A new fake code site, movscodec(dot)com, hosted (not surprisingly) by the infamous Intercage/Atrivo.
These fake codecs are bad news and this one is no better. A user recently told us:
“This disgusting program installed itself when I was told I needed to install a codec to view a movie about my stocks. I was prompted to buy tons of programs and my computer hasn’t been successfully cleaned since.”
Movscodec is even blatant about what they do in their EULA:
SOFTWARE INSTALLATION: Components bundled with our software may report to Licensor and/or its affiliates the installation status of certain marketing offers, such as toolbars, and also generalized installation information, such as language preference and operating system version, to assist Licensor in its product development. No personal information will be communicated to MEDIA-CODEC or its affiliates during this process. Licensor may offer additional components through our version checking/update system. These components include:
(a) “Internet Explorer Security Plugin 2006”: Internet Explorer toolbar that protects your computer while you browse by setting high level of security for suspicious hosts.
(b) “Public Messenger ver 2.03”: Popup advertising module that opens Internet Explorer ad windows when you are connected to internet.
(c) “Internet Security Add-On”: your Internet Explorer homepage will be changed.
(d) Security software: antivirus/antispyware application.
Other similar sites include:
dvdcodec(dot)net
emcodec(dot)com
emediacodec(dot)com
emediacodec(dot)com
imediacodec(dot)com
Intcodec(dot)com
media-codec(dot)com
mediacodec(dot)net
media-codec(dot)net
movscodec(dot)com
mpgcodec(dot)com
nvidcodec(dot)com
nvidcodec(dot)com
pcodec(dot)com
svideocodec(dot)com
vcodec(dot)com
V-codec(dot)com
vcodecdownload(dot)com
vcodec-download(dot)com
vcodecget(dot)com
vcodec-get(dot)com
vcodecpull(dot)com
Vicodec(dot)com
Vidcodec(dot)com
vidscodec(dot)com
zcodec(dot)com
Alex Eckelberry
(Thanks to Sunbelt researchers Patrick Jordan and Adam Thomas)