I’m starting a new series of blog posts, called “Seen in the Wild”.  These are various odds-and-ends we see during our research.

This was picked up today by Sunbelt spyware researcher Adam Thomas.  It shows a certified ActiveX install of 180 Search Assistant, offering “Free Porn Access By 180 Search Tools”.

What’s interesting is not that 180 was installed through a porn site (I suppose it’s something they have every right to do). Rather, it’s that the ActiveX control is so explicit in saying what the purpose of the install is (“Free Porn Access By 180 Search Tools”).  This is classic CDT stuff (CDT is the distributor 180 bought).

Incidentally, the install came off a crack site, which also sometimes passes you off to a Super Search page which installs various malware through an IFRAME exploit.

180adsfa_09

180df_90234 

Alex Eckelberry