September 1st, 2006
by Tim Wilson, Site Editor

Zcodec, a new malicious program that incorporates a rootkit, can alter Internet search results, install adware, and fool users into installing Trojans, the security company reported on Wednesday.

Source: Dark Reading

It is produced by the SAME 'codec' guys who are creating the ZLob Trojan installers that are
disguised as Video Codecs.


The files that come from them are named such as...
dvdcodec1000.exe
ZCodec1000.exe


The ZLob installers will have names like...
sv-codec-v4_01a.exe
mediacodec-4.207.exe
intcodec-v6.535.exe
intcodec-v6.107.exe

...

zCodec promises video, delivers nasties
Users looking for the latest and greatest video software may not just be in danger from media lawyers. Security firm Panda Software last week warned that zCodec, which claims to offer "up to 40 percent better (video) quality," is in fact an adware program that can install Trojans, rootkits and other malicious software.

Panda Advisory - ZCodec
Brief Description

ZCodec is an adware program that passes itself off as a video codec.

It accesses an IP address on the Internet in order to download and run a certain file at random. This file can be of any nature. For example, ZCodec could download the Trojan Ruins.MB, which uses rootkit techniques in order to hide itself. Or, it could install an online casino.

ZCodec also changes the DNS configuration and monitors if the user accesses any of several adult websites.

ZCodec can be voluntarily downloaded from a certain website.