Internet Optimizer, also known as DyFuCA is an adware and a spyware program, which first appeared in 2003.[1] It typically redirects Internet Explorer error pages to advertising pages. It may be installed as a drive-by download via an ActiveX component, usually via nuisance affiliate porn webpage popups. Users suspicions are lulled by its installer title as Internet Optimizer under the guise of the name of the otherwise unrelated Moneytree, while the C&C domains accessed were usually named with the prefix "mtree".[2][3]

When users follow a broken link or enter an erroneous URL, instead of the browser's internal default error status page, they see an internet page of advertisements. Password-protected Web sites or pages will prompt for a missing or required user name and password via a pop-up request, this HTTP Basic authentication uses the same mechanism as HTTP errors, thus Internet Optimizer inadvertently interferes and makes it impossible for the user to access password-protected sites or pages.

It uses the "Browser Helper Object" or BHO interface, and as such, it loads whenever MS Internet Explorer starts and may be ignored by firewalls or not flagged by anti-virus software, as it is seen as a legitimate part of the browser application.

It is also classified as a "downloader" which can download, install and run malevolent software on the victim's computer without their knowledge or permission.[2][1]

References

  1. 1 2 "Dyfuca". Panda Security.
  2. 1 2 "MoneyTree". Pest Patrol. Archived from the original on October 26, 2003. Retrieved October 12, 2018.
  3. ↑ "DyFuCa". F-Secure.


This article is issued from Wikipedia. The text is licensed under Creative Commons - Attribution - Sharealike. Additional terms may apply for the media files.