Adware Cydoor Spyware
Type: Adware (Previously called Spyware)
Publisher: Cydoor TechnologiesSystems Affected: Windows 95, Windows 98, Windows NT, Windows 2000, Windows XP, Windows Me
Systems Not Affected: DOS, Linux, Macintosh, OS/2, UNIX, Windows 3.x
This spyware threat can be detected only by free Spyware Scanner software that support expanded threats.
The Spyware's Behavior
Spyware 'Cydoor' has an adware program that downloads advertisements from a server and displays them on your computer.The spyware files on your system will be able to be detected as Adware under the file name(s) Cydoor.
The adware program must be manually installed. There are several known programs that have Cydoor's spyware within them and that install it as the program itself is installed.
File names: cd_clint.dll; cd_load.exe
Adware 'Cydoor' is an adware program that displays advertisements.
When Spyware Cydoor is executed, it performs the following:
Creates the files:System\Cd_clint.dll
System\Cd_load.exe
Creates the registry keys:
HKEY_USERS\.DEFAULT\Software\Cydoor
HKEY_USERS\.DEFAULT\Software\Cydoor Services
HKEY_CURRENT_USER\Software\Cydoor
HKEY_CURRENT_USER\Software\Cydoor Services
HKEY_LOCAL_MACHINE\Software\Cydoor
Other applications usually install Spyware Cydoor.
The spyware does not add a registry value to launch itself at startup. Instead, it allows the program that installed it to launch it as the program itself is started. Then, the program uses Cydoor's Adware to download and display advertisements.
The Cd_load.exe spyware file is only installed when the program that installed Cydoor's adware does not require an Internet connection to function. This file is only used to check for the active Internet connections. The spyware file, Cd_clint.dll, contains all the functionality.
When Cydoor's adware is launched after installation, it will contact the server rgs?.net (in which ? is a number between 1 – 4) on port 80. The adware is not limited to contacting this server alone. The adware can receive a list of other servers from the initial server and connect to them instead. These servers are advertisement servers, and it is from these servers that Cydoor retrieves the advertisements.
*Make sure you run a full system spyware scan and delete all the spyware files detected as Adware under the file name(s) Cydoor.
Then delete the spyware keys that were added to the registry.
Scanning for and Deleting the Spyware files
*If you know the name of the spyware program that installed the Adware 'Cydoor', make sure that the program is not running. If you do not know the name of the program, restart the computer in Safe mode before running your spyware scan.Run your free spyware scanner and make sure that it is configured to scan all files.
Run a full system spyware scan.
If any files are detected as spyware infected with the Adware Cydoor, click Delete.
Deleting the Spyware Values from the Registry
Click Start, and then click Run. (The Run dialog box appears.)Type regedit
Then click OK. (The Registry Editor opens.)
Navigate to and delete the spyware's keys:
HKEY_USERS\.DEFAULT\Software\Cydoor
HKEY_USERS\.DEFAULT\Software\Cydoor Services
HKEY_CURRENT_USERS\Software\Cydoor
HKEY_CURRENT_USERS\Software\Cydoor Services
HKEY_LOCAL_MACHINE\Software\Cydoor
Exit the Registry Editor.
You will find much more on this topic at WorldsLargestNetwork.com
 |
|
|
|
|
WorldsLargestNetwork.com
Free Spyware Scanner
PC Speed Boost
Create Website Easily
Computer Monitoring Software
Internet Education
Anti Spy Software
Stop Pop Ups
Scan PC for Spyware
Pop-up Eliminator
