Slashdot Mirror
Major Rogue Anti-Virus Program Shut Down
krebsatwpost writes "TrafficConverter.biz, one of the more notorious pay-per-install affiliate programs, was dismantled this week after media attention caused Visa and Mastercard to shut down the group's payment operations. The action comes just a few days after a report by The Washington Post that showed some affiliates were making more than $100,000 USD a week installing rogue anti-virus software. The credit card industry may have been spurred by the fact that the first version of the Conficker worm told infected systems to download a file from TrafficConverter, although the story posits that this could have been an attempted Joe Job rather than a blatant attempt to drum up more installs."
I'm surprised visa/MC actually shut them down. 3% of 100k/week is a decent chunk of change.
$100K per week: at about fifty bucks per victim, comes out to two thousand people getting robbed every week.
After all that, one article in the WaPo gets it shut down?
Yes. Because those thousands of people every year don't have the public impact that a news story does.
This has been going on for YEARS and the credit card companies NEVER took any action before now. Because the credit card companies were getting their share of the loot.
Now that the PR problem might be more costly than their share of the fraud, they take action.
Not that it matters much - but the numbers look tempting for scamsters to say 'wow - this is good way to make more money'.
Affiliate oriented scams like directi [directi.com] - a scam business operating from india - will now push this deeper into more unsuspecting user's desktops.
While I'm glad these guys were shut down, Mastercard and Visa shouldn't have had to do it. This case constitutes outright fraud, and the perpetrators should be punished like other criminals: with handcuffs, a jury, and iron bars.
We used to have strong consumer protection agencies. Then something happened. How many more electronic Elixir Sulfanilamide incidents (or real ones for that matter) do we need before we re-create the strong and sensible regulatory bodies that used to protect us?
Which is why we need 3 geeks, 3 lawyers to shutdown the lion's share of spam and misbehavior like this.
That thing breaks havoc on every machine it is installed on. They too make over $100K a week: http://en.wikipedia.org/wiki/Antivirus_2009#Earnings
...How F-secure can track down AV360's Virus Inc. but still can't figure out a way from stopping the rogue installers from running on a fully patched F-secure protected PC.
I know it's more technical than this and easy for Virus writers to workaround, but I would think that their DeepGuard system could at least block/warn anything with the name "InstallAVG_(Random 6 digit number).exe from running. That would at least keep 99% of the current AV360/AV2009 infections down for awile until they change their naming scheme.
TDSS is the next Virus I'd love to see die, but thats another story.
In Soviet Russia, Trojan exploits YOU!
This whole conflicker/antivirusXP/antivirus360 has generated more work at my service desk than all the warranty and out of warranty and other unrelated service on computers all year at my store.
and who has been taking bonuses for tax payers' money?
and who runs these financial services?
There. In this case, correlation is not causation, it's confirmation.
Traffic Converter have a note on their site www.trafficconverter2.biz:
On March 18th, in the evening, with no warnings, the German Merchant Processing was cut off. Merchant was at the bank personally (without intermediaries), proved and with the arrangements on the highest level. Up until now the bank was not replying to our inquiries, but finally we received answers from them your Merchant was blocked and the account frozen until the determination of the facts. According to unofficial channels, we have been able to ascertain the following:
"I am sorry to inform you that both VISA and MC have done a surprise on site visit at the offices in Frankfurt. They are actually there as we speak.
They have instructed WC to freeze your account until further notice and both of these companies have different reasons for doing so:
VISA; they want to investigate where all the volume comes from.
MC; High CB`s the past few days."
This is absolutely unprecedented case when two of the largest payment system called the requirement to block the Merchant. We also have a reason to believe that the situation was caused by the recent publication about us and our products in Washington Post:
http://voices.washingtonpost.com/securityfix/
There are, as you can see, some very serious accusations. Including the relation to Conficker, which we actually are not implicated with (and can prove it if necessary).
As a result of this situation:
- No money to pay;
- No capacity to process products (not because we're not working, but because this volume is not endure any processor)
- There is a chance to get ourselves under prosecution and let down Webmasters.
So, the decision was made to âefault and shut down the Traffic Converter. In case we resolve this issue and manage to refund the money from the bank, we will pay you off all debts as quickly as possible.
If we manage to get the stable traffic conversions we have demonstrated during the year and a half, we will contact you on individual basis.
Thanks to everyone for succesful business cooperation.
I.O.U One Sig.
Am I the only one to be shocked that a private company (Visa and MC) can shut down another one simply on the basis of denunciations in the press, and be congratulated about it ?
Traffic Converter should be tried before the judicial system. They probably aren't saints, but justice works only if it is applied the same way to everybody. Otherwise it's called arbitrary. This should be obvious but apparently it seems necessary to repeat it often.
I am hoping that this is not the beginning of the payment processors taking a lead role in policing the internet and denying payment processing to whomever they may deem inappropriate.
It can certainly have it's good points, but usually, when you give a powerful company More power...
" ... Otherwise it's called arbitrary. This should be obvious but apparently it seems necessary to repeat it often "
It's called vigilanteism, it's what you get where mob rule replaces justice. Modern day newspapers specialise in inspiring it.
IQ of a mob is significantly less than the average of its members, so way less than 100. Not the cleverest of entities. Again, newspapers love them because they're so easily steerable.
Solipse