ClientMan
Category: Cookie
Risk:
Low Risk
* Low risk threats pose a very low risk or no immediate danger to your computer or your privacy, however these types of applications may profile user online habits, but only according to specific privacy policies stated in the applications End-User License. These types of threats generally borderline on being a threat to being a standard application that has a complex license agreement that you knowingly installed.
Description: ClientMan is a wide-ranging advertising threat. The various versions released may add advertising links to web pages, open popup adverts, and redirect search engine results, address bar searches and error pages. ClientMan is a spyware application that submits various Internet usage information to a server, including email and instant messaging details. It also submits personal information, such as IP address, browser used, and user details retrieved from other installed applications on the system. ClientMan is bundled with file sharing programs or its affiliates. The software does not contain any information about its source or purpose. Its default location is "C:\Program Files\ClientMan". ClientMan starts up every time when the computer is rebooted. The installer says the software is delivered from odysseusmarketing.com. This software has a number of variants: ClientMan.b99 variant runs at reboot. ClientMan.bho1 is a browser helper object variant. ClientMan.bho2 is a browser helper object variant. ClientMan.mskhhe is implemented as a browser helper object. ClientMan.msmc runs at reboot. ClientMan has been bundled with some versions of Grokster from late March 2003. Installed by the FavoriteMan spyware threat. Makes all targeted words in all web pages links with a yellow background, pointing to ClientMan's server odysseusmarketing.com. This may redirect to a search results site such as 1stblaze.com or epilot.com. Periodically opens pop-up advertising from odysseusmarketing.com, which may redirect to popupmarketing.com. The Tagger variant redirects use of known search engines (at the time of writing, Google and Yahoo only) to firstbookmark.com; the address bar will still show the address of the original search engine, but the content of the page will be overwritten with results from firstbookmark.com (which are currently sourced from 123search.com).
Alias: None
Signatures: None Listed
Copyright @2006 THR Computer Solutions: ClientMan