Select Page

We’ve written about VideoC before (a fake video add-on like Vcodec)  It’s a scam that makes you believe you need to download a special plug-in to Windows Media Player in order to watch a video. 

Then it infects you with a barrelfull of spyware. 

But, like all spyware and adware, it’s fueled by commercial interests:   A company called CodecCash is offering website publishers the opportunity to make money on videos, by offering this fake codec

From their website:

The CodecCash(TM) system earns revenue each time movies on your website are viewed. Use your own content! Your users view 8 seconds of a movie, and then they click yes to download a full 30 seconds. We pay you whenever they click yes for the full 30 seconds. …Simple as that! We pay you $.15 for each movie viewing.

Well here’s an example of how this works.  Let’s take the site a-137(dot)com.  One clicks to view a video, gets the Windows Media Player…but then gets this message:

Videoc241a234

Clicking on “Show details and terms” takes you to this link.  Buried in the text are these treasures:

In return for the right to access this Content, you acknowledge and agree that the Software contains additional software products provided to Codec Cash by its suppliers which will periodically deliver additional Content such as, but not limited to, advertisements and promotional messages to your computer Updates to Software.

and

Uninstalling the Software. In order to uninstall the Software, you will need to run the removal executable. You can get this program by contacting [email protected].

Ah, well, that’s a little misleading, isn’t it?  Because if you lick that “Run” button, here’s what your system will look like in just a few seconds:

Infection234234234

(Typical SpySheriff evil).

There’s a new start page too!

Startpage13123123

And even this fake Windows firewall message that pops-up intermittently:

Fakewindowsfirewall12sfa

(Clicking “Yes” goes to http://search4help(dot)net/search_own.php?pin=87649)

But it was especially entertaining to get this scrolling marquee popping up over the browser just out of the blue:

Testwetesliuowier

(It links to http://www(dot)teslaplus(dot)com/search.php?wmid=143&sub=87649)

In other words, a simple 30 second movie just ruined your day.

 

Alex Eckelberry
(Thanks to Sunbelt researcher Patrick Jordan).