zCodec Video Codec is a TROJAN

Use Netsparker


For those that didn’t see, there is a new all singing all dancing ‘light-weight’ Codec in town that is actually a trojan.

Indeed it’s not the first time we’ve seen this kind of thing.

The zCodec software actually messes with your DNS settings.

Users looking for the latest and greatest video software may not just be in danger from media lawyers. Security firm Panda Software last week warned that zCodec, which claims to offer “up to 40 percent better (video) quality,” is in fact an adware program that can install Trojans, rootkits and other malicious software.

zCodec is freely available online and, as of Monday afternoon, was easy enough to find, offering downloads from its own website – zcodec.com. The site uses images from the films Sin City and Pulp Fiction, and claims zCodec will boost audio as well as video quality.

“zCodec is a multimedia compressor/decompressor which registers into the Windows collection of multimedia drivers and integrates with any application using DirectShow and Microsoft Video for Windows,” the site states.

Media players use codecs (compressor/decompressors) to compress and play back digital media files, but in the real world, for a codec to make any quality difference, a file must be encoded using that codec.

As always do be vigilant when installing software and use a software or desktop firewall to patrol outgoing connections. You can also use something like TCPView to check on outgoing connections a little easier than using plain old netstat.

Panda’s advisory last week revealed that the 100KB file is in fact adware, which “downloads and runs files, changes the DNS configuration and monitors accesses to several adult websites”.

zCodec, formally known as Adware/ZCodec or Adware/EMediacodec, affects most versions of Windows and was first detected last week, Panda said.

When run, the program alters the system’s DNS configuration in order to divert traffic to DNS servers of its choice, a technique sometimes used as part of a phishing scam or to rack up clicks for advertising schemes.

zCodec also accesses a particular IP address to randomly select and download one of a collection of files. The files that could be downloaded include Ruins.MB, a Trojan horse that uses rootkit techniques to conceal itself, Panda said. zCodec could also download an online casino program.

A second file launches every time the user starts Internet Explorer and monitors Web usage. Panda said its software can remove zCodec.

Companies are getting really unscrupulous, what is going to come next I do wonder?

Source: Techworld

Posted in: Malware, Spammers & Scammers

, , , , , , ,


Latest Posts:


BDFProxy - Patch Binaries via MITM - BackdoorFactory + mitmProxy BDFProxy – Patch Binaries via MiTM – BackdoorFactory + mitmproxy
BDFProxy allows you to patch binaries via MiTM with The Backdoor Factory combined with mitmproxy enabling on the fly patching of binary downloads
Domained - Multi Tool Subdomain Enumeration Domained – Multi Tool Subdomain Enumeration
Domained is a multi tool subdomain enumeration tool that uses several subdomain enumeration tools and wordlists to create a unique list of subdomains.
Acunetix Vulnerability Scanner For Linux Now Available Acunetix Vulnerability Scanner For Linux Now Available
Acunetix Vulnerability Scanner For Linux is now available, now you get all of the functionality of Acunetix, with all of the dependability of Linux.
Gerix WiFi Cracker - Wireless 802.11 Hacking Tool With GUI Gerix WiFi Cracker – Wireless 802.11 Hacking Tool With GUI
Gerix WiFi cracker is an easy to use Wireless 802.11 Hacking Tool with a GUI, it was originally made to run on BackTrack and this version has been updated for Kali (2018.1).
Malcom - Malware Communication Analyzer Malcom – Malware Communication Analyzer
Malcom is a Malware Communication Analyzer designed to analyze a system's network communication using graphical representations of network traffic.
WepAttack - WLAN 802.11 WEP Key Hacking Tool WepAttack – WLAN 802.11 WEP Key Hacking Tool
WepAttack is a WLAN open source Linux WEP key hacking tool for breaking 802.11 WEP keys using a wordlist based dictionary attack.


One Response to zCodec Video Codec is a TROJAN

  1. Interested October 16, 2006 at 6:27 pm #

    “but in the real world, for a codec to make any quality difference, a file must be encoded using that codec.”

    I thought FFDSHOW can decode other codecs and also enhance it?