Welcome to Spyware Removal News

Trojan.Trafbrush


My colleague, Takashi Katsuki, posted a blog that describes how Trojan.Farfli provides a service to affiliates, which allows them to increase the number of hits for an affiliate’s tracker. Recently I came across another Trojan, which provides such a service: Trojan.Trafbrush. When Trojan.Trafbrush is executed, it drops several components and registers a browser helper object (BHO).

It then downloads two configuration files from 1.mailhunt.cn. One of the files is config.ini, which contains display options of a Web browser and URLs. Most of the URLs are related to search engines with affiliate IDs in them. The other file, list.dic, is a dictionary file of search keywords. The BHO periodically opens the URLs or performs searches using a keyword that is randomly picked from list.dic. Thus, the compromised computer aids the affiliate to increase the number of hits of their tracker. The Trojan also accesses another site, luckycn.cn, in order to check for updates to itself. Symantec Security Response Weblog: Trojan.Trafbrush: Providing Click Fraud Services to Affiliates





20% off PC Tools Spyware Doctor
20% off PC Tools Spyware Doctor Offer Expires 06/30/08

Coupon Code: pctools20
Please Visit our Home Page

Home

More Spyware Removal News