Removing Clientman

Learn how to removing and uninstall client man. In this series of our Removing clientman Spyware and Adware articles, you shall learn about how to successfully uninstall client man spyware and successfully Remove the clientman Spyware trojan from your system.
What is Clientman and how to remove this spyware
ClientMan is Browser Helper Object which is malware.
Opens popups. Crashes IE randomly. S eems to add itself to Norton Firewall allow list. Tries to read your name from: RealName, Settings \Software\Microsoft\Internet Account Manager\Accounts\ SMTP Display Name, InstallUser, BusinessTitle, JobTitle, vCard. Various versions will redirect [hijack] search engine results, searches from your address bar, & even error pages. Some versions add advertising links to web pages & display popup ads. Installing it is highly not recommended.
This Browser Helper Object is also known as:
Adware/Madfinder - named by Panda.
Backdoor/Armageddon.20!Server - named by Computer Associates.
iPend - named by o.
SearchFu/123Search.
Spyware/ClientMan - named by Panda.
Trj/Small.AQ - named by Panda.
Trojan Horse - named by Panda.
Trojan.Win32.Small.i - named by Kaspersky.
TrojanNotifier.Win32.EES.a - named by Kaspersky.
Win32.Madfind.A - named by Computer Associates.
Win32.Siboco.B - named by Computer Associates.
Win32/MadFind!Trojan - named by Computer Associates.
Win32/MadFind.BH!Trojan - named by Computer Associates.
Win32/Siboco.B!Trojan - named by Computer Associates.

How to remove Clientman - Removing Clientman Instructions

There may be an entry for mscman in the Control Panel's Add/Remove Programs list, you can use it to remove ClientMan.

If that fails, do the following to remove ClientMan,

  1. Open the registry (click 'Start', choose 'Run' and enter 'regedit') and find the key Software\Microsoft\Windows\CurrentVersion\Run, inside HKEY_LOCAL_MACHINE (for ClientMan/Helper and ClientMan/Tagger) or HKEY_CURRENT_USER (for ClientMan/2in1). On the right pane, right-click the entry 'ClientMan' or 'ClientMan1' and choose 'Delete'.
  2. Now open the 'run' folder inside 'ClientMan' in the Program Files folder, and note the names of the DLLs. If you have the Helper variant, you should see 'browserhelperX.dll' and 'trackurlX.dll', where X is a random eight-digit hexadecimal value. If you have the Tagger variant, you should have 'taggerbhoX.dll', 'trackurlX.dll' and 'searchrepX.dll'. In either variant, you may have further leftover DLLs from previous updates.
  3. Open a DOS command prompt window (from Start->Programs->Accessories). Enter the following commands in the DOS window,
    for the Helper variant:
    cd "%WinDir%\System"
    regsvr32 /u "\Program Files\ClientMan\run\browserhelperX.dll"
    regsvr32 /u "\Program Files\ClientMan\run\trackurlX.dll"

    Or, for the Tagger variant:
    cd "%WinDir%\System"
    regsvr32 /u "\Program Files\ClientMan\run\taggerbhoX.dll"
    regsvr32 /u "\Program Files\ClientMan\run\trackurlX.dll"
    regsvr32 /u "\Program Files\ClientMan\run\searchrepX.dll"

    Or, for the 2in1 variant:
    cd "%WinDir%\System"
    regsvr32 /u "\Program Files\ClientMan\run\urlcliX.dll"
    regsvr32 /u "\Program Files\ClientMan\run\trackurlX.dll"
    regsvr32 /u "\Program Files\ClientMan\run\searchrepX.dll"
    regsvr32 /u "\Program Files\ClientMan\run\msvrfyX.dll"
    regsvr32 /u "\Program Files\ClientMan\run\gstylebhoX.dll"
    regsvr32 /u "\Program Files\ClientMan\run\dnsrepX.dll"
    regsvr32 /u "\Program Files\ClientMan\runin1X.dll"

    Replace the 'X' in these commands with the random letters and numbers you see in the filenames in the folder view. If there's more than one file with the same name but a different set of numebrs you can use either, it doesn't matter. Tip: if you drag the DLL file from the folder view into the DOS command prompt window, it will put the filename in for you, so you don't have to type it out.

    Users of non-English versions of Windows may also need to replace the name 'Program Files' with the name of the Program Files folder on their operating system. Tip: if you drag the file in question into the DOS command prompt window, its full name will be inserted for you. Remember to include the space after '/u' before dragging in a file if you do this.
  4. Rstart the computer.
  5. Delete the entire 'ClientMan' folder inside Program Files. You can also delete the 'words.lst' file inside the Windows folder and the 'cachelut.dat' file which you may find inside the Windows folder or inside the Internet Explorer folder in Program Files.
  6. Open registry editor, find and delete the following registry keys: 'HKEY_CURRENT_USER\Software\CliMan' and 'HKEY_CURRENT_USER\Software\iPend'
Return from Removing Clientman to Free Spyware Removal home page

©Copyright 2005-2008 Free Spyware Removal All Rights Reserved