IE Defender, Files Secure, Malware Bell

IE Defender/Files Secure/MalwareBell Codec has been update, it installs files with semi-random filenames, composed from fragment words: sim, op, ku, _de, _uk, _us, 16, 32, 64...

Files could be: simop_de32.dll, simku_uk16.dll...

and displays alert messages:


Use SmitfraudFix to remove the infection.

Zlob

Zlob fake codec has been update. It drops the following file:

%SYSTEM%\bubbj.dll

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{db763ed8-100a-481b-8913-50a2f41dcdc3}"="exegeses"

It also installs Toolbar, BHO, VirusHeat Rogue software...

This bubbj.dll filename has already been used last year by this infection. This time the CLSID is different.

Use SmitfraudFix to remove the infection.

IE Defender, Files Secure, Malware Bell

IE Defender/Files Secure/MalwareBell Codec has been update, it installs files with semi-random filenames, composed from fragment words: pa, ko, ny, do, net, api, 32, 99...

Files could be: nydo32r.dll

and displays alert messages:


Use SmitfraudFix to remove the infection.

IE Defender, Files Secure, Malware Bell

IE Defender/Files Secure/MalwareBell Codec has been update, it installs files with semi-random filenames, composed from fragment words: sys, pol, net, owl,api, web, 16,32,64...

Files could be: netweb64c.dll, sysapi32a.dll ...

and displays alert messages:


Use SmitfraudFix to remove the infection.

IEDefender

IE Defender/Files Secure/MalwareBell Codec has been update, it installs the following files:

%WINDOWS%\pctools.dll

and displays alert messages:


See: http://secubox.aldria.com/topic-2320.html
Use SmitfraudFix to remove the infection.

Zlob

Zlob fake codec has been update. It drops the following file:

%SYSTEM%\vualf.dll

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{12a31567-9883-4cc0-a684-ad5804394d69}"="hemimorphite"

It also installs Toolbar, BHO, VirusHeat Rogue software...

Use SmitfraudFix to remove the infection.

Malware Bell

A new Rogue has been released: Malware Bell.
This rogues looks like: IE Defender, Files Secure.

VideoAccessCodec (VAC)

VideoAccessCodec has been update, it installs the following files:

%WINDOWS%\lgmxvpat???.dll (where ? is a random caracter)
%WINDOWS%\qtvglped.dll
%WINDOWS%\pmsoarbf.dll
%WINDOWS%\omlbpkaw.dll

Use SmitfraudFix to remove the infection.

IEDefender

IE Defender/Files Secure Codec has been update, it installs the following files:

%WINDOWS%\ps16sys.dll

It displays alert messages:


See: http://secubox.aldria.com/edit-post3200.html
Use SmitfraudFix to remove the infection.

IEDefender

IE Defender/Files Secure Codec has been update, it installs the following files:

%WINDOWS%\winsurf.dll

It displays alert messages:


See: http://secubox.aldria.com/topic-2318.html
Use SmitfraudFix to remove the infection.