7/23: Dluca-CQ an Adware Application
July 23, 2004

Troj/Dluca-CQ is an adware application, according to Sophos.

The Trojan copies itself to the location:
C:\Program Files\Internet Optimizer\optimize.exe
and creates the following registry entry in order to be run on startup:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\Internet Optimizer
= \"C:\Program Files\Internet Optimizer\optimize.exe\"

The Trojan also creates registry entries in the following locations:

HKCU\Software\Avenue Media\
HKCU\Software\Policies\Avenue Media\
HKLM\SOFTWARE\Avenue Media\Internet Optimizer\
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DyFuCA\
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Internet Optimizer\
HKLM\SOFTWARE\Policies\Avenue Media\

The Trojan may execute files downloaded without the user's consent.