Chances are you know someone who has been hit by Koobface, one of the first successful social networking worms. But there are many faces to Koobface, and many ways its authors make money from it.

New research from Trend Micro details how Koobface’s creators monetize the worm through scareware or fake antivirus, click fraud, information-stealing malware, and online dating services. “Unlike in the past when we always thought of malware as one piece of malware, like Melissa or Lovebug, in today’s world Koobface is an ongoing criminal enterprise using hundreds and thousands of pieces of code,” says David Perry, global director of education for Trend Micro. “That makes it more difficult to describe to the public at large. It’s not just one file.”

And the Koobface gang uses multiple channels for generating revenue with its malware, which when it infects a machine turns it into one of its bots. “Koobface has been a fantastically successful attack on social networking,” Perry says. And its criminal model represents the type of “evil corporation” that runs today’s successful malware operations, he says.

While some botnets do their work by downloading other malware, Koobface is the revenue-generating malware for the Koobface botnet gang, according to the report (PDF).

The group is affiliated with five different fake antivirus groups, including Safety Center and Security Tool. Fake antivirus creators have been pushing their phony software via botnets recently using pay-per-install tactics. The fake antivirus software typically is installed on the victim’s machine via Koobfaces’s pp.12.exe module, which acts as a fake AV downloader.

Click fraud, in which the bad guys basically hijack search results as a way to artificially increase traffic to earn ad revenue, is another way Koobface pays for its creators. The search hijacker basically intercepts a user’s request for a URL and redirects the user to a page that registers the click fraud.

Koobface also installs a variant of the Ldpinch information-stealing Trojan that steals user credentials and then either resells them or uses them to hack Websites. “In turn, compromised sites can be rented out or used by the cybercriminals behind KOOBFACE to host phishing sites or malicious scripts,” says the Trend Micro report.

The notorious AdultFriendFinder online dating site is also a Koobface vehicle for money-making. When users click on Flash animations of chat windows, they get infected with Koobface: “It seems that AdultFriendFinder is also back to its old ways, serving unsolicited adult-oriented ads using malicious software. In December 2007, AdultFriendFinder has agreed with the Federal Trade Commission (FTC)’s mandate, which barred it from displaying sexually explicit online ads,” says the Trend Micro report. “However, as can be gleaned from our research, the site has revived its former practice.”

Trend’s Perry says he wasn’t surprised by the inner workings of the Koobface gang. “This is exactly what we were expecting to see,” he says. “The reason we came up with this [research] is that we get the question all the time of, ‘What is this doing?’ This indicates that Koobface does not just do one thing,” he says. “They are using social networking to plant malware and Trojan downloaders on millions of PCs. They then use those to create an enormous botnet, and take portions of that botnet and sell or lease it to other criminals.”

Fake security software is something that has seemed to be on the rise lately with more and more machines installing and sometimes even paying for software. About the only things these software programs can do is slow down your computer, report FAKE security problems, and install and infect the machines with other viruses to do all the dirty work. But there is good news regarding these programs that have been infecting more and more PCs lately. It seems as though Microsoft has finally sent out an update for Windows systems that is meant to clean these infected systems of this worthless software with the Microsoft Software Removal Tool (MSRT). 

Windows users may install the fake programs because they’ve been duped into thinking that they’re real — at times, bogus security software has been ranked high in Internet search results — although the rogue applications are also often secretly installed by malware that’s infected a system.

As this won’t be the end of these types of malware attacks for PC users, this is surely to cause a huge impact on the amount of systems infected and is greaty helping to clean them out and get them running how they should. Since these programs help bring hackers over $5 million a year, this is going to put a hurting in their pocket and also require them to go about alternate paths to try and infect PCs in order to bring themselves their profits that these programs help them get!

You can read the whole article HERE! So enjoy and keep safe while crusing the internet!