New ClickFraud Trojan


Searchadv.com is a part of the umaxsearch.com pay-per-click affiliate search program and is known for working with home page hijackers. Searchadv.com has now started using a new type of scam: A fraudulent pay-per-click scheme that Sunbelt calls Misc.Iwin.Scam. In short, itís a trojan that generates fake clicks. These clicks earn money.

Searchadv.com is running this fraudulent scheme through at least two methods at present:

The first involves the use of the WMF exploit served from the web site loomcompany.com (which Searchadv.com owns) that drops a payload file on PCs of victims who visit compromised web sites.

The second known method involves links to RAR compressed files that are disguised as "adult games" at the web site pornocollection.net site (also controlled by Searchadv.com). Sunbelt BLOG: Seen in the wild: New ClickFraud Trojan

Linked by shanmuga Friday, 27th January 2006 12:21AM