Video ActiveX Object Error

Fake Video suggesting Fake Codec installation, linked to IEDefender Rogue.

IE Codec

A New fake Codec installer was found. (Thanks to nosirrah).
Compromised web sites display fake alerts about a software installation to watch a video. This Software installs a componant (BHO) in Internet Explorer displaying Fake Trojan Alerts.

Flash Player incorrect version

Flash Player incorrect version is a fake popup linked to a fake Video ActiveX Object (see Multimedia Decoder codec).





This Trojan installs an Internet Explorer componant that displays alerts, popup, and modifies search results to encourage the user to install IEDefender Rogue.

See SunbeltBlog

VirusProtect 3.8

A new Rogue has been released: VirusProtect.
This rogues looks like: VirusRay, Antivir Gear, VirusProtectPro , SpyDown, SpywareQuake.

Files Secure

A new Rogue has been released: File Secure.
This rogues looks like: IE Defender.

Zlob - Trend Security Advisories

Trend Micro have published an article about Zlob few months ago.

IE Defender

Rogue IE Defender coming with the fake codec multimedia decoder has been incuded to SmitfraudFix.



The authors of IE Defender are claiming on CastleCops forum that their software is "clean and is real antispyware".
Talking about the problem of the trojan fake codec that advertise for IE Defender installation, they post:

we have a partnership for our distributors to advertise our program, we pay them a percent of registration fee. Some of them use illegal methods, that we not accept, our customers send us abuses about it and we closed some of our affiliates accounts without paying them. We are watching on it but there are problems with them sometimes. We're working on this problem and it's very sad for us.

Looking at the servers IP of IE Defender and the Trojan: they are the same. No more to say.

Multimedia Decoder

Multimedia Decoder is another fake codec installing malware.
It displays fake alert to install IEDefender Rogue and Hijacks google pages with an alert and a malware p0rn link.

VirusRay 3.8

A new Rogue has been released: VirusRay.
This rogues looks like: Antivir Gear, VirusProtectPro , SpyDown, SpywareQuake.

Trojan SPM/LX

Smitfraud family Malware.
Displays fake alert messages, Hijacks desktop background.