CIA removal

Spyware CIA Information
Name: CIA Category: RAT Date: 2003-03-23 Author: Alchemist Coded in: VB6.0 Dangerous: Yes

CIA is one of RAT spywares.
Finding it on your computer means that your computer is infected with RAT and crucial data could be endangered or even lost.

CIA description by Alchemist:

Vendor: ´ C.I.A Cruel Intentionz Admistrator By Alchemist Coded in VB6.0 Multi Client Support Resizable Forms. ´Features FileManger - Get drives Refresh Execute exe/bat ect delete file rename file define wallpaper (bmp) play .wav get file size upload download Process Control - get process kill process window control - get windows visible/invisible near window minimize maximize hide window show window define on top/off top rename caption send keys to window Screen Capture - Set jpg quality 1-99 check if dll exists full screen display get screen/active window constant/not consant capture save pictures to folder Webcam Capture - Set jpg quality 1-99 check if dll exists list drivers define driver constant/not consant capture save pictures to folder Key logger - start/stop keylog clear log save log Passwords - get cached passwords save passwords transfers - get transfer name speed of transfer amount transfered Chat - Open/close chat define your nick define there nick define chat caption clear chat save chat Msn - Send to fake login screen get logged passwords Power - Shut down restart force shutdown Server - get server info restart server near server uninstall server Printer - Print Text Explorer - Get I.E 5.5 history Get opera 7 history send to webpage Messages - define title define body test message send message send input box Clipboard - get clipboard text define clipboard text Batch Scripting - Make unremovable directorys Deltree System any file get system.ini get win.ini get control.ini get msdos.sys get winstart.bat get autoexec.bat change them & upload Redirect Dos - get dos command outputs mouse hide/show cursor swap buttons Server/Edit Server define main port define victim name define password define start up method choose server name after install cgi notify icq notify fake error pack server´ C.I.A v1.2 Public Beta By Alchemist Added in v.1.21 Beta Fixed Transfer Remove item bug File Manager Show Hidden and System Any file and Faster :P upload plugin bux fixed (tryed to upload while you where uploading or download) server builder cancel bug fixed logger retreiver adds password in password box bug fixed logger retreiver cgi last ip bug fixed changing icon issues fixed slightly (remember only 32 x 32 icons) client remembers screen values height and width of each window offline key logger issues fixed improved encryption (hopefully fixed cgi notify issues) added zonealarm mutex exploit (stops all zonealarm versions loading)

This RAT is also known as:

•Backdoor Program - named by Panda.
• Backdoor.Ciadoor.10.a - named by Kaspersky.
• Backdoor.Ciadoor.11.a - named by a.
• Bckdoor.Cidoor.11.c.
• Backdoor.Ciadoor.122.
• Backdoor.Ciadoor.a.
• Backdoor.Ciadoor.logger.
• BackDoor-ASB - named by McAfee.
• BackDoor-ASB.cfg trojan - named by c.
• BakDoor-ASB.li trojan.
• BackDoor-ASB.svr trojan.
• Bck/Ciadoor.10 - named by Panda.
• Cruel Intentionz Administator - named by a.
• security risk named W32/CYAdoor.A - named by F-Prot.
• security risk or a "backdoor" program - named by F-Prot.
• Win32.Ciadoor.1 - named by Computer Associates.
• Win32/Ciadoor.10!Backdoor!Server - named by Computer Associates.

>> Delete CIA automatically - Download Spyware Doctor

CIA Removal Instructions
Kill the following processes 0895ee42.exe, 3ec8d1fb.exe, 45534355.exe, 462ac4c3.exe, client.exe, copy of webcam pic.exe, edit server.exe, server builder.exe, server.exe, server_unpacked.exe, server_upx.exe
Unregister the following DLLs and reboot cjpg.dll, pspv.dll.
Delete these registry entries HKEY_CURRENT_USER\software\microsoft\windows nt\currentversion\windows\run\runtime process HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\runtime process
Remove the following files 0895ee42.exe, 3ec8d1fb.exe, 45534355.exe, 462ac4c3.exe, about skins.txt, add.php, anonying shit.txt, apple mac.skn, c..i.a 1.2 tutorial.doc, c.i.a blue.skn, cia 1.22 tutorial.doc, ciaadvanced.skn, cjpg.dll, client.exe, client.ini, copy of webcam pic.exe, default.ssd, disclaimer.txt, edit server.exe, editor.ini, huge kill list.txt, list.cgi, log.cgi, matrix.skn, msn6.cip, notes.txt, notice.txt, passdevil.skn, plugins notice.txt, pspv.cip, pspv.dll, read me.txt, read.txt, readme.txt, server builder.exe, server.exe, server_unpacked.exe, server_upx.exe, stop.bat, stub.stb, the matrix.skn, thumbs.db, tz's pager.skn, windows utilities.txt, yah5.cip. okl.okl, okl445.dat in Windows\system\

Bookmark CIA page

Previous Spyware: Remove Chupacabra

Next Spyware: Remove CIA 1.0a