xvid 1.357 final? there's a such a NEW version?

[puzzledman]

I was trying to play a video file named with a ".avi" extension but Windows Media Player (WMP) complained that it was not really an AVI file. From an error message of AVS Video Converter, I reckon it's really an ASF file. Anyway, WMP then said it needed to download a codec which it referred to as XVID 1.357 Final. It opened up webpage with the following URL h t t p : / / softforme2008.com/software/Update%20is%20Required%20to%20play%20this%20file-XviD%201.357%20Final/1357/6/ (and the rendered image is attached in case you didn't feel like visiting that URL which might be harmful). And the said webpage further directed me to download the codec from h t t p : / / softwareforme-08.com/download2/502/1357/6/ ... Now, for all I know, the latest version of XVID is 1.1.3 and so I got suspicious and didn't persuit the download further (I actually did, but used a perl command line tool to get the file so that it wouldn't be interpreted in anyway. The file appears to be an executable. I will attached the file in the next message of this thread for anyone who are kind enough to take a look.)

I think you might have guessed my question now. But, here it is: what's the latest version of the XVID codec? I shouldn't be fooled by that link, right?

[puzzledman]

Attached with this message is the file I fetched off the said potentially bogus link.


Please don't post direct links to a possible virus/trojan

Moderator redwudz

[minidv2dvd]

that's a bogus video with a script to lead you to the nasty installer. xvid.org is the only place you want to get anything related to xvid from and they have never had a "final" version.

[minidv2dvd]

how unusual it's a russian site. hard to trace but here it is.
Domain Name: SOFTWAREFORME-08.COM

Registrant:
Petrenko
Nikolay (info@softwareforme2008.com)
Moscow
Moscow
Moskovskaya oblast,173633
RU
Tel. +7.4958394534
Fax. +7.4958394534

Creation Date: 19-Aug-2008
Expiration Date: 19-Aug-2009

[puzzledman]

I am sorry for posting the potentially harmful URL... thankfully the moderator has done something to protect you. And thanks to guys who investigated. I guess the answer is surely I should play safe.

[Placio74]

Uh... under download it's TrojanDownloader:Win32/Zlob.gen!BS

[onionringlets]

what should i do if i opened the executable file. nothing seems to be happening, but i also didn't get to watch my vid

[45tripp]

you're infected now!!

run anti-virus,
anti-spyware, anti trojan...

try and find specific instructions to the infection,
placio names the infection above.

print out instructions.

disconnect from the internet as soon as you're ready to start cleaning.

[cobalt]

Always the same thing with those communists.