Circuit membership for the dissemination of NoAdware rogue

Malware hides behind a business. Without a doubt, I believe that no one denies this claim. Day by day is an important flow of malicious code that, while general purpose have a story in its activities, seeking final feedback on the business behind through fraudulent mechanisms and strategies.

One of the most popular business models is to pay a percentage of money given to those who successfully promote rogue. The model is known as affiliate programs, while the facility payment system is called Pay-Per-Install.

This is the case of rogue NoAdware, a malicious code that operates widely available for several years through different coverages.

Home NoAdware
From this website you download the official binary of "economic resource" for the system of affiliates and partners

Using common strategies imposed by this style websites, such as false certificates and testimonies that try to convey confidence in the potential victims, promote the installation of an alleged security solution that is actually malware.

• noadware.exe (e407db8a983f8960c4378b3b00c29c32) 

Affiliate program usually provide only the executable to spread, which many criminals spread it through some  crimeware type exploit pack, and to a lesser extent, only spread by a page that is created and hosted at your own risk .

The system behind NoAdware, facilitates this issue by providing the ability to select a template and then just upload to the hosting affiliate. Thus, when a potential victim visits this site, is redirected to the homepage of NoAdware, and each member, in theory, get 75% of money for each installation. The sales of rogue (mimicked in security program) is for $47.00.

However, other values are also managed directly related to the number of licenses:

• 2 Computers ($67.00)
• 3 Computers ($87.00)
• 5 Computers ($117.00)
• 10 Computers ($197.00)
• 25 Computers ($417.00)
• 50 Computers ($767.00)

Site selection to propagate NoAdware
The process involves two steps: select the template and download. This web site traffic routed to the home page of NoAdware

NoAdware also promoted under the name Adware Professional 2010. It's exactly the same application to install malicious reports against the system that is behind NoAdware.

Hypothetically speaking, suppose a partner (affiliate/delinquent) successful installation per day for 30 days (one month). 75% of $47 is $35.25 (this is what would win one day and successful installation of malware). Accordingly, this partner would have a theoretical gain of $1057.5 monthly.

This affiliate program works with a payment system via the Internet, legal, called ClickBank, especially whose main trade is that a large number of rogue malware type is done through this system.

HopLink for NoAdware
This page directs traffic to the official website of NoAdware, while sending information to the payment affiliate log into your account

The address is to the URL with the following syntax: noadware.net/?hop=[PARTNER-NICK]

This will record the payment of a percentage of money as a commission for each of the members to serve on the circuit of this rogue.

Affiliate System Circuit
The graph shows the different stages that runs a conventional affiliate

One of the evidences that reflects the rate for ClickBank by criminal groups to secure economic transactions "safe" is the important flow of affiliate systems, many of them promote malware, which are under his roof. Some of them are:

• AdvancedPCTweaker_Setup.exe (5840f571debba9f148b1b8e70433a292) – AdvPCTweak
• pconpoint.exe (db797eb02a3fc511fbbb1e9e183d50b2) – ErrorClean
• setupxv.exe (7b44136825d45091bacf77c62c2bc628) – RegistrySmart
• setupxv.exe (0b9d9e18705aa079c96cb182e48652f9) – SpywareRemover
• setupxv.exe (e7b74fa5ddc43609617544594a4b6fb3) – SpywareRemover
• setupxv.exe (db22cfd42912f47e24bbf922ceb13686) – SpywareRemover
• setupxv.exe (8fe863f7bf05d685d18b1dc3710ab9ba) – RegistrySmart
• setupxv.exe (d4cf0033dcd6caaecabad839aa9b3c8e) – SpywareRemover
• setupxv.exe (3557a90e6c670071cad05302bf65dfed) – MalwareBot
• setupxv.exe (8ad492c01871cfd96a2dae15723f3ae0) – RegistrySmart
• setup-trial.exe (29f0274b1ef5de0f29b86c36f6eaf42b) SpywareRemover
• setup-trial.exe (58242da7e7736d067c0179bb280766de) SpywareRemover
• setup.exe (27b002ee170c751d14e030dacbb52b9f) – NoAdware
• RegistryWinner_Setup.exe (0216f93189d93fe23686e8bbff684ab0) – RegistryVictor
• RegistryToolkit_setup.exe (bf61b76f46c594276005f77bc6f7fa20) – RegistryToolkit
• registryfix.exe (00dbe43417343b3d8d07dd6fb6bdb12d) – ErrorClean
• registryeasy_lite.exe (e8d6564dc44ce2bf5877ac7d475d4e41) – RegistryEasy
• RegGenieSetup.exe (43bc26e16328a338ba19e6967212089f) – RegGenie

This brief list is just a small sample, because the volume of malware that are promoted through this medium is very large.

Related  information

Pirated Edition. Affiliate program Pay-per-Install

Pay-per-Install through VIVA INSTALLS / HAPPY INSTALLS in BKCNET “SIA” IZZI

State of the art in Eleonore Exploit Pack II

AntiSpy Safeguard with new social engineering approach

Litter Korean rogue lurking V
PC Defender Antivirus rogue update system registry
Phoenix Exploit's Kit and Pay-per-Install via PC Defender Antivirus
Dangerous trojans, keyloggers and Spyware detected in you computer!!!
Desktop Hijack by Internet Security 2010. Your System Is Infected!