It may come in an email asking you to check out a movie file or it may seek to push its way to your computer from malicious websites. In both cases a 'codec' will be offered in the guise of helping you watch a streaming video, but instead of showing the movie it will install a stealthy Trojan Downloader in your computer. That is Zlob Trojan.

Security experts at MicroWorld Technologies warn that a new Zlob variant named Zlob.fes is spreading among unsuspecting computer users. When a user visits certain websites, a harmful code named 'Trojan.HTML.Agent.e' is downloaded without the user's knowledge. This file prompts an error message that says the browser has encountered an Active-X error and needs to download a codec to play a video file.

When a user clicks on 'Yes' button and proceeds to download the codec, a License Agreement is displayed to make him believe that the program is authentic. The name of the downloaded file is 'VideoAccessCodecInstall.exe', which in fact is Zlob.fes. Once inside the computer, Zlob.fes downloads many other kinds of malware.

"Codec is a program used to encode or decode video clips so that large files can be downloaded faster," explained Vikas Vishwasrao, Assistant Manager R&D, MicroWorld. "Most web users are familiar with codec and naturally some wouldn't think twice before clicking on the 'yes' button to download it. Since the Trojan shows no sign of its presence in the infected computer, a victim may never know about the infection till the time the computer screen gets all filled up with annoying pop-ups.

The first Zlob appeared in year 2005 and keeping pace with the Web2.0 phenomenon, the Trojan Downloader has migrated into Social Networking and Video sharing websites. The user posted content in these sites offer perfect opportunities for malware authors to upload harmful files and lure victims into downloading them.

Many Zlob variants are seen bringing in a range of malware like Spyware, Adware, Rogue-AntiSpyware, Rogue-AntiVirus, Backdoor, Bots, Rootkits and more to compromised machines. A computer infected with a Zlob is thus exposed to a chain of many more online threats.

MicroWorld's AntiVirus, AntiSpam and Content Security software eScan provides protection against all spreading routines of Zlob family, the company release claimed. The email route is checked as it scans and cleans all incoming mails. Browser vulnerabilities are guarded against as the software plugs those loopholes. It can block HTML agents like the one used in the case of Zlob.fes, as well as detect the malware on the fly during manual download.