version:
2.13.3.38

Copyright:
© 2014 ClientConnect Ltd.

Original file name:
SearchProtect (R)

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\Program Files\searchprotect\main\bin\cltmngsvc.exe

Digital Signature
Signed by:
ClientConnect LTD

Authority:
VeriSign, Inc.

Valid from:
2/3/2014 2:00:00 AM

Valid to:
2/5/2016 1:59:59 AM

Subject:
CN=ClientConnect LTD, OU=Digital ID Class 3 - Microsoft Software Validation v2, OU=Search Protect, O=ClientConnect LTD, L=Ness Ziona, S=Israel, C=IL

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
173D1F00E27A9D60265B3AB0B87F2ED8

File PE Metadata
Compilation timestamp:
5/23/2014 10:18:08 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

CTPH (ssdeep):
49152:kwBHCch82ufjqAhkLDTMaWKJJxgI0nbybQ7P7+JD:kwThiffhkLXRWKqn8

Entry address:
0xCCA9D

Entry point:
E8, 53, 97, 00, 00, E9, 7F, FE, FF, FF, 55, 8B, EC, 83, EC, 18, 8D, 4D, E8, 53, FF, 75, 0C, E8, 79, FC, FF, FF, 8B, 5D, 08, 81, FB, 00, 01, 00, 00, 73, 60, 8B, 4D, E8, 83, 79, 74, 01, 7E, 14, 8D, 45, E8, 50, 6A, 02, 53, E8, 10, DE, 00, 00, 8B, 4D, E8, 83, C4, 0C, EB, 0D, 8B, 81, 90, 00, 00, 00, 0F, B7, 04, 58, 83, E0, 02, 85, C0, 74, 1E, 80, 7D, F4, 00, 8B, 81, 98, 00, 00, 00, 0F, B6, 0C, 18, 74, 07, 8B, 45, F0, 83, 60, 70, FD, 8B, C1, E9, D6, 00, 00, 00, 80, 7D, F4, 00, 74, 07, 8B, 4D, F0, 83, 61, 70, FD...
 
[+]

Code size:
1.5 MB (1,533,440 bytes)

Service
Display name:
Search Protect Service

Service name:
CltMngSvc

Description:
This service loads the Search Protector, which maintains your selected Search settings, and enables auto-updates.

Type:
Win32OwnProcess

Depends on:
TermService


The file cltmngsvc.exe has been discovered within the following program.

Search Protect  by Client Connect LTD
Search Protect from Client Connect (formally Conduit, now a venture of Perion) is a homepage and search provider modifier that when installed will change the default web browser's home page and search pages to a partner portal such as Trovi.
www.conduit.com/searchprotect
79% remove it
 
Powered by Should I Remove It?

Remove cltmngsvc.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.