cltmng.exe
Search Protect by Conduit Ltd. (Signed)
| Version: | 1.4.1.12 |
| MD5: | 8bf6e87d0a6455905b89049851704201 |
| SHA1: | 70aafcbe39157dac2bef6a1b215f0275a9a56607 |
| SHA256: | efeaade58326b9d98e6de8c2e0807f6c53b00356b3ac11a41f206a5f1accb9f1 |
Warning 7 antivirus scanners has detected malware.
Overview
cltmng.exe is malware that executes as a process with the local user's privileges. It is set to be run when the PC boots and the user logs into Windows (added to the Run registry key for the current user). It is installed with a couple of know programs including Search Protect by conduit published by Conduit Ltd. and Search Protect by conduit published by Conduit Ltd.. The file is digitally signed by Conduit Ltd. which was issued by the VeriSign certificate authority (CA).
Details
| File name: | cltmng.exe |
| Publisher: | Conduit |
| Product name: | Search Protect |
| Description: | Search Protect by Conduit |
| Typical file path: | C:\Program Files\searchprotect\bin\cltmng.exe |
| Original name: | SearchProtect (R) |
| File version: | 1.4.1.12 |
| Size: | 2.6 MB (2,731,296 bytes) |
| Certificate |
| Issued to: | Conduit Ltd. |
| Authority (CA): | VeriSign |
| Effective date: | Wednesday, February 17, 2010 |
| Expiration date: | Saturday, March 30, 2013 |
| Digital DNA |
| PE subsystem: | Windows GUI |
| File packed: | No |
| Code language: | Microsoft Visual C++ 10.0 |
| .NET CLR: | No |
More details
Programs
The following programs will install this file
The Conduit Search Protect software is designed to prevent other competing web browser plugins from changing the homepage and search settings that are created by the Conduit OurToolbar from being changed automatically. It is typically installed with various Community toolbars.
During install of a Conduit Toolbar, you by default except the EULA to install the included SearchProtect software (which is required). Upon installation the p...
Behaviors
Startup files (all users) run
Runs under the registry key 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run'
- 'SearchProtectAll' → C:\Program Files\SearchProtect\bin\cltmng.exe
Startup files (user) run
Runs under the registry key 'HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run'
- 'SearchProtect' → C:\users\user\appdata\Roaming\SearchProtect\bin\cltmng.exe
Malware detections
Based on 40+ industry antivirus scanners, 7 of them detected the following malware.
| Antivirus engine | Engine version | Detection |
| avast! |
8.0.1489.320 |
Win32:SearchProtect-B [PUP] |
| Bkav Security |
1.3.0.4923 |
W32.Clod916.Trojan.4ec8 |
| ESET NOD32 |
7.9341 |
Win32/Conduit.SearchProtect.A |
| Kingsoft |
2013.4.9.267 |
Win32.Troj.Generic.a.(kcloud) |
| Malwarebytes |
1.75.0.1 |
PUP.Optional.Conduit.A |
| Panda Antivirus |
10.0.3.5 |
Adware/Conduit |
| VIPRE Antivirus |
25854 |
Conduit (fs) |
Resource utilization
(Note: statistics below are averages based on a minimum sample size of 200 unique participants)
Averages
| CPU |
| Total CPU: | 0.00554597% | |
| Kernel CPU: | 0.00177037% | |
| User CPU: | 0.00377560% | |
| Kernel CPU time: | 12,537 ms/min | |
| Context switches: | 4/sec | |
| Memory |
| Private memory: | 25.86 MB | |
| Private (maximum): | 20.87 MB | |
| Private (minimum): | 8.42 MB | |
| Non-paged memory: | 25.86 MB | |
| Virtual memory: | 149.5 MB | |
| Virtual memory (peak): | 155.85 MB | |
| Working set: | 10.97 MB | |
| Working set (peak): | 23.5 MB | |
| Resource allocations |
| Threads: | 37 | |
| Handles: | 633 | |
| GUI GDI count: | 10 | |
| GUI GDI peak: | 11 | |
| GUI USER count: | 47 | |
| GUI USER peak: | 51 | |
Process properties
| Integrety level: | Medium |
| Platform: | 32-bit |
| Command lines: |
- "C:\users\user\appdata\roaming\searchprotect\bin\cltmng.exe"
- C:\users\user\appdata\roaming\searchprotect\bin\cltmng.exe
|
| Owner: | User |
Threads
Averages
| cltmng.exe (main module) |
| Total CPU: | 0.00406812% | |
| Kernel CPU: | 0.00073691% | |
| User CPU: | 0.00333121% | |
| CPU cycles: | 108,679/sec | |
| Memory: | 2.65 MB | |
| ntdll.dll |
| Total CPU: | 0.00405135% | |
| Kernel CPU: | 0.00114959% | |
| User CPU: | 0.00290176% | |
| CPU cycles: | 88,054/sec | |
| Memory: | 1.23 MB | |
| ole32.dll |
| Total CPU: | 0.00286722% | |
| Kernel CPU: | 0.00175219% | |
| User CPU: | 0.00111503% | |
| CPU cycles: | 59,016/sec | |
| Memory: | 1.36 MB | |
| combase.dll |
| Total CPU: | 0.00249091% | |
| Kernel CPU: | 0.00144771% | |
| User CPU: | 0.00104320% | |
| CPU cycles: | 39,306/sec | |
| Memory: | 1.21 MB | |
| MSVCR100.dll |
| Total CPU: | 0.00126120% | |
| Kernel CPU: | 0.00089881% | |
| User CPU: | 0.00036239% | |
| CPU cycles: | 31,442/sec | |
| Memory: | 760 KB | |
Common loaded modules
These are modules that are typiclaly loaded within the context of this process.
Distribution by Windows OS
| OS version | distribution |
| Windows 7 Home Premium |
43.42% |
|
| Windows 7 Ultimate |
15.79% |
|
| Windows 8 Pro |
9.21% |
|
| Microsoft Windows XP |
7.89% |
|
| Windows 7 Professional |
6.58% |
|
| Windows 8 |
5.26% |
|
| Windows Vista Home Premium |
5.26% |
|
| Windows Vista Ultimate |
3.95% |
|
| Windows 7 Starter |
2.63% |
|
Distribution by country
United States installs about 68.42% of Search Protect.
Distribution by PC manufacturer
| PC Manufacturer | distribution |
| Hewlett-Packard |
31.11% |
|
| Dell |
17.78% |
|
| Acer |
15.56% |
|
| Toshiba |
15.56% |
|
| ASUS |
6.67% |
|
| Compaq |
4.44% |
|
| Lenovo |
4.44% |
|
| Sahara |
2.22% |
|
| Samsung |
2.22% |
|
