While checking a system for adware/spyware, SpyCop Spyware Remover reported that cd_clint.dll, which was in c:\windows\system32 was part of "ADWARE: Cydoor". Bazooka Spyware Scanner also reported the file as being part of Cydoor.
Though cd_clint.dll is part of Cydoor, this particular file with an MD5 checksum of 65fd7ea79f626f7b57f4d6ced6339f32 is not. Instead it is a dummy file from CEXX Labs, which is intended to allow you to execute a spyware-dependent program without fear that the program is impeding the system's performance with adware/spyware. The dummy file can be downloaded from "Dummy files for neutering spyware".
The CEXX.Org webpage providing the download states that Pest Patrol 4 also gives a false positive result for this file.
For more information on Cydoor and CD_Clint.dll see Advertising Spyware: CyDoor CD_Load.exe and CD_Clint.dll"
In addition to differences in size and MD5 checksums, you can also easily distinguish the CEXX dummy version of cd_clint.dll from the Cydoor adware version by right-clicking on the file and choosing Properties and then Version. The differences between the files are listed below. It is possible Cydoor has released multiple versions of cd_clint.dll, so the size, checksum, and version information may differ for other versions of the Cydoor cd_clint.dll Dynamic Link Library (DLL) file.
|CEXX Dummy Version||Cydoor Adware Version|
|Size||48.0 KB (48,640)||151 KB (154,624 bytes)|
|Download Site #1||CEXX.Org||Moonpoint Support|
|Download Site #2||Moonpoint Support|
|Description||DLL (GUI)||Cydoor Technologies ad-system|
|Copyright||CEXX Labs + Mike Dombrowski||Copyright (C) Cydoor Technologies, Inc. 1999|
|Comments||"For that EXTRA comfort and protection"||This is a module of Cydoor's ad system. Additional information is available at http://www.cydoor.com|
|Company||CEXX Labs - www.cexx.org||Cydoor Technologies, Inc.|
|Language||English (United States)||English (United States)|
|Legal Trademarks||CYDOOR is a trademark of CYDOOR Technologies. CEXX.ORG is not affiliated with CYDOOR Technologies||Cydoor Technologies(tm)|
|Original File Name||project1.dll||CD_Clint.dll|
|Product Name||CEXX.ORG Spyware Condom (CYDOOR-Compatible)||Cydoor Technologies ad-system|
|Special Build Description||14|
Some antispyware software will report a false positive for the CEXX cd_clint.dll, identifying it as being part of Cydoor adware, apparently from the name alone. Programs I've found report a false positive and those I've found not to report it as malware are listed below.
|Program||Program Version||Database/Definitions Version|
|False Positive Detection as Cydoor|
|Spy Sweeper||4.0.4 (Build 430)||492 (Updated on August 12, 2005)|
|No False Positive Detection|
|Ad-Aware SE Personal||Build 1.06r1||SE1R61 10.08.2005|
|ClamWin||0.86.2||19:39 08 Aug 2005 (main: 33; daily 1010)|
|Microsoft AntiSpyware Beta1||1.0.615||5743 (8/8/2005 8:01:19 PM)|
|Spybot Search & Destroy||1.4||2005-08-04|
|Symantec AntiVirus||188.8.131.528||8/10/2005 rev. 4|
I also submitted the file to Jotti's Online Malware Scan, which scanned the file with 14 different antivirus programs all of which reported "found nothing" for the file.
- Advertising Spyware CyDoor CD_Load.exe and CD_Clint.dll
- Dummy files for neutering spyware
- Cydoor - Adware removal instructions