Title: CIA

Remove CIA. Removal instructions

Also known as: Ciadoor

Severity scale:

(80 / 100)

CIA, also known as Ciadoor, is a malicious remote administration tool with lots of functions. It consists of server and client. Server secretly runs on an infected system and accepts connections from the client, used by attackers. CIA server starts automatically on every system startup and hides from the user. It gathers system and user account information and sends it to the hacker. CIA can manipulate files, launch and terminate any application, log keystrokes, modify critical system settings and control some hardware devices, steal passwords and license information of several games and programs, take screenshots of user activity. It contains an integrated FTP server that allows the attacker to download and upload various files, including userâ€™s valuable personal documents. The hacker can configure this malware to include only those functions he needs. The most dangerous is CIA variant with all available functions. However, even the simplest configuration allows the attacker to damage files, installed software and operating system.

CIA properties:
• Allows remote user connection
• Takes and sends out screenshots of user activity
• Sends out logs by FTP or email
• Logs keystrokes
• Hides from the user
• Stays resident in background

Automatic CIA removal:

remover for CIA

SpyHunter is recommended remover to uninstall CIA. You should confirm using free trial that it detects current version of parasite.

Note: Manual assistance required means that one or all of removers were unable to remove parasite without some manual intervention, please read manul removal instructions below.

If you failed to remove CIA using SpyHunter please report this to us.

We might be affiliated with any product we recommend on the site. Full disclosure in our Agreement of Use.

STOPzilla

download | review

We are testing STOPzilla's efficiency at removing CIA (2005-03-14 14:41:57)

Malwarebytes Anti Malware

download | review

We are testing Malwarebytes Anti Malware's efficiency at removing CIA (2005-03-14 14:41:57)

Spyware Doctor

download | review | tutorial

We are testing Spyware Doctor's efficiency at removing CIA (2005-03-14 14:41:57)

XoftSpySE Anti Spyware

download | review

CIA manual removal:

FORUM:
Discuss CIA in
spyware removal forum

Kill processes:
0895ee42.exe, 3ec8d1fb.exe, 45534355.exe, 462ac4c3.exe, client.exe, pic.exe, server.exe, builder.exe, server_unpacked.exe, server_upx.exe

HELP:
how to kill malicious processes

Delete registry values:
HKEY_CURRENT_USER\software\microsoft\windows nt\currentversion\windows\run\runtime process HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\runtime process

HELP:
how to remove registry entries

Unregister DLLs:
cjpg.dll, pspv.dll

HELP:
how to unregister malicious DLLs

Delete files:
0895ee42.exe, 3ec8d1fb.exe, 45534355.exe, 462ac4c3.exe, client.exe, pic.exe, server.exe, builder.exe, server_unpacked.exe, server_upx.exe, cjpg.dll, pspv.dll

HELP:
how to remove harmful files

Information added: 2005-03-14 12:04:42
Information updated: 2005-03-14 12:04:42

Additional resources related to CIA:

Attention: If you know or you have a website or page about CIA removal, feel free to add a link to this list: add url

more resources

Post Comment:

Attention: Use this form only if you have additional information about CIA parasite, its removal instructions, additional resources or behavior. By clicking "post comment" button you agree not to post any copyrighted, unlawful, harmful, threatening, abusive, harassing, defamatory, vulgar, obscene, profane, hateful, racially, ethnically or otherwise objectionable material of any kind.

Spreading the knowledge:

It is very hard to fight Computer parasites alone in internet space. If you have a website we would be more than happy if you would help us to spread the knowledge about latest threats. You can help your visitors to manage their Computer system manually without aditional expences. Knowledge is the power, we just need to spread it.