Adware.Cydoor

The detection of Adware.Cydoor on your system indicates the presence of unwanted software that may be displaying advertisements, collecting user data, or performing other unwanted actions. Adware programs like Adware.Cydoor are designed to generate revenue for their creators by displaying ads, often in the form of pop-ups, banners, or sponsored search results. In some cases, adware can also collect user data, such as browsing history or search queries, to deliver targeted advertisements.

What Is Adware.Cydoor?

Adware.Cydoor is a type of malware that is designed to display unwanted advertisements on a user's computer. It can be installed on a system through various means, including bundled software downloads, infected websites, or email attachments. Once installed, Adware.Cydoor can modify system settings, such as changing the default search engine or homepage, to display advertisements. It can also collect user data, such as browsing history or search queries, to deliver targeted advertisements.

How Adware.Cydoor Operates

Adware.Cydoor operates by installing itself on a user's system and then modifying system settings to display advertisements. It can also collect user data, such as browsing history or search queries, to deliver targeted advertisements. In some cases, Adware.Cydoor can also install additional software, such as toolbars or browser extensions, to display more advertisements. Adware.Cydoor can be difficult to remove, as it can install itself in various locations on a system and modify system settings to maintain its presence.

Symptoms of Infection

Symptoms of Adware.Cydoor infection can include unwanted advertisements, such as pop-ups or banners, appearing on a user's computer. Users may also notice that their default search engine or homepage has been changed. Additionally, users may experience slow system performance, as Adware.Cydoor can consume system resources to display advertisements. In some cases, users may also notice that their browser is being redirected to unwanted websites or that they are receiving unwanted email messages.

• Unwanted advertisements, such as pop-ups or banners
• Changes to default search engine or homepage
• Slow system performance
• Browser redirection to unwanted websites
• Unwanted email messages

How to Remove Adware.Cydoor

1. Boot your computer in Safe Mode with Networking to prevent Adware.Cydoor from loading and to allow for removal.
2. Use a reputable anti-malware tool, such as SpyHunter, to perform a full scan of your system and remove any detected threats.
3. Uninstall any suspicious programs that may be related to Adware.Cydoor.
4. Reset your web browsers, such as Chrome, Firefox, or Edge, to their default settings to remove any changes made by Adware.Cydoor.
5. Reboot your computer and perform a follow-up scan with your anti-malware tool to ensure that Adware.Cydoor has been completely removed.

Conclusion

Removing Adware.Cydoor from your system can be a challenging task, but it is essential to prevent further damage and protect your personal data. By following the steps outlined above, you can remove Adware.Cydoor and restore your system to its normal state. It is also important to take preventive measures, such as avoiding suspicious downloads and email attachments, to prevent future infections. Additionally, keeping your operating system and software up to date can help to prevent vulnerabilities that can be exploited by malware like Adware.Cydoor. By being vigilant and taking the necessary steps, you can protect your system and your personal data from the threats posed by Adware.Cydoor and other types of malware.

Analysis Report

General information

Family Name:	Adware.Cydoor
Signature status:	No Signature

Known Samples

i

Known Samples

This section lists other file samples believed to be associated with this family.

MD5: 1be3480a9e09168e3a473f1344f1bade SHA1: 65b7559f1705698b0ae5cac9c9ecebe25a221d9e SHA256: 39058E9D60C7BEF3DEAD4E6920C49898F9F07AA0A3EDE86124B5E255B4023BCB File Size: 9.68 MB, 9675776 bytes

MD5: f34aa73c2a201c6cfe973a15100209e2 SHA1: eab49ba0fbed1a36ab544fee7405e422ba9b0e1b SHA256: 4BB1A0853DC13884ABDAD40EFF7A89CF33ED9EAEE71E50A0D8688A6AC434DB46 File Size: 6.58 MB, 6583296 bytes

MD5: 1518c52d00fd8211124c87d92c64d0bb SHA1: 4c74d777ba143a54633957beaf4d956b0a61e915 SHA256: E2F74CC4AAD417A8E16BBE7D6201A5100940F944417D4EE1982844C5329C8116 File Size: 1.90 MB, 1896448 bytes

MD5: 663f8f55c4a0a36bf1219ae69d282c83 SHA1: c1236fc2f362cf4c00d4370859ee896ae561f420 SHA256: 724474A2D2F54CEABC114097A3CD55B8A5C60339281F41A156C3DA4048C122E2 File Size: 8.42 MB, 8416256 bytes

MD5: 856a5537a3b2f9e71d25b46230b27179 SHA1: f24a0f0fffe00f52bf241d59e5f4f13380b51135 SHA256: 3D7EA82EFCCF61FFD4F8AC8E762DDAC00A6A04E8F8FCF3AE21EDE09B49B8307F File Size: 8.00 MB, 8004096 bytes

Windows Portable Executable Attributes

i

Windows Portable Executable Attributes

This section lists file attributes found within family samples. These attributes are extracted from the files’ Windows PE (Portable Executable) specification and various system flags. Portable Executable Attributes give malware researchers insight into a file’s functionality, executable details, platform and runtime environment.

• File doesn't have "Rich" header
• File doesn't have debug information
• File doesn't have exports table
• File doesn't have relocations information
• File doesn't have security information
• File has exports table
• File is 32-bit executable
• File is either console or GUI application
• File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
• File is Native application (NOT .NET application)

Show More

• File is not packed
• IMAGE_FILE_DLL is not set inside PE header (Executable)
• IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Icons

i

File Icons

This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.

Windows PE Version Information

i

Windows PE Version Information

This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.

Name	Value
Company Name	Babylon.com Ltd.
File Description	Babylon Information Tool
File Version	3.2
Internal Name	capture
Legal Copyright	Copyright © Babylon.com Ltd. 1997-2001
Original Filename	capture
Product Name	Babylon
Product Version	3.2

File Traits

• HighEntropy
• x86

Files Modified

i

Files Modified

This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.

File	Attributes
\device\namedpipe\gmdasllogger	Generic Write,Read Attributes
c:\users\user\appdata\local\microsoft\windows\usrclass.dat{dba6b5ef-640a-11ed-9bcb-f677369d361c}.txr.1.regtrans-ms	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\microsoft\windows\usrclass.dat{dba6b5ef-640a-11ed-9bcb-f677369d361c}.txr.2.regtrans-ms	Generic Read,Write Data,Write Attributes,Write extended,Append data

Registry Modifications

i

Registry Modifications

This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.

Key::Value	Data	API Name
HKCU\software\babylon\babylon translator\websearch::s2	http://search.excite.com/search.gw?search=+ÿExcite	RegNtPreCreateKey
HKCU\software\babylon\babylon translator\websearch::s3	http://www.lycos.com/cgi-bin/pursuit?cat=dir&query=+ÿLycos	RegNtPreCreateKey
HKCU\software\babylon\babylon translator\websearch::s4	http://infoseek.go.com/Titles?qt=+ÿInfoseek	RegNtPreCreateKey
HKCU\software\babylon\babylon translator\websearch::s5	http://www.altavista.com/cgi-bin/query?q=+ÿAlta Vista	RegNtPreCreateKey
HKCU\software\babylon\babylon translator\websearch::s6	http://www.askjeeves.com/main/askJeeves.asp?ask=+ÿAsk Jeeves	RegNtPreCreateKey
HKCU\software\babylon\babylon translator\websearch::s7	http://www.northernlight.com/nlquery.fcg?cb=0&qr=+ÿNorthern Light	RegNtPreCreateKey
HKCU\software\babylon\babylon translator\websearch::s8	http://www.google.com/search?q=+ÿGoogle	RegNtPreCreateKey
HKCU\software\babylon\babylon translator\websearch::s9	http://hotbot.lycos.com/?MT=+ÿHotBot	RegNtPreCreateKey
HKCU\software\babylon\babylon translator\websearch::sa	http://www.webcrawler.com/cgi-bin/WebQuery?searchText=+ÿWebCrawler	RegNtPreCreateKey
HKCU\software\babylon\babylon translator\websearch::sb	http://results.searchopolis.com/cgi-bin/britannica_results.cgi?firstResult=0&displayfirstResult=1&act.search=search&request=+ÿBr	RegNtPreCreateKey

Show More

HKCU\software\babylon\babylon translator\websearch::s0		RegNtPreCreateKey
HKCU\software\babylon\babylon translator\websearch::r2	http://search.britannica.com/bcom/search/results/1,5843,,00.html?p_query0=+ÿBritannica.com	RegNtPreCreateKey
HKCU\software\babylon\babylon translator\websearch::r3	http://www.encarta.com/find/search.asp?tr=122&search=+ÿEncarta Online	RegNtPreCreateKey
HKCU\software\babylon\babylon translator\websearch::r4	http://www.infoplease.com/search.php3?in=all&query=+ÿInfoPlease	RegNtPreCreateKey
HKCU\software\babylon\babylon translator\websearch::r5	http://www.encyclopedia.com/cgi-bin/search.cgi?search=+ÿEncyclopedia.Com	RegNtPreCreateKey
HKCU\software\babylon\babylon translator\websearch::r0		RegNtPreCreateKey
HKLM\software\classes\.bgl::	BabyGloss	RegNtPreCreateKey
HKLM\software\classes\.bgl::content type	application/bgl	RegNtPreCreateKey
HKLM\software\classes\babygloss::	Babylon Glossary	RegNtPreCreateKey
HKLM\software\classes\babygloss\defaulticon::	c:\users\user\downloads\Babylon.exe,2	RegNtPreCreateKey
HKLM\software\classes\babygloss\shell\open\command::	"c:\users\user\downloads\Babylon.exe" %1	RegNtPreCreateKey
HKLM\software\classes\mime\database\content type\application/bgl::extension	.bgl	RegNtPreCreateKey
HKCU\software\microsoft\ctf\msutb::left	ঔ	RegNtPreCreateKey
HKCU\software\microsoft\ctf\msutb::top		RegNtPreCreateKey
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75	�n & �v����Bx%� (�1`1�1HO@V�A��H[uN$ a$ b"hk`k�ql(�{b��P���! ��� ����3 �����������m�Ù��V����$ �8წ���l��&M�~�=�SB1_T�Vw��i���%�� �������AE��D��&��$���L A *�"	RegNtPreCreateKey
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75	�n ' �v����Bx%� (�1`1�1HO@V�A��H[uN$ a$ b"he�vk`k�ql(�{b��P���! ��� ����3 �����������m�Ù��V����$ �8წ���l��&M�~�=�SB1_T�Vw��i���%�� �������AE��D��&��$���L A	RegNtPreCreateKey
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75	�n * �v����Bx%� (�,=�1`1�1HO@V�A��H[uN$ N�a$ b"he�vk`k�ql(�y�9{b��P���! ��� ����3 �����������m�Ù��V����$ �8წ���l��&M�~�=�SB1_T�Vw��i���%�� �������AE��D��&��$��	RegNtPreCreateKey
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75	�n + �v ������Bx%� (�,=�1`1�1HO@V�A��H[uN$ N�a$ b"he�vk`k�ql(�y�9{b��P���! ��� ����3 �����������m�Ù��V����$ �8წ���l��&M�~�=�SB1_T�Vw��i���%�� �������AE��D��&��	RegNtPreCreateKey

Windows API Usage

i

Windows API Usage

This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.

Category	API
Anti Debug	IsDebuggerPresent
User Data Access	GetUserObjectInformation