SunbeltBlog have written about VideoC before
We’ve been seeing this for a while now — a file starts to play, then is interrupted with a message that the user needs to install VideoC.
Of course, there is no such player called VideoC. Instead, what you get is a big, fat nasty payload of spyware.
(a fake video add-on like Vcodec) It’s a scam that makes you believe you need to download a special plug-in to Windows Media Player in order to watch a video.
Then it infects you with a barrelfull of spyware.
But, like all spyware and adware, it’s fueled by commercial interests: A company called CodecCash is offering website publishers the opportunity to make money on videos, by offering this fake codec.
From their website:
The CodecCash(TM) system earns revenue each time movies on your website are viewed. Use your own content! Your users view 8 seconds of a movie, and then they click yes to download a full 30 seconds. We pay you whenever they click yes for the full 30 seconds. …Simple as that! We pay you $.15 for each movie viewing.
Well here’s an example of how this works. Let’s take the site a-137(dot)com. One clicks to view a video, gets the Windows Media Player…but then gets this message:
Hit run button 3 times. Installation will not take long. Please, stay online. After full installation your video will be continued automatically.
Clicking on “Show details and terms” takes you to this link. Buried in the text are these treasures:
In return for the right to access this Content, you acknowledge and agree that the Software contains additional software products provided to Codec Cash by its suppliers which will periodically deliver additional Content such as, but not limited to, advertisements and promotional messages to your computer Updates to Software.
and
Uninstalling the Software. In order to uninstall the Software, you will need to run the removal executable. You can get this program by contacting support@codeccash.com.
After, if you click that “Run” button, here’s what your will look message “SPYWARE INFECTION” and an icon in the system tray. This icons shows a balloon, which says that your computer is infected with dangerous spyware parasites and asks the user to download and install an rogue antispyware program.
Thanks to Sunbelt researcher Patrick Jordan
