Slashdot Log In
zCodec Video Codec Is a Trojan
Posted by
kdawson
on Mon Sep 04, 2006 05:10 PM
from the who-is-watching-whom? dept.
from the who-is-watching-whom? dept.
Bride of Chucky writes "There's a new video codec out there that claims to offer 'up to 40 percent better video quality' but that resets your computer's DNS settings — opening the way for Trojans, rootkits, or whatever. Techworld warns that zCodec looks professional enough, is widely available, and comes in at 100KB. What's the bet the media companies are behind this somewhere?"
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Rather than the conspiracy theory. (Score:5, Insightful)
(http://www.ablabla.org/)
Follow the money. The MPAA has plenty to make off p2p lawsuits to risk the kind of bad press and fines they'd get by doing something like this.
Basically, the submitter is an irrational idiot pandering to the anarchist conspiracy theorists in an attempt to start a flamewar. Congratulations, you've probably got it.
Re:Rather than the conspiracy theory. (Score:5, Insightful)
"Follow the money. Sony has plenty to make off hardware and music sales to risk the kind of bad press and fines they'd get by installing a rootkit on your computer"
Sony makes a whole fuckload more money from their products than the MPAA gets from suing grandmothers, and that sure didn't stop them from one of the biggest PR blunders by a tech company in recent memory.
It's far more likely that a script kiddie or spammer type is responsible... but I would NOT put this sort of thing past the shitbags at the MPAA.
What! (Score:5, Funny)
Re:What! (Score:5, Funny)
But It dosen't run on linux.
Re:What! (Score:5, Insightful)
(http://evil.google.com/)
So I clicked on the zcodec.com link above and the first thing I noticed was the use of some copyrighted movie posters on their page. And then I saw the link for the "therms of use." "Professional enough" indeed...
Re: Therms!! Hooray! (Score:4, Funny)
(http://www.fredshome.org/)
Re:What! (Score:5, Funny)
(Last Journal: Saturday September 15, @06:35PM)
http-//www.vcodec.com in it{see last line of 'therms'} to zcodec.com is the best laugh I've had today.
Huh? (Score:5, Insightful)
I am surprised this one did not make it to the pos (Score:1, Offtopic)
(http://en.wikipedia....vated_protein_kinase | Last Journal: Monday April 30 2007, @06:22AM)
Why are the media companies being accused? (Score:2, Insightful)
Don't you think that after the sony rootkit most companies wouldnt bother with such schemes....
Gimme an S. (Score:2, Redundant)
(http://www.uncoveror.com/)
S!
Gimme an O.
O!
Gimme an N.
N!
Gimme a Y
Why? They put rootkits on CDs. They are just the kind of company that would make a video codec that is a trojan.
Freaky coincidence (Score:1, Offtopic)
(http://www.asmor.com/)
Anyone have any idea what might have happened? I didn't download or install anything in the time frame that this happened.
4.2.2.2 (Score:5, Informative)
(Last Journal: Wednesday January 31 2007, @02:25AM)
You've already gotten a reply to your original post that indicates at least one other person has seen this happen to their DNS settings. If I'd never typed in 4.2.2.2 myself, and I had no previous business relationship with Verizon or GTE, I'd call shenanigans. A malware writer needing to disable automatic DNS for some reason would have to specify a replacement IP and 4.2.2.2 is convenient to hard code.
Hmm. (Score:5, Insightful)
(http://theravensnest.org/ | Last Journal: Sunday October 07, @07:05AM)
A tin-foil hat is a mark of someone who can, in all seriousness, say 'if it looks like a duck, and quacks like a duck, then it must be a concealed listening device placed by the government under the instruction of the military-industrial complex and funded by the media industry.' The poster should wear his with pride.
"looks professional enough"?? (Score:1, Insightful)
"Therms" of Use and Support (Score:1)
(http://slashdot.org/ | Last Journal: Sunday August 10 2003, @06:00AM)
They also have a Support form on their site. Wonder if they actually are reading the support enquiries or just harvesting emails?
No need for conspiracies... (Score:4, Insightful)
This ranks right up there with the scores of malware programs that pretend to be malware removers. I assume the original poster would have us believe that all those are really written by the likes of Symantec and McAfee?
The underlying problem is much deeper (Score:2)
(http://easyvpshost.com/ | Last Journal: Friday August 26 2005, @06:58PM)
Joey Dell doesn't see the difference between technical details of OSS and Proprietary Software, all he sees is the malware being marketed as "Faster SMaller Better"
zcodec.com still up?!? (Score:1)
Come on, mods, it has to be asked (Score:4, Funny)
Oh please... (Score:5, Insightful)
(Last Journal: Wednesday April 27 2005, @01:58PM)
That's incredibly presumptuous and a completely baseless accusation. There are lots of people who can clearly benefit from trojans, and someone obviously has seen the potential in video codecs as a nice "social engineering" way of fooling the gullible masses into downloading them. The average person generally searches for video codecs once in a blue moon - they have no way of knowing which sites are legitimate, or which files are legitimate. They'll download whatever sounds promising. In fact, the website looks far more legitimate than some of the genuine codec sites out there.
Smarter users might do regular intensive searching to make sure they are getting a legitimate file, but the average user will not. It's far more likely that the author of this trojan is just exploiting the fact that so many users of codecs are clueless than yet another paranoid conspiracy that the media companies are behind it. Really, will the slashdot editors ever get over their bias and just print actual NEWS.
Send someone to jail (Score:3, Insightful)
Enough is a enough. A message needs to be sent to these bastards. Suing and fines only do so much. They fine these bastards, they file for bankruptcy and its over. They close the company and the fines and suits go away. Can't sue what doesn't exist and current corp. laws protect us from going after personal assets.
Time to bring some real charges against these fuckers and send a few of them to prison for a good long stretch. And I'm not talking 6 months in a jail with 500 hours of community service. I'm talking 10 years in maximum security.
I know some people say the punishment doesn't fit the crime but I think its time it did. If we would have locked up some of them bastards from Sony then I bet this one wouldn't' happen.
and nobody's doing anything.....why? (Score:4, Informative)
ZCodec Inc
Abrahamen Biderman
webmaster@zcodec.com
5624 17th Ave
Brooklyn
New York
NY,11204-1834
Tel. +718.2364275
Creation Date: 23-Dec-2005
Expiration Date: 23-Dec-2006
Okay first of all, it was registered almost a full year ago and second, even now I could probably drive to his house/office (assuming that info is accurate) and arrest him myself faster than the FBI could. Why does everyone always sit around and do nothing when stuff like this happens? Someone should at least give him a call :-) It's not even nigeria this time, how expensive could it be?
No bet... (Score:3, Insightful)
(http://www.hyperlogos.org/ | Last Journal: Wednesday July 18, @08:19PM)
Wha? (Score:2)
(http://joe-baldwin.net/ | Last Journal: Saturday September 02 2006, @11:58AM)
Whoever wrote that needs their heads checking.
Fire! (Score:1, Offtopic)
Appears to be from Inhoster, known spyware source. (Score:5, Informative)
(http://www.animats.com)
Looks like this is coming from a known source of spyware in Ukraine, "Inhoster.com".
"zcodec.com" is actually "85.255.117.106-xbox.dedi.inhoster.com", a dedicated server at a "nlayer.net" colocation site in San Francisco. The dedicated server appears to be associated with "atrivo".
Both "inhoster.com" and "atrivo" appear to be "psuedo-ISPs"; they have web sites that look like those of an ISP, but they don't really offer services for sale. Both have bad reputations: see "Spywarequake Scam on the Run [netrn.net]. The previous attacks were based on phony anti-spyware programs. Now that people are wise to that one, the new frontier is apparently phony codecs.
The WHOIS information for "zcodec.net" appears to be bogus. It's given as "Abrahamen Biderman" at "5624 17th Ave, Brooklyn, New York" There is an "Abraham Biderman" with an office at 5624 17th Ave, Brooklyn, New York, and he's a political figure and investment banker [forbes.com], with a career running major financial institutions. Probably not behind some two-bit spyware scam.
thats news - heres a tip (Score:4, Interesting)
Virtually every bloody codec pack you could download contained spyware/adware - some of them put in by the developers themselves. I've got some lovely versions of Nimo, K-lite and gordian knot to prove it. Hell, DivX pre 5.2 had GAIN in it and if you didn't know where to look on their website you had no way of finding the version without it (it didnt have the encoder so wasn't gain supported) . VLC is all I download for video playback now. If they don't support it I don't need to watch it - I've an flv file convertor for those of you who know how to download the dang yourtube/google videos that vlc cant handle perfectly.
Learnt the hard way not to download things from any third party site even if its trusted back in high school. I run XP because I like playing games. If I had a tinfoil hat I'd read the source and then compile and do MD5 checks but I'm lazy and will take the binary packages, and I suspect one day I will pay for that laziness, despite my use of Tea Timer and the Spybot S&D hosts file and immunization databse, Lavasofts ad aware, windows defender and rootkit revealer, hijack this, peer guardian 2, and spyware blaster. One day I will be an idiot and download a binary with some spyware that is still under the radar for all of these and I will be pissed when I realize it. Atleast, I will realize it, but most users wont.
I bet PC will (Score:4, Funny)
(http://www.jazz-sax.com/)
The therms(sic) do seem to admit part of this (Score:1)
Why take the detour? (Score:3, Interesting)
Music companies have huge legal departments that can (and do) get their info from ISPs with subpoenas. Trojan distributors are constantly trying to find new ways to push their junk onto your computer, often by paying heavily for 0day exploits.
Who is more likely to buy a "cheap" way to bug your PC?
What's behind what (Score:1)
What's to bet that a grudge and agenda is behind this unfounded swipe?
Whats the bet? (Score:1)
codecs have been used for years as spyware drops (Score:2)
(http://henry.simon.net.nz/)
--Simon
At least they're honest... eventually... (Score:1)
(Last Journal: Monday November 27 2006, @01:17PM)
Yay, malware!
Also:
Is it me, or is that not the job of a codec?
watch out for Pcodec too. http://www.pcodec.com/ (Score:3, Informative)
the same blurb, different
Domain Name: PCODEC.COM
Creation Date: 25-Aug-2006
Expiration Date: 25-Aug-2007
People are being enticed into downloading this codec by the following posting that is being spambotted on to public forums that allow guest posting..
"Br1tney Spe@rs r@ped!
http://britneyspearsrocks.info/ [britneyspearsrocks.info]"
Check out the "Therms of use" (Score:1)
There are some reasons for reading the TOS, you know.
Also as a side note, the file name of the "Therms of use" is therms.html for whatever that may mean.
Ok so.. (Score:1)
(http://www.shaolintiger.com/)
Thanks!
DivX has been pumping us full of Spyware for years, this is nothing new.
Maybe it's Panda that's trying to drum up business (Score:1)
Who are they targetting? (Score:1)
(Last Journal: Tuesday June 19, @07:48AM)
This is kind of interesting, usually these trojans are targetted at the least technical people (screensavers, games etc) - seems to make sense, there's more of them and they're more likely to fall for it.
But presumably you have to be at least a little technically interested to know what a codec is and think you want one. So are they gaining some advantage by targetting a smaller group who's less likely to fall for it? Are their machines on for longer on faster connections?
Strange, how can a mere codec... (Score:1)
But, they install spyware for the sake of security (Score:2)
(Last Journal: Thursday October 27 2005, @04:01PM)
(a) "Internet Explorer Security Plugin 2006": Internet Explorer toolbar that protects your computer while you browse by setting high level of security for suspicious hosts.
(b) "Public Messenger ver 2.03": Popup advertising module that opens Internet Explorer ad windows when you are connected to internet.
(c) "Internet Security Add-On": your Internet Explorer homepage will be changed.
(d) Security software: antivirus/antispyware application.
Even I, after reading this would not think this would be "spyware" with exception to (b). I don't like any software to change the settings/homepage or interface without me agreeing to it anyways but still
"professional enough"?? (Score:2)
(http://www.biglumber.com/ | Last Journal: Tuesday September 18, @12:25PM)
What the hell does that mean? How do you know if something looks "professional"? Are you checking to see if it's a full-time business vs a hobby, or some kind of test like that?
Sometimes I think "professional" is one of the dumbest and most-abused (to the point of being renderred meaningless) words in our language. We're seeing used here as implying lack of spyware (wtf does that have to do with getting paid?!) and it has often been used to describe how someone dresses. What a great word for saying nothing.
Re:suprise suprise, another American company (Score:2)
(http://www.nerdparadise.com/)
I'm going out of a limb and say that that's just someone registering false info. Also, there is no 17th Ave in Brooklyn. [google.com]
Re:suprise suprise, another American company (Score:5, Informative)
Actually, there is [google.com]. One of the oddities about New York City is that a mailing address of New York, NY means Manhattan. To properly address something in Brooklyn (and thus for Google Maps to find it) you need to use Brooklyn, NY.
Re:Use Linux (Score:4, Informative)
Re:I blame Windows (Score:1)
*Claps*
Re:suprise suprise, another American company (Score:2)
dear god! its a terr'ist!