Two more fake codec sites:
IP: 85.255.117.197
apassmanager(dot)com
IP: 85.255.117.197
imageactivex(dot)com
Obviously, do not download these fake codecs as they are malware. If you are infected, the latest version of CounterSpy (or the CounterSpy 2.0 beta) should remove them just fine.
Patrick Jordan and Alex Eckelberry