More Malware-Laced Codecs

A few weeks ago, while catching up on Internet pop culture videos, I stumbled upon a few 2girls1cup-reaction videos on Ebaumsworld. Having watched the reaction videos, I was naturally curious what the actual 2girls1cup video was about. A quick Google search revealed 740,000 results for “2girls1cup”–seems everyone’s already watched it except for me.

I quickly found the video and like everyone else in the reaction videos, my eyes were glued to the screen. After watching some more reaction videos, I came across a blog comment that promises 2girls1finger is even better–and it links us to the site (http://us-private-[BLOCKED].blogspot.com). Awesome! Let’s check it out…

Here’s a screenshot of the linked site:

The site wants me to download this “codec”:

Looking at the download dialog, the .exe seems to be from http://powerm[BLOCKED].com. (Sounds legit, I guess.) I went ahead and downloaded the codec. (Note: Don’t try this at home, folks; I’m a professional. You should never download content from untrusted sources.)

After downloading the “codec,” I clicked the Continue button on the video screen. This action just popped up the download tab again. I don’t understand why–I had already downloaded it. Next, I clicked the Cancel button; that action threw me into a loop between the following two pop-ups (how’s that for annoying?):

It turns out this codec wasn’t so much a codec as a Trojan. Here’s a write-up from McAfee.

Don’t forget that downloading content from untrusted sources often means downloading malware. Keep this in mind while searching for the next bizarre fetish clip or its reaction videos. Here’s a similar blog entry posted last year. Same attack vector, just a different video.