I was trying to get an alleged video to run on some celebrity web page where I was told I needed to download a video codec update, wmcodec_update.exe. I did so, ran it and nothing happened. The video still wouldn't play. So I said to hell with it and forgot about it. I did notice it installed a file named 'richvideocodec.dll' in the windows\system32 folder but I just left it there. Then on some google searches I noticed I would seem to get some bad links. But when they occcured on sites I knew to be good I took a closer look. They were being redirected to a site called siteresults1.com with a 404 error. The google returns were all legit but were redirected when I clicked on them. I did searches on both siteresults1.com and richvideocodec.dll and both seemed to be a problem but I didn't find any links indicating they were related. I let hijackthis remove the richvideocodec registry reference and then rebooted to safe mode and removed the dll file. I rebooted again and got online and did a google search using the same terms that previously had resulted in links that were redirected. This time there was no redirection. So I think it's safe to say it's richvideocodec.dll that causes the redirection to siteresults1.com. Fortunately it's easy to remove and doesn't seem to leave any permanent damage. I don't think the relationship between the file and the site has been indicated before but if so I apologize for the redundancy.

I just noticed when installing wmcodec_update.exe a 'richvideocodec' folder is created in 'program files' with a single file--dllscan.dll. So that folder can be removed too.