home

SearchProtect

Search Protect

ClientConnect LTD

The file belongs to the ClientConnect (Conduit/Perion) platform, a utility that bundles and monetizes search toolbars and browser add-ons. The file SearchProtect, “Search Protect Uninstaller” by ClientConnect has been detected as adware by 16 anti-malware scanners. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. This is the uninstaller utility registered in the Windows Control Panel for the program Search Protect by Client Connect LTD. This file is typically installed with the program Search Protect by Client Connect LTD which is a potentially unwanted software program.
Publisher:
Client Connect LTD  (signed by ClientConnect LTD)

Product:
Search Protect

Description:
Search Protect Uninstaller

Version:
2.20.2.12

MD5:
7a33f93f3a0cb04a3e3e54a35ec5c43e

SHA-1:
37f2e86a54230ab1f4f04d968bcd15a8075288b9

SHA-256:
02a0510a753660bf26da3d81327461e5e3abc1a595427d4757e315745fd044cf

Scanner detections:
16 / 68

Status:
Adware

Explanation:
Bundles the Conduit Toolbar and/or Conduit Search Protect.

Analysis date:
4/25/2024 11:33:41 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Gen:Variant.Application.SearchProtect.2
734

avast!
Win32:Conduit-B [PUP]
2014.9-150201

AVG
Generic
2016.0.3212

Baidu Antivirus
Adware.Win32.Conduit
4.0.3.1521

Bitdefender
Gen:Variant.Application.SearchProtect.2
1.0.20.160

Dr.Web
Adware.Conduit.45
9.0.1.032

ESET NOD32
Win32/ClientConnect.A potentially unwanted (variant)
9.11102

F-Secure
Gen:Variant.Application.SearchProtect
11.2015-01-02_1

G Data
Gen:Variant.Application.SearchProtect
15.2.25

Malwarebytes
PUP.Optional.SearchProtect
v2015.02.01.04

McAfee
Artemis!7A33F93F3A0C
5600.6868

MicroWorld eScan
Gen:Variant.Application.SearchProtect.2
16.0.0.96

Qihoo 360 Security
Win32/Application.433
1.0.0.1015

Reason Heuristics
PUP.Installer.Conduit
15.2.1.4

Sophos
Conduit Search Protect
4.98

VIPRE Antivirus
Conduit
37128

File size:
1.2 MB (1,257,584 bytes)

Product version:
2.20.2.12

Copyright:
© 2014 ClientConnect Ltd.

Original file name:
SearchProtect

Installer:
NSIS (Nullsoft Scriptable Install System)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\temp\{random}.tmp\au_.exe

Digital Signature
Signed by:
ClientConnect LTD

Authority:
VeriSign, Inc.

Valid from:
12/31/2014 12:00:00 AM

Valid to:
12/26/2016 11:59:59 PM

Subject:
CN=ClientConnect LTD, OU=Safe Search, O=ClientConnect LTD, L=Ness Ziona, S=Israel, C=IL

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
354F4C7E49A131A6E4BF89B253C78A2D

File PE Metadata
Compilation timestamp:
7/6/2011 3:31:20 PM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
24576:qmJC0gHMzwnjIGitz5jlo8xrIWaj7yfC9I2RyQDLy2ZoS:qEwnKz5jpxUWDQfpP

Entry address:
0x354B

Entry point:
81, EC, D4, 02, 00, 00, 53, 55, 56, 57, 6A, 20, 33, ED, 5E, 89, 6C, 24, 18, C7, 44, 24, 10, D8, 84, 40, 00, 89, 6C, 24, 14, FF, 15, 30, 80, 40, 00, 68, 01, 80, 00, 00, FF, 15, B8, 80, 40, 00, 55, FF, 15, B0, 82, 40, 00, 6A, 08, A3, 98, 06, 47, 00, E8, 67, 27, 00, 00, 55, 68, B4, 02, 00, 00, A3, B0, 05, 47, 00, 8D, 44, 24, 38, 50, 55, 68, 1C, 86, 40, 00, FF, 15, 80, 81, 40, 00, 68, 04, 86, 40, 00, 68, A0, 85, 46, 00, E8, 35, 26, 00, 00, FF, 15, B4, 80, 40, 00, 50, BF, A0, 10, 4C, 00, 57, E8, 23, 26, 00, 00...
 
[+]

Entropy:
7.8863

Packer / compiler:
Nullsoft install system v2.x

Code size:
25 KB (25,600 bytes)

Program Uninstaller
Program name:
Search Protect

Display publisher:
Client Connect LTD

Display version:
2.20.2.12

Uninstall string:
"C:\PROGRA~1\SearchProtect\Main\bin\uninstall.exe" /S


The file SearchProtect has been discovered within the following programs.

Search Protect  by Client Connect LTD
Search Protect from Client Connect (formally Conduit, now a venture of Perion) is a homepage and search provider modifier that when installed will change the default web browser's home page and search pages to a partner portal such as Trovi.
www.conduit.com/searchprotect
79% remove it
 
Powered by Should I Remove It?

The executing file has been seen to make the following network communication in live environments.

TCP (HTTP):
Connects to a184-27-80-179.deploy.static.akamaitechnologies.com  (184.27.80.179:80)

Remove SearchProtect - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.