Home Malware Programs Backdoors Backdoor.Ciadoor!rem

Backdoor.Ciadoor!rem

Posted: August 9, 2011

Backdoor.Ciadoor!rem is a backdoor Trojan and potential dropper Trojan that infects native system processes to bypass several types of security and avoid detection. After doing so, Backdoor.Ciadoor!rem will contact remote servers to receive various instructions. Backdoor.Ciadoor!rem attacks may vary from other security-related attacks to downloading other malicious programs (including scamware, viruses or keyloggers) to forcing your PC to take part in DDoS crimes. Since SpywareRemove.com malware experts have found the standard Backdoor.Ciadoor!rem infection to be sophisticated and advanced in stealth techniques, you may not be able to detect Backdoor.Ciadoor!rem without assistance from a good security program. Since Backdoor.Ciadoor!rem is an extraordinarily high security threat for your PC, prompt removal of Backdoor.Ciadoor!rem with such a program is strongly encouraged.

Backdoor.Ciadoor!rem – a Potential Rainbow of PC Security Attacks

First recorded in mid-2010, Backdoor.Ciadoor!rem remains a current and relevant threat and has been seen infecting new computers as late as August 2011. The label Backdoor.Ciadoor!rem may be used to identify several types of similar backdoor Trojans, including (but not restricted to) Backdoor:Win32/Poison.M, Backdoor:Win32/Poisonivy.E, Trojan.Win32.Chifrax.a, Trojan.Win32.Patched.ka and Virus.Win32.Bancos.AWV. The majority of these Trojans will infect native memory processes such as iexplore.exe or explorer.exe, although some Backdoor.Ciadoor!rem variants will create independent memory processes (such as 24.exe or u1015.exe) that can be seen in Task Manager.
 
Although Backdoor.Ciadoor!rem can vary widely in its minor details, all Backdoor.Ciadoor!rem infections are prone to the following forms of malicious behavior that SpywareRemove.com malware experts have observed:

  • Using various methods to launch themselves without your permission. These means may be as advanced as infecting the memory space of other processes or as simple as adding startup entries for Backdoor.Ciadoor!rem into the Registry.
  • Reducing the infected computer's security by several means. The most popular security-targeting attack that SpywareRemove.com malware research team has seen Backdoor.Ciadoor!rem engage in is the deletion of various Registry entries and values that relate to Internet Explorer's security settings. Although this doesn't cause permanent harm to any applications on your PC, Backdoor.Ciadoor!rem will make you vulnerable to other attacks until the Registry information and linked security functions are restored.
  • Creating exceptions for themselves in the Windows Firewall. This lets Backdoor.Ciadoor!rem ignore your firewall protection to send and receive information freely, including potentially private data like passwords or harmful configuration instructions.
  • Opening network ports and corresponding network activity, which is linked to the aforementioned firewall-bypassing behavior. SpywareRemove.com malware researchers have found that most Backdoor.Ciadoor!rem infections contact remote servers to receive further instructions from this point onwards. Instructions may allow remote criminals to control your PC or let Backdoor.Ciadoor!rem install other types of hostile programs.

Why Finding Backdoor.Ciadoor!rem Without Help May Be a Tough Job

It's strongly recommended for you to use your preference of advanced anti-malware software to find and delete Backdoor.Ciadoor!rem due to the highly advanced nature of Backdoor.Ciadoor!rem infections. Different Backdoor.Ciadoor!rem variants have been seen to infect a variety of other memory processes and files, make advanced Registry-based changes to system settings, conceal files in a variety of obscure locations such as the Temp or Windows system directories, and even mimic the file names of important system components like rundll23.exe.
 
Although Backdoor.Ciadoor!rem infections can come from many different sources and may even be installed by other Trojans, most Backdoor.Ciadoor!rem infections appear to be using criminal and illicitly-distributed software to infect new computers. To better keep Backdoor.Ciadoor!rem out of your PC, avoid files from sources that you haven't confirmed to be trustworthy, particularly on criminal warez website and P2P file-sharing networks.

Aliases

BackDoor-DSS.gen.a

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:



%Windir%\msn.exe File name: %Windir%\msn.exe
File type: Executable File
Mime Type: unknown/exe

Registry Modifications

The following newly produced Registry Values are:

HKEY..\..\..\..{Subkeys}KEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44E4CBD9-8063-773C-E56B-528FBD95C503}HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\..{RunKeys}HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Loading...