Another fake codec to avoid

I found this fake codec site using a new social engineering trick ... they play the (adult) movie in Windows Media Player from a small pop-up but as you can see it's blank. While the movie plays the sound is audible but no video ... this is to trick the viewer into clicking the link displayed to download a "Video Access ActiveX Object". The guys at SunBelt reported a similar site, which the download is nothing more than another Trojan.Zlob version.

So who is behind all these fake codec installs? Generally the VideoCash folks, just look at their offer ...

While VideoCash pays up to $0.44 to the site operator they generate much more revenue with their downloaded bundle. This generally includes (at least) a Rogue Antispyware program, which they recieve 50-75% commission per install ...

Published Friday, December 08, 2006 3:58 AM by winhelp2002

Comments

# Who is behind all these Codec sites?

Wednesday, May 16, 2007 2:44 PM by Hosts News
While investigating yet another Trojan.Zlob codec site passtosites(dot)net ... it makes you wonder what