»www.lavasoft.de/company/newslett···cks.html

quote:

---

Beware - Desktop Hijacks on the Rise Again
Security Forums have been deluged with daily cries of help from victims of the "Smitfraud" desktop hijackers that are using fake codec to infect their prey.

Watch out for the Zlob Trojan that poses as a codec needed to view a video, then installs a fake virus and urges its victims to download a rogue anti-spyware program to remove it. Lavasoft has also confirmed that this malware takes advantage of unpatched systems using exploits on web pages. Visit Microsoft Update to ensure that ALL of your critical Windows security pages are updated.

Other victims have been infected by a fake e-card greeting, or even a spoofed e-mail that claims to be Windows Update (Microsoft never sends updates via e-mail). Still more unassuming victims received an e-mail asking them to open a link to see the message (these can be fake e-mails, intended only to infect), or even a link from your 'buddy' in instant messages - but don't trust it if you aren't expecting it. Even your buddy could be infected without his/her knowledge and the virus on their computer is sending you the link with one purpose, and one purpose only - to infect you!

A few of the fake codecs out there include:

braincodec (added 28 Nov2006)
EliteCodec (added 08 Nov 2006)
Emcodec
eMedia Codec
Gold Codec (added 23 Nov 2006)
HQ Codec
iCodecPack
iMediaCodec
iVideoCodec
IntCodec
KeyCodec
Media-Codec
MediaCodec
MMediaCodec
MPCODEC
PCODEC
PerfectCodec (added 15 Nov 2006)
PowerCodec
PornPass Manager
PornMag Pass
QualityCodec (Added 08 Nov 2006)
SilverCodec (added 23 Nov 2006)
SoftCodec
strCodec
Supercodec (added 15 Nov 2006)
TrueCodec
vaxsetup
Vccodec
VideoCompressionCodec
VideoKeyCodec
VideosCodec,
WinMediaCodec
X Password Generator
X Password Manager
ZipCodec

We urge you to be aware and watch out for fake codecs. This is one of the favorite methods used by the authors of malware to lure you into downloading a file that infects your computer. If you receive a link for a video that says you need a certain codec in order to view it, be careful! Today, it could be a fake codec that is actually a Trojan just waiting to infect your system.

New variants are being released daily, even faster than Security Products companies receive new samples for detection. And because it does take time for due diligence on detection for the newer variants, it is important to remember that prevention is the key!

---

A screen shot of what one of the fake codecs looks like:




Discussion thread is here:
»Beware Fake Codecs - it could be a trojan

Edited for new variants: 23 Nov 2006 by CalamityJane
Last edited for new variants: 15 Nov 2006 by CalamityJane
Edit 08 Nov 2006 by CalamityJane: List of codecs updated for new variants

Last edited for new variants: 15 Nov 2006 by CalamityJane

got feedback? got feedback?

Any feedback you provide is sent to the owner of this FAQ for possible incorporation and shown publically as well.

by CalamityJane
last modified: 2006-12-05 14:41:10