Speaking of fake codec, a new "italian only" targeted attack targets users posing as new codecs... these were spammed via e-mail as "funny Christmas videos" that required the user to download a fake codec. Once downloaded, it displays some popup saying "sorry, compatible only with Windows Vista", but obviously the trojan is installed already. Propagation is automatic, meaning an infected person automatically sends the same spam to people in his contacts (who might in turn think it's authentic since a "friend" sent it)...

"Fortunately" while the scripted pages prevent being reached outside Italy displaying a custom 500 internal server error, the files can be downloaded.

hxxp://www.newcodecscentral(dot)biz/ codec_install.exe

hxxp://www.videocardcodecs(dot)biz/install.exe

hxxp://www.videocodecs(dot)biz/ codec_installer.exe
TNT | Homepage | 12.23.06 - 9:46 pm | #

All reported to Site Advisor and PIRT.
Darth_yoda | 12.28.06 - 6:12 am | #