OpenCandy

OpenCandy is an "Adware" module designed to install on a personal computer during software installation. Produced by SweetLabs, it consists of a Microsoft Windows library incorporated in a Windows Installer. When a user installs an application that has bundled the OpenCandy library, an option appears to install software it recommends based on a scan of the user's system and geolocation. Both the option and offers it generates are selected by default if the user simply clicks [Next] through the installation.[1][2]

OpenCandy's various undesirable side-effects include changing your homepage, desktop background or search provider, and inserting unwanted toolbars or plug-in/extension add-ons in your browser. It also collects and transmits various information about the user and his surfing habits to third parties without notification or consent.

It has been reported that a number of anti-virus vendors flag OpenCandy as malware.[3]

Development

The software was originally developed for the DivX installation, by CEO Darrius Thompson. When installing DivX, the user was prompted to optionally install the Yahoo! Toolbar. DivX received $15.7 million during the first nine months of 2008 from Yahoo and other software developers, after 250 million downloads.[2]

Chester Ng, the former DivX business development director, is chief business officer and Mark Chweh, former DivX engineering director, is chief technology officer.[2]

Windows components

Components of the program may have differing but similar names based on version.

Files dropped

Note that files dropped by this program usually have the 'hidden' and 'system' attributes set. In order to see or search for them, folder settings for "hide operating system files" will need to be unchecked, and "show hidden files and folders" will need to be checked.

Processes

Note: additional processes associated with any accepted offers may also run.

Registry keys

Registry keys have varying names, so that a search of the registry for "*opencandy*" will need to be done to find and delete them.

DNS and HTTP queries

Counter measures

Software download sites known to host OpenCandy infected software

In addition to individual company/vendor sites distributing their own freeware/shareware, commercial depository type download sites also host OpenCandy infected software.

Applications known to use or have used OpenCandy

References

  1. ↑ Needleman, Rafe (11 November 2008), OpenCandy brings ad market to software installs. What?, CNET news, retrieved 2009-08-18
  2. 1 2 3 Marshall, Matt (10 November 2008), OpenCandy inserts recommendations when you install software, retrieved 2009-08-18
  3. ↑ Van der Sar, Ernesto (21 July 2015). "uTorrent Flagged As 'Harmful' by Anti-Virus Companies and Google". TorrentFreak. Retrieved 19 August 2015. The anti-virus scans associate the uTorrent.exe file with Trojan.Win32.Generic!BT and the controversial OpenCandy bundling software. While this isn’t the first time that uTorrent has been flagged in this manner, we haven’t seen it being reported by this many independent tests before. [followed by an image showing open candy being flagged in utorrent on virus total]
  4. ↑ "Safely install ImgBurn without OpenCandy malware". www.jdhodges.com. Retrieved 2016-01-06.
  5. ↑ "To those who are unhappy about 2.5.8.0 being bundled with OpenCandy - ImgBurn General". ImgBurn Support Forum. Retrieved 2016-01-06.
  6. ↑ "Blocking Unwanted Connections with a Hosts File". winhelp2002.mvps.org. Retrieved 2016-01-06.
  7. ↑ "Free Anti-Malware & Internet Security Software". Malwarebytes. Retrieved 2016-01-06.
  8. ↑
  9. ↑ (Click More download options)
  10. ↑ Multiple Packages available
  11. ↑ End User License Agreement, retrieved September 2014
  12. ↑ Foxit Forum
  13. ↑ FreeFileSync FAQ
  14. ↑ "Change log". ImgBurn. LIGHTNING UK!. 2013-06-16. Archived from the original on 2014-08-08. Retrieved 2014-08-30. Changed: No longer bundling/offering the Ask.com toolbar in the setup program, OpenCandy now handles product offerings during installation.
  15. ↑ http://www.herdprotect.com/signer-mp3-support-146c2e323177663b9df87fff1b9c31d8.aspx
  16. 1 2 3 gizmo, richards (2014-02-08). "Controversial Advertising Program Now Being Embedded in More Software". Gizmo's Freeware. Archived from the original on 2014-08-07. Retrieved 2014-08-30. OpenCandy (OC) is a relatively new advertising product that more and more software developers are bundling with their programs. It can now be found in the installers of dozens of popular programs including IZArc, mirC, PrimoPDF, Trillian Astra and more.
  17. ↑ http://www.fjsoft.at/en/news.php
  18. ↑ On the Help/Facts page
  19. ↑ Discussions on pdfforge Forums
  20. ↑ http://alternativeto.net/software/riot---radical-image-optimization-tool/comments/
  21. ↑ Schember, John (21 January 2012). "Sigil 0.5.0 Released". Retrieved 2012-03-17.
  22. ↑ "WinSCP - OpenCandy". Retrieved 2014-04-03.
This article is issued from Wikipedia - version of the Saturday, February 13, 2016. The text is available under the Creative Commons Attribution/Share Alike but additional terms may apply for the media files.