[Michael]

The following domain, *sexvideorussia.com pushes a fake codec in the form of.... a WSF file (Windows Script File).



The file datafeeder.swf contains obfuscated JavaScript:



If you run it, it will install a BHO tied to bpfeed.dll



That BHO is going to inject ads into your webpages, as this VirusTotal screen cap shows:



Since everything appears to be written in Russian, I assume it is targeting the same population.

On that same IP (88.208.19.153) there are similar sites pushing the same malware:

redxporno.com



besplatnoexxx.com



The domains appear to be registered to:

andrey smiyan
Lepkalno
19
Vilnus, 232000
Latvia

But the IP is located in the Netherlands.

Jerome Segura

Malware ID:*cea469492f8430cc060a33e0324a0869.zip