Home Malware Programs Malware Codec-C

Codec-C

Posted: March 30, 2012

Threat Metric

Threat Level: 7/10
Infected PCs: 3,832
First Seen: March 30, 2012
Last Seen: March 29, 2020
OS(es) Affected: Windows

Codec-C is a fake codec update that's marketed by browser hijackers that typically make alterations to unrelated websites and force them to display fraudulent codec update messages. Attempts to install this fake codec will result in your PC being infected by ClickPotato, an adware-based PC threat that displays unnecessary advertisements and change your homepage settings. However, even if you don't install Codec-C, the presence of Codec-C installation prompts often can be taken as an indicator that your PC is already infected by a related PC threat. SpywareRemove.com malware researchers recommend scanning your computer with trustworthy anti-malware applications to identify and erase the source of Codec-C messages, and placing emphasis on the essential innocence of unrelated websites who are forced to display these prompts due to Codec-C browser attacks.

Codec-C: the Rogue Codec That Changes the Web to Make You Download It

While a normal codec is a common update package for various types of video files, Codec-C is a fake codec that doesn't serve any sort of purpose as an enabler of movie content. Instead of serving its marketed function, Codec-C is just a fraudulent delivery package for ClickPotato, an adware program that's so infamous that many people would be aware enough to refuse to install it based on its name alone. Codec-C is commonly encountered after another PC threat already infects your computer. Codec-C is then promoted by browser advertisements that misrepresent themselves in the form of fake Codec-C update requests, and will block various types of videos and movies while they're enabled. Although you may be able to modify your browser settings to disable these advertisements, SpywareRemove.com malware researchers warn that this act actually doesn't remove the browser hijacker, and should only be considered a temporary measure along the way to removing the PC threat with appropriate software.

The Unpleasant Results of Trying to Improve Your Video Player Performance with Codec-C

Codec-C can be rated as a low-level threat, but its attack will create exploitable vulnerabilities on your computer and should never be considered as a side effect of any type of benign software. Some other common symptoms of infection by Codec-C include:

  • Poor system and browser performance.
  • A Start Menu that refuses to display.
  • Changes to your browser's settings, especially with regards to your homepage settings, which may be set to an unusual or harmful site.
  • The presence of unusual toolbars, emoticons and any other side effects of unwanted browser add-ons.
  • The appearance of unfamiliar desktop icons.
  • Registry changes that allow Codec-C's associated PC threats to launch automatically with Windows.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:



%ALLUSERSPROFILE%\CodecC\bhoclass.dll File name: bhoclass.dll
Size: 140.8 KB (140800 bytes)
MD5: c9b0594425c1fae5e387c9dfab657c4d
Detection count: 3,820
File type: Dynamic link library
Mime Type: unknown/dll
Path: %ALLUSERSPROFILE%\CodecC
Group: Malware file
Last Updated: August 25, 2023
%DesktopDir%\Windows No-Risk Agent.lnk File name: %DesktopDir%\Windows No-Risk Agent.lnk
File type: Shortcut
Mime Type: unknown/lnk
Group: Malware file
%CommonPrograms%\Windows No-Risk Agent.lnk File name: %CommonPrograms%\Windows No-Risk Agent.lnk
File type: Shortcut
Mime Type: unknown/lnk
Group: Malware file
%AppData%\npswf32.dll File name: %AppData%\npswf32.dll
File type: Dynamic link library
Mime Type: unknown/dll
Group: Malware file
%AppData%\Inspector-[RANDOM CHARACTERS].exe File name: %AppData%\Inspector-[RANDOM CHARACTERS].exe
File type: Executable File
Mime Type: unknown/exe
Group: Malware file

Registry Modifications

The following newly produced Registry Values are:

HKEY..\..\..\..{Subkeys}HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "Inspector"
Loading...