NetDefend IPS
IPS Advisories
NetDefend
Anti-Virus
Anti-Virus Advisories
NetDefend Web Content Filtering
NetDefend IP Reputation
NetDefend Update Center
IPS History
Oct 17, 2024
Oct 09, 2024
Oct 04, 2024
Oct 03, 2024
Sep 25, 2024
Anti-Virus History
Feb 12, 2022
Jan 06, 2022
Oct 23, 2021
Aug 29, 2021
Aug 23, 2021







Home > NetDefend Live > NetDefend IPS Service
NetDefend IPS Service
Print
Advisory ID
2007
Name
Cyn Backdoor
IPS Signature
Maintenance IPS Signature
IPS Group
FROM / EXT / EXPLOIT
Issued
Apr 01, 2001
Description
Cyn, also known as Backdoor.Antilam.g1, Backdoor.Cyn.101, Backdoor.Cyn.102, Backdoor.Cyn.103, Backdoor.Cyn.12.a, Backdoor.Cyn.121 and Backdoor.Cyn.20, and Cyn_Trojan, is a backdoor Trojan written in Visual Basic. The server attempts to open a port, typically UDP ports 1183; UDP/TCP ports 11225 and 113; and TCP ports 15432, 22115, and 51234.
Behaviour: once executed the server does not run in stealth and can clearly be seen by hitting ctrl alt del
Affected Application
Microsoft Corporation: Windows Any version
Solution
Removal Cyn Trojan 1.01: Hit ctrl-alt-del, choose c_server, and then click on end task. Now delete C_Server.exe 64.0 KB (65,599 bytes)
Removal Cyn Trojan 1.03b: open up regedit (click start, go to run and type regedit) now follow this path:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Look for the "System32" value, right click on it and choose delete
Reboot then delete C_server.exe 19.5 KB (19,968 bytes), this could be located anywhere on the infected machine.
Refferences
http://www.justkiwi.com/tairua/antitrojan/trojans/Cyn%20Trojan%201.01.htm
http://www.justkiwi.com/tairua/antitrojan/trojans/Cyn%20Trojan%201.03b.htm
http://www.justkiwi.com/tairua/antitrojan/trojans/Cyn_Trojan1.01.htm
http://xforce.iss.net/xforce/xfdb/15996
http://www3.ca.com/securityadvisor/pest/pest.aspx?id=453075567
http://www.simovits.com/trojans/tr_data/y769.html
Enter your details in the box below to receive an email each time we post a new issue of our newsletter.







Dec 21, 2024