gneprogram(dot)com
ndcperformance(dot)com
mzdsoftware(dot)com
pkbsolution(dot)com
zerocodec(dot)com
As is the case with fake codecs these days, the binaries are hidden and getting them depends on where the developer hides them. With certain sites, you can often get a sample through /download/(sitename).exe (there are always more binaries in the same directory as well, each numbered for affiliates). For other codec sites, /download.php?id=4082 will get a binary (that number is just an affiliate ID — other numbers work as well). If you are hunting for Mac fake codecs, remember to change your user agent to a Mac. And please — don’t touch these binaries unless you know what you’re doing, as they are live Trojans.
Alex Eckelberry
(Thanks Bharath)