Malware-type clickbots infect machines in order to achieve IP diversity, and their traffic may or may not be as easily iden- tifiable as that generated by for-sale clickbots. is a malware-type clickbot, and is identified as a trojan by some anti-virus packages. The result of a VirusTOTAL scan, which runs various anti-virus scanners, on the binary pro- duced the results shown in Table 1 in the Appendix, as noted by SANS handler Swa Frantzen [2]. Many of the popular virus scanners includingMcAfee, Sophos, and Symantec did not detect that was malicious, and some of those that did detect it only did so because it used a common Trojan.
