Zlob, fake download

Fake site proposing software download (or Keygen/Crack) installing a Zlob Malware.

Zlob, fake download

Zlob infections are related to p0rn sites !
This used to be true but it is not anymore. After Fake Codec Errors , Fake Flash Errors, Fake Flash Version, Faked MP3 Download.
Zlob infections familly (Rogue installer Antispycheck/IEAntivirus, DNS Changer, VAC) is also spread on Fake Cracks/Warez Blogs or Fake Softwares Downloads WebSites.



Notice the "*100% checked by Antivirus" comment ;)

Video ActiveX Object Error

Fake Video suggesting Fake Codec installation, and dropping iSecurity Malware (infected Windows Security icon in Control Panel).



Thanks to nosirrah.

Zlob, VideoAccessCodec (VAC)

Websites proposing malware installation under fake codec message have seen an evolution, according to Secure Computing, Zlob threat hides as free, faked MP3 download.

VideoAccessCodec fake messages content have also changed, proposing a Fake Flash installation:



Thanks to MAD.

VideoAccessCodec (VAC)

VideoAccessCodec (aka VAC, VideoCach, MediaTubeCodec, Media Codec Software, Video ActiveX Codec) is installed from web sites proposing video and a codec (trojan) installation.



It installs a toolbar in Internet Explorer:


and displays fake IE alert bars, linking to rogues:

Video ActiveX Object Error

Fake Video suggesting Fake Codec installation, and dropping Video Access Codec Malware (Toolbars, Fake Alerts, URL Redirections) to suggest user to install rogue software.

Video ActiveX Object Error

Fake Video suggesting Fake Codec installation, and dropping DNS.Changer Malware.

Video ActiveX Object Error

Fake Video suggesting Fake Codec installation, linked to IEDefender Rogue.

IE Codec

A New fake Codec installer was found. (Thanks to nosirrah).
Compromised web sites display fake alerts about a software installation to watch a video. This Software installs a componant (BHO) in Internet Explorer displaying Fake Trojan Alerts.

Flash Player incorrect version

Flash Player incorrect version is a fake popup linked to a fake Video ActiveX Object (see Multimedia Decoder codec).





This Trojan installs an Internet Explorer componant that displays alerts, popup, and modifies search results to encourage the user to install IEDefender Rogue.

See SunbeltBlog

Multimedia Decoder

Multimedia Decoder is another fake codec installing malware.
It displays fake alert to install IEDefender Rogue and Hijacks google pages with an alert and a malware p0rn link.