In the last day or so we've seen yet another change in codecs used by the popular zlob infection.

This time around its called Micro-Codec. The filenames are normally structured like MICRO-CODEC[0-9][0-9][0-9][0-9].EXE.

These come and go on a daily basis, but this one warranted more then 2 minutes of our time.

Here's what we found:

One of the main sites that point users to the codec download is listed below.

Registered and running from Singapore, it's been used in the past to peddle illegal porn, a quick google search shows this clearly, however to our suprise we found some very reputable sites containing guestbook and talkback spam containing these links.

Clearly there has been a breakdown in filtering these out somewhere along the line. Countless users are being directed to these sites from reputable sites, and having a link on all these sites improves the pagerank of said malicious site, making it easier to find via Google.

See Image below for some mid afternoon humour. (There are currently 734 sites linking to this site!)

By the way - The Domaintools Reverse IP for this server looks quite juicy, see below!

And finally.... Have you seen this person?