Tek-Tips is the largest IT community on the Internet today!

Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!

  • Congratulations wOOdy-Soft on being selected by the Tek-Tips community for having the most helpful posts in the forums last week. Way to Go!

Browsing error 404 with IE

Status
Not open for further replies.

vias

Programmer
Apr 25, 2000
54
GB
Im sure this is a registry hack -- IE stores it's search defualt page in a registry entry. Sly programs always try to change this as well as try to covertly change your home page - this is evil adware.

Just goto Start->Run...->Enter "regedit" in the box w/o quotes and search for that internet domain and see if u get any hits - if u do feel free to replace the values with something like
Rocco is the BOY!!

SHUT YOUR LIPS...
ROCCOsm.gif
 
Hi,

Thanks for your reply.

I did a 'find' for the the domain name
in the registry
but didn't find anything.

Do you have any other suggestions.

Thanks in advance,
 
Your provider may be redirecting you. If I try to go to I get:

Forbidden
You don't have permission to access /Help/ on this server.

Try adding the following line to your Hosts file:
127.0.0.1
With this line added, when you get redirected your browser will be pointed to your local machine and the redirection will fail. Not sure what the results will look like though ;)
 
Here is your answer courtesy of
Description
Internet Optimizer is an error page hijacker.

Variants
InternetOptimizer/Iopti: unknown-server errors, page-missing errors, server errors and even password-required errors are redirected to Internet Optimizer's controlling server at
InternetOptimizer/Nem: as Iopti, but searches are hijacked to yoogee.com (a search site run by the makers of InternetOptimizer).

InternetOptimizer/Wsem: a larger version of the software, whose purpose is unclear.

InternetOptimizer/Crmrest: an ActiveX downloader control for InternetOptimizer.

Also known as
DyFuCA.

Distribution
May be installed by MoneyTree/DyFuCA, or the Crmrest variant. The latter poses as a comedy or porn video from the site movies-etc.com, and when allowed to install may forward a mail to all contacts in your Outlook address book, promoting movies-etc in your name.

What it does
Advertising
Yes. The 'DyFuCA Active Alert' component can open pop-up 'alerts' when directed by its controlling server.

Privacy violation
Suspected. The EULA at Internet Optimizer's web site states the software may send all your browsing information back to its controllers. At the time of writing, however, this has not been seen to happen with the current version of the software.

Security issues
Yes. Can download and execute arbitrary unsigned code from its controlling server, as an update feature.

Stability problems
Unknown; some unclear user reports of it causing crashes.

Removal
Check the Control Panel's Add/Remove Programs feature for 'Active Alert' and 'Internet Optimizer'. If these entries are there, using both should result in InternetOptimizer's correct removal. Afterwards, ensure MoneyTree/DyFuCA is no longer loaded.

Manual removal
For the Crmrest installer variant, open the Downloaded Program Files folder (inside the Windows folder) and remove the 'Media Manager' entry.

For other variants, open the Windows folder. You should be able to see a file 'ioptiXXX.dll' (Iopti variant), 'nemXXX.dll' (Nem variant) or 'wsemXXX.dll' (Wsem variant). The XXX differs for different versions; common versions are 'iopti130.dll', 'nem207.dll' and 'wsem210.dll'.

Open the registry (click 'Start', choose 'Run' and enter 'regedit') and find the key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run. Delete the entries 'DyFuCA' and 'DyFuCA Active Alerts'.

Now open a DOS command prompt window (from Start->Programs->Accessories), and enter the following commands (for the Iopti variant):

cd "%WinDir%\System"
regsvr32 /u ..\iopti130.dll
Or, for the Nem variant:

cd "%WinDir%\System"
regsvr32 /u ..\nem207.dll
Or, for the Wsem variant:

cd "%WinDir%\System"
regsvr32 /u ..\wsem210.dll
Restart the computer and you should be able to delete the DLL from the Windows folder, and the 'DyFuCA', 'Internet Optimizer' or 'STWSI' folder you may have inside Program Files. You can also delete the subkey 'FCI' in HKEY_LOCAL_MACHINE\Software and HKEY_CURRENT_USER\Software to clean up if you like.

Links
Avenue Media wrote and control InternetOptimizer.

[poke]
 
Status
Not open for further replies.

Part and Inventory Search

Sponsor

Back
Top