Troj/Dluca-G

Please follow the instructions for removing Trojans.

Windows NT/2000/XP/2003

In Windows NT/2000/XP/2003 you will also need to edit the following registry entry. The removal of this entry is optional in Windows 95/98/Me. Please read the warning about editing the registry.

At the taskbar, click Start|Run. Type 'Regedit' and press Return. The registry editor opens.

Before you edit the registry, you should make a backup. On the 'Registry' menu, click 'Export Registry File'. In the 'Export range' panel, click 'All', then save your registry as Backup.

Locate the HKEY_LOCAL_MACHINE entry:

HKLM\Software\Microsoft\Windows\CurrentVersion\
Run\ Internet Optimizer = %Program Files%\Internet Optimizer\optimize.exe

and delete it if it exists.

Close the registry editor.

Troj/Dluca-G is a downloader Trojan which runs in the background, waiting for an internet connection to be established and then attempts to download and run executables without the user's knowledge.

When first run the Trojan copies itself as optimize.exe to a new sub-folder of the Program Files folder named Internet Optimizer\ and creates the following registry entry, so that optimize.exe is run automatically each time Windows is started:

HKLM\Software\Microsoft\Windows\CurrentVersion\
Run\ Internet Optimizer = %Program Files%\Internet Optimizer\optimize.exe

Registry entries are also created under:

HKLM\Software\Avenue Media\Internet Optimizer HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Internet Optimizer

Some versions of this Trojan may download DLLs and register them as Browser Helper Objects for Microsoft Internet Explorer.

Troj/Dluca-G can be uninstalled via the "Add or Remove Programs" dialog in the Windows Control Panel. Select the "Internet Optimizer" entry in the software list and click "Add/Remove" (a copy of the Trojan may remain in the TEMP folder with a name beginning 'cln' and an extension of TMP).