codec

New Zlob fake codec domains:

theprivatetube.com (78.157.143.191)
softload2008jq.com (78.157.143.250)
91.203.93.26

More fake codec distributing domains:

http://xh-codec.net (78.157.142.111)
http://mediamswares.com (77.91.231.183)
http://movsdlls.com (77.91.231.201)

These are some new Zlob pushing domains:

free-download-basez.com (74.50.117.68)
wmmsupdate.com (77.91.231.201)
metavideotube.com (78.157.143.191)
codecdownload.trustedsoftportal07.net (74.50.117.89)
softload2008mx.com (78.157.143.250)
downloadtorun.com (91.203.93.25)

Stay away from them ;)

Here are some of the latest Zlob distributing domains:

favoritetube.net
trustedware.com
wplayerware.com
codecdownload.trustedsoftportal2009.net

Here are some more new Zlob pushing websites:

http://gothotvidtosee.com
http://imagesaccess.com
http://myveryprivatevid.com
http://watchmovie2009.com
http://softload2009.com
http://www.pwrware.com
http://yebanulisohuenno.com
http://u-software-online.com  read more »

Here are some of the new Zlob pushing websites:
http://getqtysoftware.com
http://softwareportal2008.com
http://www.favoredmovie.com
http://megazcodec.com
http://www.plupdate.com
Stay away from these sites...

Here's one more fake codec, named AccessMedia. The dropper is named as AccessMediaSetup.exe and is hosted at www.softwaredestributiononlinecorp.com.  read more »

Zlob gang has modified their fake codec malware once again!  read more »

It seems Zlob group is changing/re-packing their fake code installers almost every 24 hours. New samples are found every day! After player-codec, host-codec, click-codec and virutalcodec, now they have released greatcodec. It is hosted at www(dot)greatcodec(dot)com.

Actually, we can see three forms of fake codec installers from Zlob:
VideoAxObject installer (these are named as Setup.exe)
Greatcodec (as of now)
NewMediaCodecInstaller  read more »