imported>HamburgerRadio: move to most specific category

2024-06-20T03:49:24Z

move to most specific category

New page

{{Short description|Windows platform based trojan}}
{{Notability |date=April 2024}}
{{Redirect|Pcodec|3 = P-code (disambiguation)}}
{{Infobox computer virus
| fullname =
| image =
| caption =
| common_name = Codec
| technical_name =
* Trojan.Emcodec ([[NortonLifeLock|Symantec]])
* Trojan.Emcodec.[Letter] (Symantec)
* TROJ_CODEC.[Letter] ([[Trend Micro]])
* MAL_CODEC (Trend Micro)
* MAL_CODEC-[Number] (Trend Micro)
| aliases =
| family =
| classification =
| type =
| subtype =
| isolation_date =
| origin =
| infection_vector =
| author =
| ports_used =
| OS =
| filesize =
| language =
}}

'''Trojan.Emcodec.E''' is a [[trojan horse (computing)|trojan horse]] that is mis-represented as an [[sound|audio]] and [[video codec]] for [[Microsoft Windows|Windows]]-based [[Personal computer|PCs]]. It exists in various variants with names such as '''Media Codec''', '''Ecodec''', '''Imediacodec''', '''IntCodec''', '''Pcodec''', '''SVideocodec''', '''Video iCodec''', '''QualityCodec''', '''Vcodec''', '''Zip Codec''', '''zCodec''', '''ZCODEC'''<ref>{{cite web|url=http://research.sunbelt-software.com/threatdisplay.aspx?name=Tro.Vcodec&threatid=42096|title=Threat Display|website=research.sunbelt-software.com|access-date=2006-09-18|archive-date=2007-09-27|archive-url=https://web.archive.org/web/20070927031325/http://research.sunbelt-software.com/threatdisplay.aspx?name=Tro.Vcodec&threatid=42096|url-status=dead}}</ref> and began to be widely used in spring 2005.

When visiting certain web sites, in particular [[pornographic]] sites, and attempting to view a video file on the site, the user will be directed to download this software, purportedly in order to allow viewing of the video. Furthermore, a number of websites have been set up to mis-represent this [[malware]] as a legitimate codec, inviting the users to download the software, allegedly to allow for the playback of certain audio/video which claims to use the so-called codec.

Once executed, the trojan copies a program into the Program Files folder, changes some [[Windows registry|registry keys]] and displays a fake [[EULA]] for the supposed codec.<ref>{{cite web|url=http://www.symantec.com/security_response/writeup.jsp?docid=2006-070115-3546-99|archive-url=https://web.archive.org/web/20070328061533/http://www.symantec.com/security_response/writeup.jsp?docid=2006-070115-3546-99|url-status=dead|archive-date=March 28, 2007|title=Trojan.Emcodec.E - Symantec|website=[[Broadcom#Symantec enterprise security|Symantec]]}} </ref>

zCodec reportedly changes the machine's [[Domain Name System|DNS]] settings, monitors the user's browsing and acts as [[adware]].<ref>[https://web.archive.org/web/20070315143602/http://www.techworld.com/security/news/index.cfm?newsid=6781 Techworld report on zCodec], 4 September 2006</ref>

Some versions of the trojan install malware called '''[[Zlob trojan|Zlob]]''', which in turn may lead to the installation of malicious and fake "security programs" such as SpywareQuake, [[SpyFalcon]], [[WinFixer]] or other malware; some variants also install a [[Backdoor (computing)|backdoor]] into the infected computer.<ref>{{cite web|url=http://research.sunbelt-software.com/threatdisplay.aspx?name=Zlob.Media-Codec&threatid=44478|title=Trojan-Downloader.Zlob.Media-Codec (fs) Information and Removal.|website=research.sunbelt-software.com|access-date=2006-09-18|archive-date=2021-04-20|archive-url=https://web.archive.org/web/20210420000313/https://success.vipre.com/|url-status=dead}}</ref>

==References==
{{Reflist}}

== External links ==

;Removal tools
*[https://web.archive.org/web/20061011052222/http://siri.urz.free.fr/Fix/SmitfraudFix_En.php SmitfraudFix]
*[http://noahdfear.geekstogo.com SmitRem]
*[https://data-encoder.com Remote access trojans]

[[Category:Windows trojans]]
[[Category:Windows adware]]
[[Category:Spyware]]

Emcodec - Revision history

imported>HamburgerRadio: move to most specific category