ADW_DYCOO
Adware:Win32/Cydoor (Microsoft), Adware/Cydoor (Panda), Cydoor (Sunbelt)
Windows 2000, Windows Server 2003, Windows XP (32-bit, 64-bit), Windows Vista (32-bit, 64-bit), Windows 7 (32-bit, 64-bit)
Threat Type: Adware
Destructiveness: No
Encrypted:
In the wild: Yes
OVERVIEW
This adware arrives as a component bundled with malware/grayware packages. It may be manually installed by a user.
TECHNICAL DETAILS
1,593,997 bytes
EXE
07 Nov 2012
Arrival Details
This adware arrives as a component bundled with malware/grayware packages.
It may be manually installed by a user.
Installation
This adware drops the following files:
- %System%\cd_clint.dll
- %System%\cd_load.exe
- %System%\AdCache\b_{random number}.GIF
(Note: %System% is the Windows system folder, which is usually C:\Windows\System32.)
It creates the following folders:
- %System%\AdCache
- %System%\AdCache\Temp
(Note: %System% is the Windows system folder, which is usually C:\Windows\System32.)
Other System Modifications
This adware adds the following registry entries:
HKEY_CURRENT_USER\Software\Cydoor\
Adwr_167\Loct_0\Level_4\
Seqn_{random number}
Url = "www.cydoor.com/BestDeals"
HKEY_CURRENT_USER\Software\Cydoor\
Adwr_167\Loct_0\Level_4\
Seqn_{random number}
Url = "http://service.bfast.com/bfast/click?bfmid=1429031&siteid=8854274&bfpage=homelinks"
HKEY_CURRENT_USER\Software\Cydoor\
Adwr_167\Loct_0\Level_4\
Seqn_{random number}
Url = "http://www.commission-junction.com/track/track.dll?AID=1143760&PID=190859&URL=http%3A%2F%2Ffxnetworks%2Ecom%2Fshows%2Foriginals%2Fthesight%2Findexcj%2Ehtml"
It adds the following registry keys as part of its installation routine:
HKEY_CLASSES_ROOT\Prod.Cap
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Prod.Cap
HKEY_CURRENT_USER\Software\Cydoor
HKEY_LOCAL_MACHINE\SOFTWARE\Cydoor
HKEY_CURRENT_USER\Software\Cydoor\
Adwr_167
HKEY_CURRENT_USER\Software\Cydoor Services