some "Grand Microsoft Conspiracy" to bad-mouth BitTorrent to the benefit of their planned P2P tool, Avalanche. Furious P2P users (who were not familiar with the backstory of the investigation) even went as far to say Boyd was in league with the RIAA, out to create further problems for file-sharers by bringing these bundles to light. However - Dvorak's piece caused something approaching outrage on the other side of the fence, leading a fellow Ziff Davis Media publication to go head to head with Dvorak. Dave Methvin of PC Pitstop followed up the investigation with his findings. He alleges that some of the films distributed contained potentially illegal underage pornography, and not long after, MMG went offline and the Adware companies all pulled out of this particular distribution. Fake Google toolbar In October 2005, Boyd discovered a "fake" Google Toolbar which was being distributed via Instant Messaging. The toolbar allowed the user to store credit card details, and also opened up a fake Google search page. Boyd also tracked the toolbar back to 2003, through three different versions, each one exploiting vulnerabilities in the Windows operating system. Instant messaging rootkit In October / November 2005, Boyd discovered what is considered to be the first known instance of a rootkit being distributed via instant messaging, hidden inside a large payload of adware and spyware. Over a period of months, the group behind the attacks distributed numerous inventive payloads (such as a forced install of BitTorrent to spread movie files) and were eventually traced back to the Middle-East. Adware critic Boyd is a notoriously fierce critic of adware companies, famously causing 180solutions to label him a "fanatic" on their Weblog, with bad feeling in evidence on both sides to this day. He is regularly referenced on other leading antispyware sites such as Sunbelt Blog, Suzi Turner's ZDNet blog and Ben Edelman's home page. Security discoveries In 2006, Boyd continued to make significant discoveries in the field of security, including The discovery of a 150,000 strong Botnet ring that used a custom-built Perl script to steal payment data from third party shopping cart applications An exposé of a web-browser that redirected end-users to potentially illegal pornography An Instant Messaging Worm that installs its own web browser. The discovery that Adware makers Zango were promoting their content on Myspace. A modular, multi-chained string of infections dubbed the "Pipeline Worm". An Instant Messaging infection that uses