Content

Adware-DFC

Type
Program
SubType
Adware
Discovery Date
Length
Varies
Minimum DAT
4277 (07/16/2003)
Updated DAT
5586 (04/16/2009)
Minimum Engine
5.1.00
Description Added
07/15/2003
Description Modified
03/17/2005 3:09 PM (PT)
Risk Assessment
Corporate User
N/A
Home User
N/A

Tab Navigation

Characteristics

McAfee(R) AVERT™ recognizes that this program may have legitimate uses in contexts where an authorized administrator has knowingly installed this application.  If you agreed to a license agreement for this, or another bundled application, you may have legal obligations with regard to removing this software, or using the host application without this software.   Please contact the software vendor for further information.

See http://vil.nai.com/vil/DATReadme.asp for a list of Program detections added to the DATs.

See http://vil.nai.com/vil/pups/configuration.htm for information about how to enable, disable, and exclude detection of legitimately installed programs.

This program is detected as a "potentially unwanted application".

This is a program, which when active on a computer, can display pop-up advertising, and may also redirect browsers to websites controlled by the makers of this program. The EULA also allows updates and further programs to be installed on a computer running this application.

It may also send mail and ICQ and AIM messages promoting the software.

Files known to be involved with this application are:

  • COMEDY.EXE
  • NEM211.DLL (the "211" might vary in other versions)
  • WSEM303.DLL
  • OPTIMIZE.EXE
  • VIEW-M~1.EXE
Known variants will add a registry key under
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ Run under the name DyFuCA, "DyFuCA Active Alerts" or InternetOpimizer

The newer versions of program also adds the above DLL files as Browser Helper Objects in Internet Explorer using the following registry keys.

  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\
    Explorer\Browser Helper Objects\ {00000010-6F7D-442C-93E3-4A4827C2E4C8}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\
    Explorer\Browser Helper Objects\ {8F4E5661-F99E-4B3E-8D85-0EA71C0748E4}
The detection of this type of files is not automatically activated. Users who would like to check for the presence of this kind of files on their system should run the command line scanner with the /PROGRAM switch. Please note that VirusScan 7 has also an option, which enables users to detect this kind of program automatically (see below).

Symptoms

Method of Infection

Variants

Variants

    N/A

All Information

Overview -

This is a Potentially Unwanted Program (PUP) detection. It is not a virus or trojan. PUPs are any piece of software which a reasonably security-or privacy-minded computer user may want to be informed of.

Aliases

  • Adware-Dyfuca
  • App/ViewMov-A (Sophos)
  • Trojan.dyfuca

Characteristics

Characteristics -

McAfee(R) AVERT™ recognizes that this program may have legitimate uses in contexts where an authorized administrator has knowingly installed this application.  If you agreed to a license agreement for this, or another bundled application, you may have legal obligations with regard to removing this software, or using the host application without this software.   Please contact the software vendor for further information.

See http://vil.nai.com/vil/DATReadme.asp for a list of Program detections added to the DATs.

See http://vil.nai.com/vil/pups/configuration.htm for information about how to enable, disable, and exclude detection of legitimately installed programs.

This program is detected as a "potentially unwanted application".

This is a program, which when active on a computer, can display pop-up advertising, and may also redirect browsers to websites controlled by the makers of this program. The EULA also allows updates and further programs to be installed on a computer running this application.

It may also send mail and ICQ and AIM messages promoting the software.

Files known to be involved with this application are:

  • COMEDY.EXE
  • NEM211.DLL (the "211" might vary in other versions)
  • WSEM303.DLL
  • OPTIMIZE.EXE
  • VIEW-M~1.EXE
Known variants will add a registry key under
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ Run under the name DyFuCA, "DyFuCA Active Alerts" or InternetOpimizer

The newer versions of program also adds the above DLL files as Browser Helper Objects in Internet Explorer using the following registry keys.

  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\
    Explorer\Browser Helper Objects\ {00000010-6F7D-442C-93E3-4A4827C2E4C8}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\
    Explorer\Browser Helper Objects\ {8F4E5661-F99E-4B3E-8D85-0EA71C0748E4}
The detection of this type of files is not automatically activated. Users who would like to check for the presence of this kind of files on their system should run the command line scanner with the /PROGRAM switch. Please note that VirusScan 7 has also an option, which enables users to detect this kind of program automatically (see below).

Symptoms

Symptoms -

Method of Infection

Method of Infection -

Removal -

Removal -

Instructions on Enabling/Disabling Detection and Removal of Potentially Unwanted Programs

Variants

Variants -

    N/A