BleepingComputer.com: Click Fraud Malware Hides as Firefox Extension

Trend Micro threat analysts were alerted to the discovery of a spyware (detected as TSPY_EBOD.A) purporting to be an Adobe Flash Player update. Upon execution, the spyware creates a Firefox add-on called “Adobe Flash Player 0.2,” the installer of which uses JavaScript (detected as JS_EBOD.A) and appears to spread via forum posts....

...this new Firefox threat, which Trend Micro calls TSPY_EBOD.A, is using social engineering to trick users into installing it.

The extension is being offered on various forums via JavaScript as an Adobe Flash Player update. Once installed, it appears in the Add-ons Management window under the Extensions tab as "Adobe Flash Player 0.2." It is worth noting that the real Flash Player add-on for Firefox is actually a plug-in, which is listed under the Plugins tab as "Shockwave Flash [version number]."

This new piece of malware is actually a click fraud trojan, which injects ads into Google search-result pages. When these ads are clicked, the trojan's authors are receiving a small fee from the advertising network supplying them. ...

...So how do you know if you have this trojan on your system? Any of these signs indicate that you’re infected:

* A running process named smc.exe Edit: Sygate Firewall also uses this process name so this is not a reliable indicator of infection.
* A Firefox plugin named “Adobe Flash Player 0.2″
* Having recently installed a file called install_flash_player.exe or Install_Flash.exe from an unknown source ...