Spy Sweeper with AntiVirus

The most award-winning anti-spyware software

Spy Sweeper with Antivirus

Get serious about removing spyware with Spy Sweeper - the award-winning anti-spyware software trusted by millions of home computer users.

Add to Cart Button

$29.95

Spyware & Virus Directory

A B C D E F G H I J K L M N O P Q R S T U V W X Y Z 

Adware.CDT

Updated: June 14, 2006 01:44:02 PM ZE9
Type: Security Risk Removal Tool, Adware
Risk Impact: Medium
File Names: Mediatickets.exe
Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows XP

SUMMARY


Behavior

Adware.CDT is an adware program that displays advertisements, reduces the security settings for the Trusted Sites zone in Internet Explorer, and attempts to fraudulently install trusted publishers.

Symptoms

Your Symantec program detects this threat as Adware.CDT.

Transmission

This adware component can be manually installed, or installed as a component of another program.

Protection

  • Virus Definitions (LiveUpdate™ Weekly) August 11, 2004
  • Virus Definitions (Intelligent Updater) August 6, 2004

TECHNICAL DETAILS


When Adware.CDT is executed, it performs the following actions:
  1. Displays pop-up advertisements.

  2. Adds the following domains into the Trusted Sites zone for Internet Explorer:

    blazefind.com
    clickspring.net
    flingstone.com
    mt-download.com
    my-internet.info
    searchbarcash.com
    searchmeup.cc
    searchmiracle.com
    skoobidoo.com
    slotch.com
    xxxtoolbar.com

    by adding the value:

    "*" = "0x00000002"

    to the registry keys:

    HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInternet SettingsoneMapDomainslazefind.com
    HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInternet SettingsoneMapDomainsclickspring.net
    HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInternet SettingsoneMapDomainsflingstone.com
    HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInternet SettingsoneMapDomainsmt-download.com
    HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInternet SettingsoneMapDomainsmy-internet.info
    HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInternet SettingsoneMapDomainssearchmeup.cc
    HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInternet SettingsoneMapDomainssearchmiracle.com
    HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInternet SettingsoneMapDomainsskoobidoo.com
    HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInternet SettingsoneMapDomainsslotch.com
    HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInternet SettingsoneMapDomainsxxxtoolbar.com
    HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionInternet SettingsoneMapDomainslazefind.com
    HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionInternet SettingsoneMapDomainsclickspring.net
    HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionInternet SettingsoneMapDomainsflingstone.com
    HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionInternet SettingsoneMapDomainsmt-download.com
    HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionInternet SettingsoneMapDomainsmy-internet.info
    HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionInternet SettingsoneMapDomainssearchbarcash.com
    HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionInternet SettingsoneMapDomainssearchmeup.cc
    HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionInternet SettingsoneMapDomainssearchmiracle.com
    HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionInternet SettingsoneMapDomainsskoobidoo.com
    HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionInternet SettingsoneMapDomainsslotch.com
    HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionInternet SettingsoneMapDomainsxxxtoolbar.com

  3. Adds the IP address, 69.31.87.223, into the Trusted Sites zone for Internet Explorer, by adding the value:

    "*" = "0x00000002"
    ":Range" = "69.31.87.223"

    to the registry keys:

    HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersion
    Internet SettingsoneMapRangesRange1

    HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersion
    Internet SettingsoneMapRangesRange1

  4. Allows the downloading of active content and running ActiveX scripts, and enables ActiveX controls and plug-ins by adding the values:

    "MinLevel" = "Code Download"
    "Safety Warning Level" = "SucceedSilent"
    "Security_RunActiveXControls" = "0x01000000"
    "Security_RunScripts" = "0x01000000"
    "Trust Warning Level" = "No Security"

    to the registry keys:

    HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionInternet Settings
    HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionInternet Settings

  5. Allows Internet Explorer to run .NET components regardless of whether they are signed with Authenticode, by adding the values:

    "2001" = "0x00000000"
    "2004" = "0x00000000"

    to the registry key:

    HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersion
    Internet Settingsones2

  6. Attempts to fraudulently install the following trusted publishers:

    CDT inc.
    MediaTickets
    Integrated Search Technologies

    by adding the values:

    "ppcimdnnnjbeahepfabjipfginloedkg egckak" = "CDT inc."
    "goicfboogidikkejccmclpieicihhlpo ejemdn" = "MediaTickets"
    "goicfboogidikkejccmclpieicihhlpo bihgbp" = "Integrated Search Technologies"

    to the registry key:

    HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionWinTrust
    Trust ProvidersSoftware PublishingTrust Database



REMOVAL


Removal Tool
Symantec Security Response has developed a removal tool for Adware.CDT. Use this removal tool first, as it is the easiest way to remove this risk.

The tool can be found here: http://securityresponse.symantec.com/avcenter/FixCDT.exe

The current version of the tool is 1.0.1 and will have a digital signature timestamp equivalent to 06/14/2005 11:34 AM PST

Note: The date and time displayed will be adjusted to your time zone, if your computer is not set to the Pacific time zone.

It has been reported that a computer with this security risk on it may also have other security risks installed. Symantec recommends that the following steps be carried out:
  1. Run the Removal Tool.
  2. Update the definitions by starting the Symantec program and running LiveUpdate.
  3. Run a full system scan to detect any other security risks on the computer.
  4. If the scan detects any further security risks, check for removal tools at http://securityresponse.symantec.com/avcenter/security.risks.tools.list.html
  5. If there are no removal tools for the security risks that are detected, follow the manual removal instructions listed in the risk report.

Manual Removal
The following instructions pertain to all Symantec antivirus products that support Security Risk detection.
  1. Update the definitions.
  2. Run a full system scan.
  3. Delete the value that was added to the registry.
For specific details on each of these steps, read the following instructions.

1. To update the definitions
To obtain the most recent definitions, start your Symantec program and run LiveUpdate.

2. To run the scan
  1. Start your Symantec antivirus program, and then run a full system scan.
  2. If any files are detected as Adware.CDT and depending on which software version you are using, you may see one or more of the following options:


    Note: This applies only to versions of Norton AntiVirus that support Security Risk detection. If you are running a version of Symantec AntiVirus Corporate Edition that supports Security Risk detection, and Security Risk detection has been enabled, you will only see a message box that gives the results of the scan. If you have questions in this situation, contact your network administrator.
    • Exclude (Not recommended): If you click this button, it will set the threat so that it is no longer detectable. That is, the antivirus program will keep the security risk on your computer and will no longer detect it to remove from your computer.

    • Ignore or Skip: This option tells the scanner to ignore the threat for this scan only. It will be detected again the next time that you run a scan.

    • Cancel: This option is new to Norton Antivirus 2005. It is used when Norton Antivirus 2005 has determined that it cannot delete a security risk. This Cancel option tells the scanner to ignore the threat for this scan only, and thus, the threat will be detected again the next time that you run a scan.

      To actually delete the security risk:
      • Click its file name (under the Filename column).
      • In the Item Information box that displays, write down the full path and file name.
      • Then use Windows Explorer to locate and delete the file.

        If Windows reports that it cannot delete the file, this indicates that the file is in use. In this situation, complete the rest of the instructions on this page, restart the computer in Safe mode, and then delete the file using Windows Explorer.

    • Delete: This option will attempt to delete the detected files. In some cases, the scanner will not be able to do this.
      • If you see a message, "Delete Failed" (or similar message), manually delete the file.
      • Click the file name of the threat that is under the Filename column.
      • In the Item Information box that displays, write down the full path and file name.
      • Then use Windows Explorer to locate and delete the file.

        If Windows reports that it cannot delete the file, this indicates that the file is in use. In this situation, complete the rest of the instructions on this page, restart the computer in Safe mode, and then delete the file using Windows Explorer.


3. To delete the value from the registry

Important: Symantec strongly recommends that you back up the registry before making any changes to it. Incorrect changes to the registry can result in permanent data loss or corrupted files. Modify the specified keys only. Read the document, "How to make a backup of the Windows registry," for instructions.

  1. Click Start > Run.
  2. Type regedit

    Then click OK.

  3. Navigate to and delete these keys:

    HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInternet SettingsoneMapDomainslazefind.com
    HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInternet SettingsoneMapDomainsclickspring.net
    HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInternet SettingsoneMapDomainsflingstone.com
    HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInternet SettingsoneMapDomainsmt-download.com
    HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInternet SettingsoneMapDomainsmy-internet.info
    HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInternet SettingsoneMapDomainssearchbarcash.com
    HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInternet SettingsoneMapDomainssearchmeup.cc
    HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInternet SettingsoneMapDomainssearchmiracle.com
    HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInternet SettingsoneMapDomainsskoobidoo.com
    HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInternet SettingsoneMapDomainsslotch.com
    HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInternet SettingsoneMapDomainsxxxtoolbar.com
    HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInternet SettingsoneMapRangesRange1
    HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionInternet SettingsoneMapDomainslazefind.com
    HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionInternet SettingsoneMapDomainsclickspring.net
    HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionInternet SettingsoneMapDomainsflingstone.com
    HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionInternet SettingsoneMapDomainsmt-download.com
    HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionInternet SettingsoneMapDomainsmy-internet.info
    HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionInternet SettingsoneMapDomainssearchbarcash.com
    HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionInternet SettingsoneMapDomainssearchmeup.cc
    HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionInternet SettingsoneMapDomainssearchmiracle.com
    HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionInternet SettingsoneMapDomainsskoobidoo.com
    HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionInternet SettingsoneMapDomainsslotch.com
    HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionInternet SettingsoneMapDomainsxxxtoolbar.com
    HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionInternet SettingsoneMapRangesRange1

  4. Navigate to the key:

    HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionWinTrustTrust ProvidersSoftware PublishingTrust Database

  5. In the right pane, delete the values:

    " ppcimdnnnjbeahepfabjipfginloedkg egckak" = "CDT inc."
    "goicfboogidikkejccmclpieicihhlpo ejemdn" = "MediaTickets"
    "goicfboogidikkejccmclpieicihhlpo bihgbp" = "Integrated Search Technologies"

  6. Navigate to the keys:

    HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionInternet Settings
    HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionInternet Settings

  7. In the right pane, delete the values:

    "MinLevel" = "Code Download"
    "Safety Warning Level" = "SucceedSilent"
    "Security_RunActiveXControls" = "0x01000000"
    "Security_RunScripts" = "0x01000000"
    "Trust Warning Level" = "No Security"

  8. Navigate to the key:

    HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionInternet Settingsones2

  9. In the right pane, delete the values:

    "2001" = "0x00000000"
    "2004" = "0x00000000"

  10. Exit the Registry Editor.




Spy Sweeper 5.2 stops spyware in its tracks while offering home computer users the ability to configure the program to suit their specific needs, such as:

Choose a Quick, Full or Custom Sweep: With Spy Sweeper 5.2, you can easily choose to perform a quick, full or customized sweep. If you're looking for an immediate diagnosis, choose a quick sweep. For a pinpointed search, customize your sweep to have Spy Sweeper skip files by folder or file extension. For a deep cleaning, opt for a full sweep.

Exclude Files from a Sweep: Spy Sweeper allows you to save time during a sweep by skipping specific files or different sections of your PC. You can select specific file extension, such as .xls or .mpg to exclude.

Additional Highlights

As soon as it's installed, Spy Sweeper gives 360 degrees of protection against spyware, including:

Simple Sweeps: Detecting spyware and removing unwanted programs found on your computer in three effortless steps

Easy Management: Quickly and simply configure program, sweep and upgrade options

Fast Home: Use the home screen to access the most commonly used functions of Spy Sweeper

Shields Summary: A redesigned shields summary page makes it simple to see at a glance which shields are on or off

Action Alerts: Receive clear, easy-to-understand notifications when new spyware threats are detected

"Spy Sweeper remains a favorite for protection from spyware."



"This program's dominance is apparent as soon as you install it."