Internet Optimizer (DyFuCA)- SAIE.EXE

Introduction

This infectious program advertizes itself as being a help to your Internet asccess but really isn't. This malicious bug is actually a dialer and tries to access premium porn sites at your expense and to the benefit of the Avenue Media company.

Technical Information

Written using Visual C by a company called Avenue media, this Trojan is also known as DyFuCA.Internet Optimizer/Hijacker or TrojanDownloader.Win32.Dyfuca.cj or TrojanDownloader.Win32.Dyfuca.gen or Win32/TrojanDownloader.Dyfica.NAA and is related to 180Solutions/N-Case. The pestname is also MoneyTree and acts as a dialer and its purpose is to dial premium charge sites (typically porn sites) at your expense.

Saie also acts as a backdoor to your PC. It also downloads other spyware programs, it hijacks your internet explorer and installs Browser Helper Objects. Related files may be nemXXX.DLL, wsemXXX.DLL, optimize.DLL, SAIE.EXE and possibly others. Variations of this will also display advertizements on your screen.

Method of Infection

The program is installed on your PC from certain websites and requires your consent to be installed.

Detection

Normally most anti-spyware or anti-virus programs will pick it up. You will also have Optimize.dll in your windows system32 directory and other related files.

Summary

Most people not having dialup modems these days may not be affected. If you are using dialup internet... this Trojan will silently connect to premium porn sites in order to incur 900# charges. An expert at support.com can remove this from your computer.