Support Forum Articles File Help Startup DB Tips Service DB Hijack This! Analyzer

 

Dyfuca Internet Optimizer

Overview:
Internet Optimizer is an error page hijacker. This is commonly installed by other malware packages like Moneytree. This system is known to download and install additional packages which you don't want. If you have this then you likely have a number of other things you'll need to remove.

Their Uninstaller:
There should be something called "Internet Optimizer" in Add/Remove.

Also Known as:
TrojanDownloader.Win32.Dyfuca.cj
TrojanDownloader.Win32.Dyfuca.gen
Win32/TrojanDownloader.Dyfica.NAA trojan

Destroy Autorun:
Delete the following keys

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\180ax
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\ixizgfcp
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\msbb
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\saie

Reboot your system then:

Make sure you click start --> Run and type in msconfig. Then select the startup tab. Any references to the processes below.

Unregister DLLs:
Tip:
this is only a list of known files/locations. You will want to do a search by the name of the file to see if they're on your system.
A while back I wrote a guide to Register/remove DLL or AX files which you will need if you don't know how to unregister these files.

Each file is in several locations so you'll need to search for them and unregister + delete them in every location you find.

msbbhook.dll
ncmyb.dll
nem216.dll
nem218.dll
saiehook.dll

End Processes (may or may not exist):
180ax.exe
actalert.exe
msbb.exe
optimize.exe
saie.exe

Remove Directories:
programfilesdir+\180solutions\
programfilesdir+\internet optimizer\

Clean your Registry:

You should be back to normal IF this was your only problem. I suggest you post in our HJT forum since its not likely that this is your only bug. Read this first


Written By: Martin Krohn
Printer Friendly

Article Index:
Talk About it! -->