VSCodec Pro

VSCodecPro is the new version of PCCodecPack, LuxeCodecXP, WinCoDecPRO. It display fake alerts about media problems.



When trying to run Windows Media Player, it displays an alertbox and redirect to vs-vodec-pro.com webpages.



alltubesplace.com (91.212.65.29)
antivirus-xppro2009.com (91.212.65.29)
antivirus-xppro-2009.com (91.212.65.29)
free-webscaners.net (91.212.65.29)
free-web-scaners.net (91.212.65.29)
free-web-scaners.com (91.212.65.29)
free-web-scaners.biz (91.212.65.29)
onlinescanxpp.com (91.212.65.29)
onlinescanxppp.com (91.212.65.29)
vs-codec-pro.com (91.212.65.29)
vscodec-pro.com (91.212.65.29)
scan-virusremover2009.com (91.212.65.29)

PCCodecPack

PC Codec Pack is the new version of LuxeCodecXP, WinCoDecPRO.

PCCodec Pack displays codec error, redirecting infected user to PCCodecPack web site.



The Fake Alert binary use Lighty Compressor (seen on WinPC Antivirus dropper, and DNS.Changer dropper).

WinCoDecPRO Fake Codec

WinCoDecPRO is a Rogue like fake software.
While Rogues detect fake infections on a clean system and display alerts message, WinCoDecPRO displays fake codec error, redirecting infected user to WinCoDecPRO web site.

When Trying to run Windows Media Player, the malware closes it and displays a messagebox, choosing the text in a hardcoded list:



It also display regularly popups alerts:









The modified wallpaper: