Parasite: Cytron

This record last updated Tue Sep 20 2005 00:34:15

PLEASE NOTE: Due to the overwhelming extent of this problem and the unbelievable volume of email we have received, we regret that we cannot respond to questions about browser parasites at this time. If you have attempted to contact us about this parasite please accept our apology for not responding. "Thank you's" are always appreciated ;-)

Description

Cytron is an Internet Explorer Browser Helper Object. It scans the content of pages being viewed for keywords and opens pop-up advertising when they are detected.

Variants

Cytron/potd installs potd.dll into Downloaded Program Files; with Cytron/sec the filename is sec.dll instead.

Also known as

Burnaby, the internal object name; TargetingSource, the name used to describe the control in Downloaded Program Files. Troj/Ortyc by VS antivirus.

Distribution

Installed by ActiveX drive-by download on a page pointed to by junk e-mail claiming you have received an ‘e-card’ (from domains such as surprisecards.net, cardwish.com). The ActiveX control purports to be a viewer for e-cards.

What it does

Advertising

Yes. When IE is started for the first time it attempts to connect to Cytron’s servers to download a list of keywords to look for, and URLs of pop-ups to open.

Privacy violation

No.

Security issues

No.

Stability problems

None known.

Removal

There is no uninstall feature. However McAfee can remove Cytron automatically.

Manual removal

First deregister the Cytron BHO. Open a DOS command prompt (Start->Programs->Accessories) and enter the following commands:

cd "%WinDir%\System"
regsvr32 /u "%WinDir%\Downloaded Program Files\potd.dll"

(Change potd.dll to sec.dll if you have Cytron/sec variant.)

You should then be able to delete the ‘TargetingSource’ entry in Downloaded Program Files (in the Windows folder), and the registry key HKEY_CURRENT_USER\Software\POTD (Start->Run->regedit).