OpenCandy
Introduction '''OpenCandy''' is an adware module and a potentially unwanted program classified as malware by many anti-virus vendors. They flag OpenCandy due to its undesirable side-effects. It is designed to run during installation of other desired software. Produced by SweetLabs, it consists of a Microsoft Windows library incorporated in a Windows Installer. When a user installs an application that has bundled the OpenCandy library, an option appears to install software it recommends based on a scan of the user's system and geolocation. Both the option and offers it generates are selected by default and will be installed unless the user unchecks them before continuing with the installation.OpenCandy's various undesirable side-effects include changing the user's homepage, desktop background or search provider, and inserting unwanted toolbars, plug-ins and extension add-ons in the browser. It also collects and transmits various information about the user and their Web usage without notification or consent.
Development The software was originally developed for the DivX installation, by CEO Darrius Thompson. When installing DivX, the user was prompted to optionally install the Yahoo! Toolbar. DivX received $15.7 million during the first nine months of 2008 from Yahoo and other software developers, after 250 million downloads.Chester Ng, the former DivX business development director, is chief business officer and Mark Chweh, former DivX engineering director, is chief technology officer.
Windows components Components of the program may have differing but similar names based on version.===Files dropped===*OCComSDK.dll*OCSetupHlp.dll*Fusion.dll===Processes===*spidentifier.exe*rundll32.exe===DNS and HTTP queries===*tracking.opencandy.com.s3.amazonaws.com*media.opencandy.com (website not available) *cdn.opencandy.com*cdn.putono5.com*tracking.opencandy.com*api.opencandy.com*www.arcadefrontier.com
Software known to have included OpenCandy * AC3Filter* Auslogics Disk Defrag* CamStudio (since version 2.7 r316)* CDBurnerXP (depending on version; alternate download without OpenCandy available; confirmed 2017-03-01)* FileZilla (present in 2013)* Format Factory* Foxit Reader (6.1.4 – 6.2.1) * FreeFileSync* FrostWire* GOM Player* ImgBurn (since version 2.5.8.0, though only on the version of the installer distributed directly from imgburn.com; the version distributed from the official mirror sites is adware-free)* mIRC* MP3 Rocket* MyPhoneExplorer (dropped March 2015)* Orbit Downloader (confirmed 2015-10-24) * PDFCreator* PhotoScape* PrimoPDF* Sigil (dropped in version 0.5.0 and later)* Trillian (dropped 5 May 2011)* μTorrent* WinSCP (through August 2012)* FL Studio Installer
Workarounds There is a workaround to bypass OpenCandy by running some installers with a /NOCANDY parameter on the command line, which is up to the installer to support or not.
References