VideoAccessCodec

Whilst “surfing” the internet (googling an address for Lloyds TSB in Hove, actually) I come across a weird-looking google result.

manual

It begs to be clicked on, really. Next thing, I get a page telling me I need this that or the other:

codec install

First off, note the fake “ActiveX Object Error”. It’s formatted to fit in with the standard WIndows XP style on default colours (“the Fisher Price scheme”). I always want my windows to look as much like Windows 95 as possible, so it stands out like a sore thumb. The URL is http://hqthefilmsxxx.com/images/495/1… Despite the fact that the google result had giboni.cn. Next I tried the same search on Linux, and get taken straight to one of these useless “search” sites, full of loans and mortgages. Using Lynx I get page not found. More useless “search” for the same link in Server2K3, albeit a different “search” engine. Tried in Internet Explorer, but yet another “search” thing. It seems I am destined not to get to sample the delights of these codecs in a controlled environment. Eventually, I print out the HTML and find the location where this blighter is residing. Quick wget and I am on my way.

[bored@thor codec]# wget http://videoaccesscodec.com/download/502/495/1/
 --12:45:28-- http://videoaccesscodec.com/download/502/495/1/
 Resolving videoaccesscodec.com... 88.208.16.128
 Connecting to videoaccesscodec.com|88.208.16.128|:80... connected.
 HTTP request sent, awaiting response... 302 Found
 Location: /./soft/temp/502_35051070e5_1/VideoAccessCodecInstall.exe [following]
 --12:45:28-- http://videoaccesscodec.com/soft/temp/502_35051070e5_1/VideoAccessCodecInstall.exe
 Connecting to videoaccesscodec.com|88.208.16.128|:80... connected.
 HTTP request sent, awaiting response... 200 OK
 Length: 112228 (110K) [application/octet-stream]
 Saving to: `VideoAccessCodecInstall.exe'
100%[====================================================================================>] 112,228 720K/s in 0.2s
12:45:28 (720 KB/s) - `VideoAccessCodecInstall.exe' saved [112228/112228]

VideoAccessCodecInstall.exe gets installed on Server. It brings up a terms and conditions screen, reproduced here in the table for ease of skipping (because is that not what people do with these things?) (If you don’t want to read the thing now, and it really is stupidly long, click here to skip)

Video Access Codec End User License Agreement (“EULA”)NOTICE TO USER: THIS END USER LICENSE AGREEMENT (“AGREEMENT”) APPLIES WITH RESPECT TO SOFTWARE APPLICATIONS PROVIDED BY Video Access Codec. AND ITS AFFILIATES (REFERRED TO IN THIS AGREEMENT AS “WE” OR “Video Access Codec”) FROM ANY Video Access Codec WEBSITE. PLEASE READ THIS AGREEMENT CAREFULLY. BY CLICKING “ACCEPT,” “FINISH,” “CONTINUE” OR A SIMILAR ACKNOWLEDGMENT BELOW, OR BY USING ALL OR ANY PORTION OF THE Video Access Codec SOFTWARE (DEFINED BELOW), YOU ACCEPT ALL THE TERMS AND CONDITIONS OF THIS AGREEMENT. YOU AGREE THAT THIS AGREEMENT IS ENFORCEABLE LIKE ANY WRITTEN NEGOTIATED AGREEMENT SIGNED BY YOU. IF YOU DO NOT AGREE, DO NOT INSTALL OR USE THE Video Access Codec SOFTWARE. Special Notice for Non-English Speakers: The Video Access Codec Software is suited primarily for the use of English speakers and, therefore, this Agreement is written in English and is addressed to English speakers. If you are not proficient in English and feel that you cannot properly understand this Agreement, we recommend that you either retain the help of an English speaker to help you understand and accept the terms of this Agreement or, alternatively, refrain from installing or using the Video Access Codec Software. In any event, if you choose to install or Use the Video Access Codec Software, you will be bound by Agreement and the Privacy Policy incorporated herein. Notice for All Users: By installing the Video Access Codec Software, you get free access to sponsored content available on the Internet and other software applications. The Video Access Codec Software will show you a limited number of ads that pop up on your screen in a separate browser. The ads are based on keywords from the websites you visit. Please note that you may receive Adult-oriented ads if you utilize keywords connected to, search for or view Adult websites. Once installed and running, you can access the Video Access Codec Software from your system tray, and you can uninstall anytime by using the Add or Remove Programs feature of Microsoft Windows. Please see Section 2 below for important terms and conditions regarding other software applications distributed by Video Access Codec. 1. Components bundled with our software may report to Licensor and/or its affiliates status of the installation of certain components and also generalized installation information, such as language preference and operating system version, to assist Licensor in its product development. No personal information will be communicated to Licensor or its affiliates during this process. Licensor may offer additional components through our version checking/update system. These components include: (a) “Search Assistant”: Internet Explorer search assistant, will display ads based on keywords from the websites you visit. (b) “Messenger Service”: Advertisement module that opens Internet Explorer advertising windows when you are connected to internet. (c) “IExplorer Homepage and Bookmarks”: Internet Explorer homepage will be changed, links to the security software will be added to the bookmarks. (d) Privacy and Security software: A 3rd party anti-virus/anti-spyware applications. (e) “Banner Ads”: will display banner ads on the pages you visit. (f) “Video Codec”: software will open path to the protected files. 2. Owner of Computer; All Users Bound; Age Limitation; Software License; Other Software. You represent and warrant either that you are the owner of the computer and that you have authorized the download and installation of the Video Access Codec Software or that the owner of the computer has authorized you to do so. You agree, with respect to all users of the computer on which you have caused the Video Access Codec Software to reside, to provide a copy of these terms and conditions and to obtain their consent to these terms and conditions before allowing them to Use the Video Access Codec Software. Alternatively, if you have the legal right to accept this Agreement on behalf of one or more users of the computer on which you have caused or authorized the Video Access Codec Software to reside, then you hereby accept this Agreement on behalf of all such other users. You understand that the presence of the Video Access Codec Software on any computer is voluntary and that you may remove it at any time. You must be at least 18 years of age to Use the Video Access Codec Software. By accepting the terms of this Agreement and Using the Video Access Codec Software you represent that you are over the age of 18. As long as you comply with, and subject to, the terms of this Agreement, Video Access Codec grants to you a non-exclusive, revocable license to Use the Video Access Codec Software, in binary executable form only, solely for the purposes described in this Agreement. This Agreement does not apply to any Other Software. Your use of any Other Software is subject to that third partys license agreement and privacy policy. Video Access Codec makes no representations as to the quality, suitability, functionality, or legality of any Other Software. You agree that Video Access Codec is not responsible or liable for any loss or damage of any sort incurred as a result of your download, installation, or use of Other Software, and you hereby waive any claim you may have against Video Access Codec with respect to Other Software. 3. Restrictions. You will: (a) not reverse engineer, disassemble or decompile the Video Access Codec Software or attempt to discover or recreate the source code to the Video Access Codec Software, except as otherwise required by applicable law, (b) comply with all applicable laws, in your Use of the Video Access Codec Software, (c) not make any modification, adaptation, improvement, enhancement, translation or derivative work of or to the Video Access Codec Software, (d) not remove, alter or obscure any proprietary notices (including copyright notices) of Video Access Codec or its licensors in the Video Access Codec Software, (e) not Use the Video Access Codec Software for purposes for which it is not designed, and (f) only Use the Video Access Codec Software for personal, non-commercial use. 4. Intellectual Property Rights. The Video Access Codec Software is the intellectual property of, and owned by, Video Access Codec and its licensors and suppliers. The structure, organization and code of the Video Access Codec Software are the valuable trade secrets and confidential information of Video Access Codec and its licensors and suppliers. The Video Access Codec Software is protected by copyright, international treaty provisions and applicable laws in the country in which it is being used. Except as expressly stated herein, this Agreement does not grant you any intellectual property rights in the Video Access Codec Software, and all rights not expressly granted are reserved by Video Access Codec and its licensors and suppliers. Notwithstanding anything set forth herein, the source code of the FireFox Plug-in Modules incorporated into or provided with the Video Access Codec Software is available under the terms of the Mozilla Public License. Any terms set forth in this Agreement that differ from the Mozilla Public License are offered by Video Access Codec alone and, unless otherwise expressly provided in this EULA, not by any third-party supplier to Video Access Codec. 5. Important Information Regarding Video Access Codec “Search Assistant” Video Access Codec Software. If the Video Access Codec Software consists of Video Access Codec Search Assistant (the Search Assistant”), then the following terms and conditions apply to you: 5.1. Functionality. The Search Assistant Video Access Codec Software recognizes keywords from your Internet browser to display relevant advertisements. These advertisements may be displayed on your computer screen at any time while you are searching and shopping online (and not necessarily while you are using any product or service related to or downloaded with the Search Assistant Video Access Codec Software) and pop-up on your screen in a separate browser.The Search Assistant Video Access Codec Software neither stores any personally identifiable information nor records your browsing behavior. Please refer to Section 9 (below) for further information about our privacy policies. 5.2. Display of Advertising. The Search Assistant Video Access Codec Software starts automatically when you start your computer, runs in the background on your computer and may periodically direct you to our sponsors’ websites. By installing and/or using the Search Assistant Video Access Codec Software you grant permission for Video Access Codec to periodically display sponsors’ websites to you. The frequency of these advertisements (which will pop up on your screen in a separate browser) will be limited, but will vary depending on your use of the Internet. Please note that you may receive Adult-oriented ads if you utilize keywords connected to, search for or view Adult websites. On occasion, you may search for a website and receive an error from your browser software indicating that the site cannot be found. When this occurs, the Search Assistant includes a function that may redirect your web browser to our sponsor’s websites based on the content of the website address, or URL, which you entered. You hereby consent to these actions. Content that is Adult is defined as any audio, video, audiovisual, images, sounds or text that contain or reference any of the following: profanity, violence, blood and gore, weapons, use of alcohol, drugs, tobacco, online gambling, pornography, erotica, erotic images, nudity, sex, sexually explicit images, and sexual references. If you are using Microsoft Internet Explorer 6.0 or higher, you can utilize its Content Advisor feature to help restrict certain types of sites and advertisements, including Adult ones, from opening in your browser. Specifically, please follow the following steps: 1. In Internet Explorer, select Tools/Internet Options; 2. Select the Content tab; 3. Select either Enable to turn on this feature and adjust the settings or Settings (if the feature is already enabled) to adjust your settings; 4. Customize your settings under each of the available tabs. Please note that the Content Advisor feature of Internet Explorer does not specifically restrict content based on crude or off-color humor, or controlled substances. If you experience difficulty with the Content Advisor feature, please contact Microsoft customer support for assistance. 5.3. Identification of Advertisements. The advertisements that the Search Assistant presents are provided in a separate browser window and are not endorsed by or affiliated with the websites that trigger their appearance. 6. Uninstallation. You understand and agree that the presence of the Video Access Codec Software on your computer is voluntary and that you may remove the Video Access Codec Software from your computer at any time. The Video Access Codec Software may be uninstalled by going to the “Add/Remove Programs” menu on your computer and clicking the “Remove” button next to the entry for the Video Access Codec. Specifically, to uninstall all components of Video Access Codec Software, please follow these steps: 1. Go to Start menu; 2. Select Control Panel; 3. Select Add or Remove Programs; 4. Select the Video Access Codec; 5. Click Change/Remove. 6. Do the same procedure for Web Video Support. Please note that the above is the only proper way to ensure complete removal of all Video Access Codec Software files many anti-spyware or other software tools do not completely or properly remove the Video Access Codec Software. Some Internet content and software publishers, including Video Access Codec, require that their users have certain of the Video Access Codec Software (including the Search Assistant Video Access Codec Software) installed on their computer in order to access their content or use their software applications (“Content Providers”). Uninstallation of such Video Access Codec Software may impact your ability to access such content and/or use such software. You may be required to restart your computer in order for the uninstallation to take effect. 7. Updates. Video Access Codec, in its sole discretion, may provide you with Updates to the Video Access Codec Software as part of this Agreement. The Video Access Codec Software will automatically check with Video Access Codec for the existence of any Update that Video Access Codec has released, and in the event that one is available, the Video Access Codec Software will update itself automatically. Nothing herein shall be construed or interpreted as requiring that Video Access Codec provide Updates. Video Access Codec will not install any new software or Update that in our reasonable judgment has functionality that is materially different from the functionality of the previously installed Video Access Codec Software without your prior consent. 8. Disclaimer of Warranties and Remedies; Indemnity. 8.1. No Warranty; Disclaimer. YOUR USE OF THE Video Access Codec SOFTWARE IS AT YOUR SOLE RISK. THE Video Access Codec SOFTWARE IS PROVIDED ON AN “AS IS” AND “AS AVAILABLE” BASIS. Video Access Codec, AND ITS LICENSORS AND SUPPLIERS, EXPRESSLY DISCLAIM ALL WARRANTIES OF ANY KIND, WHETHER EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. Video Access Codec, AND ITS LICENSORS AND SUPPLIERS, MAKE NO WARRANTY THAT (i) THE Video Access Codec SOFTWARE WILL MEET YOUR REQUIREMENTS, (ii) THE Video Access Codec SOFTWARE WILL BE UNINTERRUPTED, TIMELY, SECURE, OR ERROR-FREE, (iii) THE RESULTS THAT MAY BE OBTAINED FROM THE USE OF THE Video Access Codec SOFTWARE WILL BE ACCURATE OR RELIABLE, (iv) THE QUALITY OF ANY PRODUCTS, SERVICES, INFORMATION, OR OTHER MATERIAL PURCHASED OR OBTAINED BY YOU THROUGH THE Video Access Codec SOFTWARE WILL MEET YOUR EXPECTATIONS, OR (v) ANY ERRORS IN THE Video Access Codec SOFTWARE WILL BE CORRECTED. ANY MATERIAL DOWNLOADED OR OTHERWISE OBTAINED THROUGH THE USE OF THE Video Access Codec SOFTWARE IS OBTAINED AT YOUR OWN DISCRETION AND RISK AND YOU WILL BE SOLELY RESPONSIBLE FOR ANY DAMAGE TO YOUR COMPUTER SYSTEM OR LOSS OF DATA THAT RESULTS FROM THE DOWNLOAD OF ANY SUCH MATERIAL. NO ADVICE OR INFORMATION, WHETHER ORAL OR WRITTEN, OBTAINED BY YOU FROM Video Access Codec OR THROUGH OR FROM THE Video Access Codec SOFTWARE SHALL CREATE ANY WARRANTY. 8.2. Limitation of Damages. NEITHER Video Access Codec NOR ANY OF ITS LICENSORS OR SUPPLIERS WILL HAVE ANY, AND YOU RELEASE Video Access Codec AND ALL OF ITS LICENSORS AND SUPPLIERS FROM ANY, LIABILITY (WHETHER IN CONTRACT, WARRANTY, TORT, NEGLIGENCE OR OTHERWISE) FOR ANY DAMAGES SUSTAINED BY YOU ARISING FROM THE USE OR INABILITY TO USE THE Video Access Codec SOFTWARE, INCLUDING, WITHOUT LIMITATION, ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, OR CONSEQUENTIAL DAMAGES OR LOSS OF DATA, SAVINGS, OR PROFITS OR THE COST OF PROCURING SUBSTITUTE GOODS, EVEN IF Video Access Codec HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. IN NO EVENT WILL Video Access Codec’S ENTIRE LIABILITY ARISING OUT OF OR IN CONNECTION WITH THIS AGREEMENT EXCEED $500.00. THE LIMITATIONS IN THIS SECTION WILL APPLY NOTWITHSTANDING THE FAILURE OF ESSENTIAL PURPOSE OF ANY LIMITED REMEDY UNDER THIS AGREEMENT. SOME JURISDICTIONS DO NOT ALLOW THE EXCLUSION OF CERTAIN WARRANTIES OR THE LIMITATION OR EXCLUSION OF LIABILITY FOR INCIDENTAL OR CONSEQUENTIAL DAMAGES. ACCORDINGLY, SOME OF THE ABOVE LIMITATIONS MAY NOT APPLY TO YOU. Any representations made with respect to, and support or assistance offered by Video Access Codec in connection with, the Video Access Codec Software are offered by Video Access Codec only and not by any third party providing open source to Video Access Codec. 9. Use of Information. By installing the Video Access Codec Software, you grant permission for Video Access Codec to collect and use certain information. You acknowledge that you have reviewed the Video Access Codec Privacy Policy, which describes Video Access Codec’s practices with respect to the collection, use and disclosure of information in connection with your Use of the Video Access Codec Software. Video Access Codec reserves the right to change the provisions of its Privacy Policy from time to time. Video Access Codec will post any changes to the Privacy Policy at the web address in the preceding sentence. Your Use of the Video Access Codec Software following the posting of such changes to the Privacy Policy will constitute your acceptance of any such changes. 10. Infringement Reporting Procedure. Video Access Codec is not responsible for content hosted by non-Video Access Codec content providers, however, if you are aware of any infringing or illegal content hosted by a site that utilizes the Video Access Codec Software as an access control mechanism, please notify Video Access Codec at the address below so that we may take appropriate action. 11. Compatibility. Video Access Codec does not warrant that the Video Access Codec Software will be compatible with your hardware or other software installed on your computer system. Compatibility issues may cause your computer’s performance to suffer. In the event that the Video Access Codec Software is not compatible with your hardware or other software installed on your computer system, the Video Access Codec Software can be uninstalled by going to the “Add/Remove Programs” menu on your computer and clicking the “Remove” button next to the entries for Video Access Codec. Please refer to Section 6 (above) for detailed uninstall directions. Like all software, the Video Access Codec Software utilizes some of your computer’s resources to run, including system memory and Internet connection. Use of the Video Access Codec Software on a computer with inadequate system resources will cause such computer’s performance to suffer. 12. User Representations and Warranties. You acknowledge, represent and warrant that (a) you own the computer on which you are installing the Video Access Codec Software, or have the authority to install the Video Access Codec Software on such computer; (b) your installation and/or Use of the Video Access Codec Software will not violate any local, state or federal laws that apply to you, or the Use or installation of the Video Access Codec Software; and (c) Video Access Codec is not causing the Video Access Codec Software to be installed on your computer, but has provided the Video Access Codec Software to you, which you are installing of your own volition. 13. Indemnification. You agree to defend, indemnify, and hold harmless Video Access Codec, its licensors and suppliers, and each of their respective officers, directors and employees, from and against any lawsuits, claims, losses, damages, fines and expenses (including attorneys’ fees and costs) arising out of your use of the Video Access Codec Software or your breach of this Agreement 14. Governing Law; Dispute Resolution. This Agreement will be governed by and construed in accordance with the laws of the Republic of Panama, without regard to its choice of law principles to the contrary. Any controversy, dispute or claim arising out of or relating to this Agreement or breach thereof shall be resolved by binding arbitration administered by Judicial Arbitration and Mediation Services, Inc. pursuant to its Comprehensive Arbitration Rules and Procedure (the “Rules”), except as otherwise provided herein. Arbitration shall be the exclusive method of resolving any controversy, dispute or claim arising out of or relating to this Agreement. Any arbitration conducted hereunder shall take place in Panama, Republic of Panama. Judgment on any arbitration award may be entered in any court having jurisdiction. The arbitrator’s fee and other expenses of the arbitration process shall be shared equally. The parties shall bear their own respective costs and attorneys’ fees. Panamas law, to the extent permitted, shall govern all substantive aspects of the dispute and all procedural issues not covered by the Rules. Nothing in this section shall prohibit Video Access Codec from seeking injunctive relief before an appropriate court to the extent necessary to protect its rights pending resolution of the dispute in accordance with the foregoing provisions. 15. Miscellaneous. This is the entire agreement between Video Access Codec and you relating to the Video Access Codec Software, and it supersedes any prior representations, discussions, undertakings, communications or advertising relating to the Video Access Codec Software. If any part of this Agreement is held by a court to be illegal, invalid or unenforceable, it will not affect the validity of the balance of the Agreement, which will remain valid and enforceable according to its terms. This Agreement may only be modified by a writing signed by an authorized officer of Video Access Codec. If you violate any term of this Agreement, Video Access Codec may terminate this Agreement without waiving any other rights. This Agreement is assignable by Video Access Codec. You may not assign your rights and obligations under this Agreement. 16. Contact Us. If you have any questions about the Video Access Codec Software please contact us support@videoaccesscodec.com

Well it does seem a little wordy to me too. Main point of interest here seems to be that they have an interesting definition of the word “codec”. Despite having wrestled with various media players and their (in)ability to play the various forms of content that I have thrown at them, I still have little understanding, and even less interest, in the codec & container phenomena. But I cannot recall Fraunhofer ever having helped me on my way searching for porn… Of course I agree to all this, and the installation continues.

I am avidly watching the packets fly by, and note that a connection is being made with “de98.remsys.org” where the installation program wants to download “install_cb.exe”. It does not seem to have any joy, the reply being “partial content”. Then all of a sudden the Wireshark capture ceases, the Wireshark screen disappears. What?! Wireshark is not even running on the same computer! (Well, sort of, but that is another story). This really does not happen to me that often, and when it does, I gather it is because it has choked on a very badly, illegally constructed packet. Luckily the temp file is still there and I load it into Wireshark on another computer. This also crashes it in style. Only after clipping the end off the capture does it load, so I’ll never know what these chinese/russian devils did to make capturing their exploits impossible. A manual download of install_cb.exe also fails, so I give up on that.

The actual ActiveX control was not included in the installation program, but gets fetched from dyn-128.16.208.88.iptp.net. Weird stuff. Dynamic, but hardly someone’s domestic connection as it is pretty fast. The installer flashes up a load of DOS boxes, and an Internet Explorer window, and that is that.

When it is finished, my taskbar has slipped off the screen, but otherwise there is absolutely no indication that something virussy is going off. No connections here and there, no new processes, no extra toolbars in IE. I wonder if something has gone wrong. Or does the thing only spring into action when I use Internet Explorer?

There are some new files, though, and registry additions. I am now the proud owner of wmpenv.dll, duocore.dll and wmpconf.dll (all in C:\WINDOWS), as well as VideoAccessCodec.ocx (in C:\Program Files\VideoAccessCodec), but I haven’t got a use for them as yet. And despite their promises, nothing is visible in my systray. This is quite disappointing, as it seemed at first sight to be a nasty little Trojan. There are two entries in the Add/Remove Program list: the VideoAccessCodec thing and a Video Viewer. (Though the second time I installed it, this never appeared.) These are the associated registry additions/modifications, as far as I can tell:

HKEY_CLASSES_ROOT\CLSID\{ECCEF4B2-E6E5-4B50-BBCF-8AD7E87161E8}\InProcServer32 (c:\windows\wmpenv.dll)
HKEY_CLASSES_ROOT\CLSID\{BE49B4AE-90E8-4C00-8A6A-0CA1B48F2B1E}\InProcServer32 (c:\windows\wmpconf.dll)
HKEY_CLASSES_ROOT\CLSID\{283A0EE3-2CC1-45AB-8207-B1D7B69C7F83}\InprocServer32 (c:\windows\duocore.dll)>
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ECCEF4B2-E6E5-4B50-BBCF-8AD7E87161E8}\InProcServer32 (c:\windows\wmpenv.dll)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BE49B4AE-90E8-4C00-8A6A-0CA1B48F2B1E}\InProcServer32 (c:\windows\wmpconf.dll)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{283A0EE3-2CC1-45AB-8207-B1D7B69C7F83}\InprocServer32 (c:\windows\duocore.dll threading model Apartment)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad (c:\windows\wmpenv.dll)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad (c:\windows\wmpconf.dll)
HKEY_CLASSES_ROOT\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}\1.0\0\win32 (c:\windows\duocore.dll)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}\1.0\0\win32 (c:\windows\duocore.dll)

I install the thing again, and now it is getting busy. Constant connections are being made with de98.remsys.org (81.29.248.50) and also 81.29.248.59 which is in the Russian Federation. GET and HEAD requests for dw.php?code=00-0C-29-48-96-40&hash=big string_not to be repeated here. These requests end with HTTP OK, except for once every ten requests when they keel Wireshark. Of course uninstalling does nothing to stop the phoning home. The extra process facilitating this is “vpncore.exe” curiously located in C:\Documents and Settings\Administrator\Local Settings|temp

Does no one ever empty their temp folder anymore? Perhaps it will just be “permission denied”. OK, I’m beginning to see the evil here. With the program “unistalled” the chattering with Russia continues. The tmp folder is filling with BITxx files, all zero KB long. I have no idea what the server in Russia actually wants, I did one IE google search and nothing (obviously) weird there. Then again, who knows what would have happened if I had searched for “adult” content…

Vpncore.exe killed, removed, registry entries (above) removed, deleted the .dll’s and that seems to be it, no more BIT files and other debris. There is some other garbage associated with this: there is a “~nsu.tmp” folder with a copy of Au_.exe in it. At 37 KB, this must be the uninstaller? Also some cookies.

(click here for the update: Video Access Codec Revisited == The codec mongers one year later )

Leave a Reply to This Post!

Your email address will not be published. Required fields are marked *

*