Question about economics of the iLivid rootkit cleanup I'm in the middle of

I'm cleaning up a laptop that was recently infected with a rootkit that installed iLivid, searchqu and some other browser redirection piece.

Am I correct in assuming that the person spreading the rootkit infection is somehow paid by iLivid and searchqu? I would like to learn more about how that happens and if there is anything those entities could do to prevent the malware author from profiting or do they quietly condone this?

Thanks

Edit: Moved topic from Breaking Virus & Security News to the more appropriate forum. ~ Roger

Hi Bwales

I have been offered the iLivid downloader several times and always resisted the temptation to install it, but with regard to the economics of the situation, malware writers get their payback in several ways.

At its simplest, there is scareware :- "Your computer is infected with umpteen thousand infections, send us money and we will clean it !". If you send them money ( don't, ever ) (1) they have your money; (2) they have your credit card details; (3) you still have the infection !

Next there are silent things like keyloggers, quietly working away sending somebody your passwords and other log-in data. This can be deadly if you do on-line banking for example.

Then there are trojans which just take over your computer and use it to generate spam or worse. This has happened to at least three of my acquaintances. Usually the first you know that this is happening is when your e-mail account gets suspended.

There are other means of making money by infecting some innocent bystander's computer - click-jacking for example - but it all comes down to criminal endeavour. Gone are the days when it was some smart-alec bored teenager playing games to show how smart he ( usually ) is.

I think, but would not stand up in court and testify, that iLivid itself is a legitimate product, but I have only come across it on one or two 'interesting' websites which are the sort of places you can very easily pick up malware along with anything like iLivid you may legitimately wish to download.

I assume by now that this computer is clean and its owner happy - I hope you made sure he had up to date protection and that it is kept up to date.

Chris Cosgrove

iLivid is a download manager which includes the Searchqu toolbar.

Many toolbars, Add-ons, screensavers, and weather monitoring programs come bundled with other software and can be the source of various issues and problems to include Adware. They usually can be removed via Add/Remove Programs from the Control Panel or Programs and Features in Vista/Windows 7, so always check there first.

If using Firefox or Google Chrome, please refer to:

• Uninstalling add-ons, plugins, extensions
• Cannot uninstall an add-on in Firefox: Uninstall From FF Safe Mode, Uninstall manually, Uninstall from Control Panel
• Using & Uninstalling Plugins in Firefox
• How to uninstall extensions in Google Chrome
• How To Uninstall Google Chrome Extensions and those that don't show

When done, be sure to restart the computer. <- Important!

In order to change Searchqu as your homepage setting please refer to the link for your browser:

• How to Change your Home Page in Internet Explorer 7 or Internet Explorer 8
• How to set the home page in Firefox
• How to set the home page in Chrome
• How to set the home page in Opera

Reset Internet Explorer or go here and click the button.

This will automatically reset registry keys and the browser back to the way it was when initially installed. If you check the Delete personal settings checkbox in Advanced settings, it will reset the home page(s), search providers and Accelerators to their default values. It will also delete temporary Internet files, history, cookies, web form information (passwords) and InPrivate Filtering data.

-- Note: Microsoft Fix it does not work in Windows 7. Instead, you can use the Internet Explorer troubleshooters to achieve this automatically.itially installed. Then clear your browser history.

If using FireFox, refer to these instructions to reset all user preferences, toolbars and search engine to their default settings using Firefox Safe Mode.

iLivid also has removal instructions posted here: How do I uninstall the software?

You may also want to read:

• Who Writes Malicious Programs and Why
• Who creates malware and why?