Cydoor

· Overview ·
· Origins ·
· Distribution ·
· Operation ·
· Risks ·
· Recommendations ·
· Detection and Removal ·
· Research ·

Overview

Vendor Notes:

 Cydoor Desktop Media leads the world in providing online advertising reach and results. Founded in 1997, Cydoor Desktop Media has expanded to successfully offer advertisers network and search media solutions. Our customers' marketing objectives are met through the strength of our extensive reach, Media Optimization System and our professional client services team. --http://www.cydoor.com/

Alias:

 Spyware/Cydoor [Panda], TrojanDownloader.Win32.BHO [Kaspersky]

See Also:

 Belcaro GoldenRetriever · SAHAgent

Category:

Adware: Software that displays popup/popunder ads when the primary user interface is not visible or which do not appear to be assocaited with the product.

Similar Pests:

 Adware

Origins

Group:

 Cydoor Desktop Media

Vendor:

 Cydoor Technologies, Inc.

By This Group:

 Cydoor.com ·

Mailing Address:

 New York City Office 135 West 29th St. Suite 302 NYC, NY 10001 Two Pidgeon Hill Drive Suite 340 Sterling, VA 20165

Phone:

 212 268 4535 Fax - 212 268 0099 Tel - 703 444 0968 Fax- 703-444-6914

EMail:

 privacy@cydoor.com

URL:

 http://www.cydoor.com

Date of Origin:

 November, 2000

Distribution

Distribution:

 The Cydoor site claims that Cydoor ships with KaZaA, NetAnts, LimeWire, Babylon, IMesh, and other applications. May also ship with Rosoft CD Extractor, and Rosoft Audio Recorder.

Prevalence:
  • Cydoor: 0.3%
    • More Info

    Clot Factor:
  • Cydoor: 89

    • The "Clot Factor" is a measure of how much a pest "gums up" a machine by adding registry entries, files, and directories. As more objects are placed in a machine, manual removal becomes more difficult and more error-prone.

    Growth:
  • Cydoor: Insufficient data to report growth
    		•

    Operation

    Platform:

    		 Windows 95/98/NT/2000/Me/XP compatible.

    General:

    Always embedded with some host application. Cydoor's Ads OnSoftware™ embeds advertising in host software, converting it to "free" adware. User tracking is tied to the GUID (Global Unique Identifier): "Upon installation of a software application integrated with our advertising technology, Cydoor Technologies sets a numerical identifier on your computer."

    Two Cydoor applications are potentially involved: CD_CLINT and CD_LOAD.

    • CD_CLINT: If the application with which Cydoor is bundled is an online application, such as a browser or P2P program, then CD_CLINT.EXE/CD_CLINT.DLL is installed.
    • CD_LOAD: For offline applications, such as MP3 players, CD_LOAD.EXE/CD_LOAD.DLL is installed. CD_LOAD.EXE runs in the background always, and whenever a connection is available, downloads ads for offline use. CD_Load.exe has no user interface. Upon invocation, it immediately tries to make an internet connection to 209.67.3.166:53 or some other address, depending on version. Even if denied the connection, it remains resident. "Your software does not have to be Internet related. The only requirement is that users occasionally go on the Internet so that ads can be downloaded transparently while they are online." - Cydoor.

    With each boot, Cydoor attempts to make contact with its host via the internet. Some versions may use HTTP port 80 to connect to any of the servers listed here. After data exchange, ads are retrieved from the server and downloaded to c:\Windows\System\adcache\ for subsequent display.

    Users do not have to be online while using software embedded with Cydoor: "Ads are pulled from the protected ad cache within each user's computer whether they are online or offline. Your program will continuously display ads from the cache until it is updated-which occurs the next time the user goes online. Ad loads and reports are transmitted the moment that happens."

    Advertising:

    		 Yes. 'The Cydoor component of a software application is simply a caching mechanism, which stores ads on your hard drive, and displays them only while the program is open. When the ads have expired, the component deletes old ads and contacts Cydoor's servers in order to receive new ones. To do this, the Cydoor component uses your Internet connection, which was designed to take up the minimum bandwidth on your line. Each ad banner on your hard disc is about 10Kbyte.' -- http://www.cydoor.com/Cydoor/index2.html

    Storage Required:
  • Cydoor: at least 3741 KB
    		•

    ScreenShot:

    No interface. When the product associated with Cydoor installs, you will see a screen such as that shown below. After providing such information, no further screens are shown.

    Risks

    Privacy Issues:

    		 Transmits email address and user-supplied demographic information (if supplied) to Cydoor. Demographic info is shared with third parties. Transmits advertising metrics such as ad displays and clicks.

    from the privacy policy: 'Please be aware that Cydoor advertisers or Web sites that have links in software on our network may utilize demographic information about you. This privacy statement does not cover the information practices of those Web sites linked from software on the Cydoor Network. From time to time, Cydoor works with third-party ad servers such as Valueclick, Commission Junction, Adventures, Advertising.com, RealMedia and BeFree and others to serve advertising to the Cydoor Network. Please visit these providers individually to learn more about how they handle privacy.

    'Some software installations will direct you to a partner site, where you may be prompted to complete a registration. The information our business partners collect pertains strictly to their privacy practices, and we do not have access to any of the information collected at these sites. In addition to demographic data, Cydoor requires that you provide your email address during the installation of Cydoor-enabled software programs. If you prefer not to provide us with your email address, then you may opt-out of the software installation. Providing Cydoor with your email address will enable us to send Cydoor-specific technology updates, as well as special offers and promotions from our business partners.' -- http://www.cydoor.com/Cydoor/index2.html

    Privacy Policy:

    		 http://www.cydoor.com/Cydoor/index2.html http://www.cydoor.com/Cydoor/Company/CompanyPrivacy.htm

    Security Issues:

    		 None known.

    Stability Issues:

    		 Numerous reports of Cydoor and associated applications causing errors in Windows XP.

    Recommendations

    Prevention:

    To prevent ad transfer, add these rows to your hosts file:

    127.0.0.1 www.bns1.net # Cydoor
    127.0.0.1 www.bns2.net # Cydoor
    127.0.0.1 www.bns3.net # Cydoor
    127.0.0.1 www.bns4.net # Cydoor
    127.0.0.1 www.bns5.net # Cydoor
    127.0.0.1 www.bns6.net # Cydoor
    127.0.0.1 www.bns7.net # Cydoor
    127.0.0.1 www.bns8.net # Cydoor
    127.0.0.1 www.cms1.net # Cydoor
    127.0.0.1 www.cms2.net # Cydoor
    127.0.0.1 www.cms3.net # Cydoor
    127.0.0.1 www.cms4.net # Cydoor
    127.0.0.1 www.cms5.net # Cydoor
    127.0.0.1 www.cms6.net # Cydoor
    127.0.0.1 www.cms7.net # Cydoor
    127.0.0.1 www.cms8.net # Cydoor
    127.0.0.1 www.rg1.com # Cydoor
    127.0.0.1 www.rg2.com # Cydoor
    127.0.0.1 www.rg3.com # Cydoor
    127.0.0.1 www.rg4.com # Cydoor
    127.0.0.1 www.rg5.com # Cydoor
    127.0.0.1 www.rg6.com # Cydoor
    127.0.0.1 www.rg7.com # Cydoor
    127.0.0.1 www.rg8.com # Cydoor
    127.0.0.1 www.cydoor.com # Cydoor
    127.0.0.1 jcms.cydoor.com # Various
    127.0.0.1 cydoor.com # Cydoor

    Detection and Removal

    Automatic Removal:

    PestPatrol detects this.

    PestPatrol removes this.

    Manual Removal:

    		 Follow these steps to remove Cydoor from your machine. Begin by backing up your registry and your system, and/or setting a Restore Point, to prevent trouble if you make a mistake.
    Stop Running Processes:

    Kill these running processes with Task Manager:

    Remove AutoRun Reference:

    Go To the key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run.
    If you find the value HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run\cydoor, delete it and reboot the machine immediately.
    If you find the value HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\cydoor, delete it and reboot the machine immediately.
    If you find the value HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonce\cydoorupdate, delete it and reboot the machine immediately.



    Unregister DLLs:

    Unregister these DLLs with Regsvr32, then reboot:

    Clean Registry:

    Remove these registry items (if present) with RegEdit:

    Remove Files:

    Remove these files (if present) with Windows Explorer:

    Remove Directories:

    Remove these directories (if present) with Windows Explorer:

    Research

    File Analyses:

    More Info:
  • AllTheWeb, AltaVista, AOL Search, Ask Jeeves, Google, HotBot, Lycos, LookSmart, MSN, Yahoo!
    		•

    Research By:
  • Benjamin Googins
  • PestPatrol's Pest Research Center
    		•

    Last Revised:

    		 April 15, 2005