5 Replies Latest reply on Sep 14, 2011 11:18 PM by ejimenez

    ADWARE-OPENCANDY.DLL removal

      Hello.

       

      My McAfee Internet Security said I had a virus - Adware-OpenCandy.dll - which was dully quarantined.

       

      HOWEVER:

       

      - I can't find information about this virus (what is it ? origin ? malignancy ? etc)

       

      - I searched my Windows registry, and there is still one Adware-OpenCandy.dll entry at:

       

                    \HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TypedURLs

       

      whose values are:

       

                    url1      REG_SZ      Adware-OpenCandy.dll

       

      So I feel quite lost - shall I remove this entry ? Am I in great danger ?

       

      Best regards.

       

      Dilermando

        • 1. Re: ADWARE-OPENCANDY.DLL removal

          Hi,

           

          I too have this dll! Found it just now after running a full system scan....

           

          Cannot find anything on the Web on this.

           

          Regards,

          Darren

          • 2. Re: ADWARE-OPENCANDY.DLL removal
            Hayton

            Not a virus, just pesky Adware. I find 14,400 mentions on the Web.

             

            Microsoft :

            Adware:Win32/OpenCandy is an adware program that may be bundled with certain third-party software installation programs. Some versions of this program may send user-specific information, including a unique machine code, operating system information, locale (country), and certain other information to a remote server without obtaining adequate user consent.

             

            McAfee :

            Adware-OpenCandy.dll is a low-risk Adware library called OCSetupHlp.dll that is bundled with several third-party installers and placed in a temporary folder on the user's system. The ditially-signed library obtains and transmits certain non-personally-identifiable information to OpenCandy servers in order to deliver additional, unrelated installs to the user. The actions occur without user knowledge or consent and the library is usually deleted once the host installation is complete although it is sometimes left behind under certain installation scenarios. Some installers show an OpenCandy End User License Agreement after the data transmission has occurred. The additional software supplied by the use of the OpenCandy library can help offset the cost of the host software to the user.

             

            If it's quarantined, just delete it. You don't need it and probably don't want it.

            • 3. Re: ADWARE-OPENCANDY.DLL removal

              Hello Hayton.

              Thank you very much for your precious assistance.

              So I guess I will not burst my PC suppressing Adware-Candy.dll entry from Windows registries.

              Bye.

              Dilermando

              • 4. Re: ADWARE-OPENCANDY.DLL removal

                We use a tool in our company called primopdf, its a free for companies to use pdf creator. However, it uses the opencandy aspect (to keep it free). I am not trying to sell the product by anymeans, just giving it as an example as to where it shows up.

                 

                also from their site:

                http://www.primopdf.com/opencandy.aspx

                 

                I'm trying to figure out how to add it to the "safe" list, which is how i landed here.

                 

                Deleted  domain\Admin C:\Windows\system32\Robocopy.exe D:\Apps\PDF\Old Primo\PrimoPDF5.0.0.19\FreewarePrimoPDF.exe\47.nsis Adware-OpenCandy.dll (Adware)

                • 5. Re: ADWARE-OPENCANDY.DLL removal

                  Hi tesdall,

                   

                  Adware-OpenCandy is a Potentially Unwanted Program detection (PUP). In order to avoid detection, you can add an exclusion for it. Since you don't mention which product you are using, this article should help with the exclusion process.

                   

                  https://kc.mcafee.com/corporate/index?page=content&id=KB53860&actp=search&viewlo cale=en_US&searchid=1316059093731

                   

                  Hope this helps.

                   


                  Elena.