Arcade File Downloads Support Forum
Email
Confirm email
Articles File Help Startup DB Tips Service DB Hijack This! Analyzer

 

Cydoor Removal
NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Overview:
Cydoor is an adware applicatithatthat a number of "free" applications package to make money off of you installing their software. This practice is very common and I will never approve of it. It's truly an awful thing to install something people don't want. Remove this right away if your software doesn't actually require it. If you look around a bit you'll find a program that does the same thing only without the ads ;)

Destroy Autorun:
Delete the following keys

HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run\cydoor
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\cydoor
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonce\cydoorupdate

Reboot your system then:

Make sure you click start --> Run and type in msconfig. Then select the startup tab. Any references to the processes below should be deleted

End Processes (may or may not exist):
cd_install.exe
cd_install_202.exe
cd_install_291.exe
cd_load.exe
cfd.exe
cydoor.exe
cydoor_uninstall.exe
sahagent.exe
sahdownloader.exe

Unregister DLLs:
Tip:
this is only a list of known files/locations. You will want to do a search by the name of the file to see if they're on your system.
A while back I wrote a guide to Register/remove DLL or AX files which you will need if you don't know how to unregister these files.

Each file is in several locations so you'll need to search for them and unregister + delete them in every location you find.

cbanner2.dll
cd_clint.dll
cd_gif.dll
cd_htm.dll
cd_html.dll
cd_swf.dll
gdnp.dll
gr02.dll
im64.dll
kernellos.dll
netpal.dll
common.dll
toolbar.dll

Remove Directories:
%program_files%\toolbar
%windows%\system32\adcache
%windows%\system32\roodyc
%windows%\system\adcache

Clean your Registry:

You should be back to normal IF this was your only problem. I suggest you post in our HJT forum since its not likely that this is your only bug. Read this first


Views: 9564
Printer Friendly

Article Index:
Talk About it! -->