Home » Unwanted Programs » Trojan-Downloader.Zlob.Media-Codec

Trojan-Downloader.Zlob.Media-Codec

27 August 2006

Trojan-Downloader.Zlob.Media-Codec disguises as required upgrade software for Windows Media Player to be able to view adult videos online. It contains malicious codes that downloads a variant of Trojan.Zlob which is the culprit for Rogue Antispyware Programs such as SpywareQuake, SpyFalcon Winfixer and others.

Risk Level: Medium

File Size: Varies

Affected System: Windows

Common Symptoms:
1. Presence of the following files:

  • %program_files%intcodeciesplugin.dll
  • %program_files%IntCodeciesuninst.exe
  • %program_files%IntCodecisaddon.dll
  • %program_files%IntCodecisamini.exe
  • %program_files%IntCodecisamonitor.exe
  • %program_files%IntCodecisauninst.exe
  • %program_files%IntCodecpmmon.exe
  • %program_files%intcodecpmsngr.exe
  • %program_files%IntCodecpmuninst.exe

Related posts:

  1. Trojan.Zlob Downloader Information and Removal

      Trojan.Zlob is a downloader trojan that acquire a malicious file from a remote computer and executes it on an infected...

  2. Trojan.Zlob.J Removal Blogs

    Overview: Trojan.Zlob.J is a back door Trojan that allows the remote attacker to perform various malicious actions on the compromised computer....

  3. Trojan.Zlob.K

    Trojan.Zlob.K is a Trojan horse that may download and execute remote files and redirect Internet Explorer home page and search page...

77 Comments »

  • 1 }
    webmaster (author) said:

    Please follow the removal procedure using SmitFraudFix.

    27 August 2006 at 10:17 am
  • 2 }
    Penny Brown said:

    Thank you Thank you!

    29 September 2006 at 3:21 am
  • 3 }
    L. Williams said:

    Worked great…thank you.

    7 October 2006 at 4:21 pm
  • 4 }
    T said:

    Spot on thankyou

    8 October 2006 at 1:05 am
  • 5 }
    Ronnie-D said:

    OMG! Pure Magic! Thanks so much!

    10 October 2006 at 3:37 am
  • 6 }
    F.S. said:

    That was great! You rock! Thanks for your expertise.

    11 October 2006 at 1:25 am
  • 7 }
    Robert Nikolic said:

    You are a genius!!
    My MEDIA CODECS were gone in seconds … not only that, my whole (win xp) system works much smoother.
    Thank you!
    People, use this and save yourselves!

    ps: have tried many anti spyware removal tools – none worked.
    Thank you again!

    14 October 2006 at 8:12 pm
  • 8 }
    Mac said:

    FLAWLESS!!! Things like this are what save you from your worst day ever! Thank you so much!

    16 October 2006 at 8:35 am
  • 9 }
    Jay said:

    THANKS!!!!

    PEOPLE, IT WORKS!!!

    16 October 2006 at 2:48 pm
  • 10 }
    Chigo said:

    thanks alot!!!!!

    16 October 2006 at 3:49 pm
  • 11 }
    joe said:

    This worked great!! Thank you for posting this, it saved me a lot of trouble.
    Thanks again!!!

    17 October 2006 at 3:33 am
  • 12 }
    Gregory said:

    WOW!!!!! It really works. I mean i spend four days without sleeping trying to get this spy out of my friend’s laptop that i borrowed and i couldn’t get it out. I tried everything and i mean EVERYTHING but nothing works. THANKS MAN, THANKS A LOT. If you have any problems with spyware or virus there are really good people out there that can help you. I should’ve known that earlier but now i do…. THANKS AGAIN.

    22 October 2006 at 2:43 am
  • 13 }
    Kevin said:

    Thank you very much for the advice.
    Worked exactly as described.
    Truly appreciated.

    25 October 2006 at 12:49 pm
  • 14 }
    Charlie said:

    I am a complete n00b when it comes to pc’s but this thing has got on my boyfriens laptop and i cant remove pmmon and pmsngr, i’m pretty sure he has windows vista installed so i dunno how to disable system restore or reboot in safe mode.
    Sorry but im extremely thick, can any one help me :(

    25 October 2006 at 3:39 pm
  • 15 }
    Ahmad said:

    Thank you very much. After struggling to get this out for the past 4 days, your meassage was the a big relief.

    Keep up the good work. Truly appreicate!!

    Regards,
    Ahmad.

    1 November 2006 at 3:33 am
  • 16 }
    ann arbor man said:

    wow,. its like 7am and i was up all night trying to fix this spyware crap. im a totaly computer idiot and this site helped me fix my computer. thank you so much, you are awesome!!!! and its freee!!!

    4 November 2006 at 11:48 am
  • 17 }
    Petra said:

    Thanks, thanks, thanks, for 3 days I was looking for a solution, and I find it here.

    Thanks

    4 November 2006 at 10:27 pm
  • 18 }
    Julian Scott said:

    Thank Thank you this was just what the doctor needed. I can not thank you enough!

    7 November 2006 at 6:39 am
  • 19 }
    Marty Burnett said:

    Maaaan, this did the trick! I just followed the directions and the software did the rest!

    THANKS!!!
    Marty

    9 November 2006 at 12:20 am
  • 20 }
    Andy B said:

    Cheers 4 setting up the software removal good work

    9 November 2006 at 5:10 pm
  • 21 }
    anna said:

    thxxxx… a lot.it really worked.!!!!!!!:))))

    11 November 2006 at 12:06 pm
  • 22 }
    mannn said:

    thnks !!!!! it works !!!!!

    11 November 2006 at 5:40 pm
  • 23 }
    thrawn said:

    Great !
    This tool rockz.
    Thank you guys you helped me really out !
    It´s bad to download stuff from andr.net when you´re tired because of this I got that shit, norton and so on weren´t able to remove it but your tool rocked this malware !

    14 November 2006 at 2:07 am
  • 24 }
    McNasty said:

    This really worked, I can not believe it but it got that little pest off my PC. Thank You so much!!!!!!!

    16 November 2006 at 2:45 am
  • 25 }
    NickU said:

    Wow worked like a charm. Thanks.

    17 November 2006 at 4:00 am
  • 26 }
    dr.jaul said:

    well I guess I get to be the first unsatisfied post. it didnt work for me. chances are I did something wrong tho. I am hesitant to turn off mcafee for fear that the virus will quickly rape my system. any suggestions will be appreciated. email “dr.jaul@yahoo.com”

    27 November 2006 at 6:19 pm
  • 27 }
    webmaster (author) said:

    Dr. Jaul, I guess you may have to do it the long way. Post your HJT logs on security forums such as BleepingComputer, ForumsTechGuy and so on… They have security experts that can analyze the problems on your computer and can give you solutions for free.

    1 December 2006 at 5:29 pm
  • 28 }
    IAN said:

    I would like to have your babies…which is not biologically possible but an indication of my gratitude for ridding my laptop of that bastard spyware.

    All that was left behind were a few Cookies, summarily dispatched.

    Was unsure about downlodaing from your site for fear of even more shite infecting it but none arrived. You have restored my faith in the ‘web’ community.

    Thanks so much.

    Ian

    5 December 2006 at 2:26 pm
  • 29 }
    Stacey said:

    when you say Extract all the files to your Desktop, it will create a folder SmitfraudFix do you mean like all the files from the folder you downloaded SmitfraudFix to or just extract the SmitfraudFix file?

    6 December 2006 at 10:56 pm
  • 30 }
    had enough said:

    when i go into safe mode my keyboard is disabled and i cannot type anything

    22 December 2006 at 12:24 am
  • 31 }
    linn said:

    Wow THANX ALOT IT WORKED! Alot of relief of my back, good ridance with you :) we need more of these sites.

    30 December 2006 at 3:12 am
  • 32 }
    matty said:

    AMAZING! I HAVE MY COMPUTER BACK!!
    I have run several scans of my antispyware, and neither that nor Nortan has done anything. This however, was great advice. Thanks again!

    30 December 2006 at 7:40 am
  • 33 }
    kristin k said:

    TRY THIS EASIER METHOD FIRST…my PC was infected by the Trojan virus and neither Spysweeper or Norton could remove it; so i restored my computer (windows xp) from the day before i was infected and the virus is gone now. i did not have to go through all those steps. i did back up the data from the two days that i had had the virus as those were lost in the restore but it worked and was really easy!

    19 February 2007 at 9:08 pm
  • 34 }
    George said:

    l spent hours trying to remove it with all
    the named antivirus and spyware with no luck.
    Impressed and relieved

    THANK YOU VERY MUCH.

    George

    22 February 2007 at 12:28 pm
  • 35 }
    Megan said:

    I thought it worked greatbecause I wasn’t seeing the trojan messages pop up, but then when I ran my webroot as a final scan, it detected it again. What do I do??

    24 February 2007 at 6:12 pm
  • 36 }
    Mike said:

    WOW…This site has become my #1 source for information and assistance. Worked GREAT, just as described!

    24 February 2007 at 10:01 pm
  • 37 }
    webmaster (author) said:

    Megan,

    Please make sure you followed the instructions carefully just like what others did.

    25 February 2007 at 8:27 am
  • 38 }
    Alicia said:

    Thank you sooooo much. This was a lifesaver. Tried to fix it for 5 days before I found this site. Thank God there are people out there like you guys! After I followed the instructions and the sypware was removed I had no Internet access though. Either the spyware or the solution had deleted all of the connections. After reestablishing them, the Norton firewall has to be disabled but everything works! Any suggestions?

    10 March 2007 at 8:26 pm
  • 39 }
    Chrissy said:

    GOD BLESS YOU! It worked!

    26 March 2007 at 6:19 pm
  • 40 }
    crossover809 said:

    it said process.exe file was missing and hwne i clicked on the cmd part of the folder, nothing happened

    1 April 2007 at 5:30 pm
  • 41 }
    Anjana said:

    Thank You Very Much!!

    This programme works like a charm!!!
    I am gratefull, Thank you very very very Much!!
    IT WORKS!!!!!!

    As Always,
    Anjana

    21 April 2007 at 8:11 pm
  • 42 }
    Jeremy said:

    I used this product and my windows XP is running much faster but i still get little bubbles with this spylock program download in the bottom right are you sure this download fixes Trojan.Zlob.N?

    15 May 2007 at 2:04 am
  • 43 }
    vladimir said:

    hi..i have been infected with…win32/trojan.downloader.Ani.Gen trojan…how can i rid of that damn virus…thanx in advance

    24 May 2007 at 8:31 pm
  • 44 }
    Sorted said:

    Thanks a lot Webmaster! You’ve saved me hours of looking for all the individual reg entries and files.

    28 June 2007 at 7:27 am
  • 45 }
    AZ said:

    Thanks a lot it really makes the difference, you know what youre taking about you rock man!! really helped to clean up the registry also runned xoftspy 4.24 to check all out and system is free of the threat.

    29 June 2007 at 8:37 pm
  • 46 }
    RA said:

    Thank You! I don’t know what I would have done if I didn’t find you. Your instructions were simple and clear.

    9 July 2007 at 12:22 am
  • 47 }
    Amol Patil said:

    Dude ur a genius…ur my heroooo!

    10 July 2007 at 1:24 pm
  • 48 }
    Henrik said:

    I only get to point number in this process. After reboot I need to sign in and the computer doesn’t accept my password… Anyway to get around this??? I can’t even get in to my computer!

    I noticed, before I found this site and these recommendations, that no password seemed to work. Does this trojan hi-jack my passwords as well??

    I just need to get in to the computer so I can finish the rest of the steps. Help please!

    11 July 2007 at 1:07 pm
  • 49 }
    webmaster (author) said:

    Henrik, I havent know of any issue that this Trojan can changed passwords on computer. If you are using winxp or 2000 you may download WinNT2k Boot to reset the password.

    13 July 2007 at 2:54 am
  • 50 }
    Brett said:

    Yep..works a treat, Mcafee had a coronary when I was installing so best to do as suggested and disable the antivirus before hand.

    Worked as described and whole process took under 5 minutes to rectify.

    15 July 2007 at 9:04 am
  • 51 }
    John D said:

    You are an angel! Amazing it works! You need to start a business for this – you will make millions!

    19 July 2007 at 3:11 am
  • 52 }
    DOC said:

    Thanks dude :-)

    14 August 2007 at 4:24 pm
  • 53 }
    zammil said:

    it is very useful to us

    27 August 2007 at 3:17 pm
  • 54 }
    Jonathan Patel said:

    Hi I have got two user accounts on my pc, both are administrator accounts, I opened a spam mail like a monkey and when Mcafee asked me if I wanted to block or allow the program like a monkey I pressed allow, I did all the 9 steps and the shield symbol near the clock (opened up popups whenever you click on it) disappeared. However when I open a browser page the pop ups still come up, please someone help!

    7 September 2007 at 1:25 pm
  • 55 }
    gzio said:

    Perfect!! Glad I found your fix. Worked great. Wasted many hours screwing around. Many, Many Thanks

    16 November 2007 at 4:23 pm
  • 56 }
    John Milliard said:

    I had a very pesky zlob trojan-tried everything on the internet-nothing-still there—until I followed your instructions-so far so good-finally someone out there that knows what ther’re doing-novel concept.

    22 November 2007 at 6:52 pm
  • 57 }
    Kit said:

    That is amazing, my PC is healthy again, thanks for the great post!!!

    23 November 2007 at 8:59 am
  • 58 }
    Paul said:

    I followed the instructions and thought I had removed the Zlob. Unfortunately, it’s back. I never got the prompt (#8): “It will check if your wininet.dll file is damaged, if so it will ask you to Replace Infected File? Press Y as Yes and hit Enter”.

    Am I doing something wrong? Is there an updated version of this @##!trojan.

    Thanks

    24 January 2008 at 4:01 pm
  • 59 }
    Keisha said:

    Thanks so much for this amazing tool!! It worked perfectly after spending an afternoon trying just about everything else :) Much appreciated

    21 February 2008 at 9:32 pm
  • 60 }
    alaskaboy said:

    dude, i did all of the instructions, but like some others, i never got the prompt (#9)
    “This tool will also check if your wininet.dll is infected and will prompt:
    Replace infected file? Press Y and then Enter to replace you wininet.dll with the clean version.”
    can you post back please?

    3 April 2008 at 6:22 pm
  • 61 }
    alaskaboy said:

    W00T!!!!!!!!
    i did what Kristen said and it works like before!!!!!! YEAHHHHH!!!!!!!

    3 April 2008 at 6:43 pm
  • 62 }
    Nick said:

    THANKS!!! WORKS PERFECTLY!

    17 July 2008 at 12:21 am
  • 63 }
    Jimmy Hsu said:

    My PC was hot by the Malware, Virus Remover 2008 two days ago. Faked virus alerts kept popping up everywhere. I managed to kill the virus by running SmitFraud Fix and SDFix in Win Safe Mode. No more faked alerts.

    However, when I clicked My Computer, I see only the D, E and F and G drive icons. I cannot see the C drive icon at all. I ran SMitFraud Fix , AVG 2008, XSoft, etc again in Safe Mode. But nothing works.

    I am on Win XP, with hard drives C, D, F and G.

    30 July 2008 at 8:47 am
  • 64 }
    Jack said:

    I am now infected with Mediacodec Zolb Trojan and this has hijacked the computer in a way that and I can’t open the XP in safe mode or even run most of the programs. The antivirus programs such as smithfraudfix and Stopzilla can’t be executed and are seen as Virus I would appreciate any comments or suggestions.
    Thanks.
    Jack

    1 August 2008 at 2:07 am
  • 65 }
    Bert said:

    Thank-you very very much …

    After few days (In Safe mode or not) of McAfee Full Scan (Fully Equiped) , Spy Sweeper and Spyware Doc They have all detected the “trojan-downloader-zlob”, but none of them could remove it as you did. What’s funny, is that all threat you as a none secure download !!!

    7 September 2008 at 5:00 pm
  • 66 }
    Pakorn said:

    I have tried to remove them for a whole week. Using many antivirus program, it doesn’t work. When I follow your instruction, It very nice , I get my computer back agian.

    19 September 2008 at 1:37 pm
  • 67 }
    gray said:

    Saved the day!! I tried so many other solutions. None worked, but yours really fixed my problem.

    18 November 2008 at 3:19 am
  • 68 }
    johnny said:

    TxijZP Thanks for good post

    31 December 2008 at 7:45 am
  • 69 }
    bilgin manisa soma said:

    uLEyxQ bilgin manisa soma Because the drug has the opposite effects of cannabinoid receptor agonists such as tetrahydrocannabinol (THC, one of the substances found in marijuana), which is neuroprotective against excitotoxicity, it can be theorized that Rimonabant promotes the development of neurodegenerative diseases of the central nervous system such as Multiple sclerosis, Alzheimer’s disease, Amyotrophic lateral sclerosis (ALS), Parkinson’s disease, and Huntington’s disease in persons that are susceptible.

    23 January 2009 at 3:31 pm
  • 70 }
    aura soma metatron said:

    SDvE4e aura soma metatron

    24 January 2009 at 11:20 am
  • 71 }
    BJBabyPenn said:

    Hello!! How is everyone doing? I am a new member and I would like to introduce myself. My name Is BJ Penn and I am from Mdison USA.

    That is all for now. I am eager to interact with everyone one this forum!

    2 February 2009 at 1:44 pm
  • 72 }
    downlodafas said:

    Sorry, but i have a question. Where can i find games and download it for free?
    Thanx for answers.

    5 March 2009 at 6:10 am
  • 73 }
    Joe90isBack said:

    I tried the system restore first and this seemed to work, after that I tried the SmitFraudFix, and the report suggested that some files still needed cleaning but most were not infected.

    Thank you so much, A headache now gone. I feel a lot less angry.

    24 March 2009 at 12:25 am
  • 74 }
    vista said:

    are there any newer versions of smitfraud that can work with Vista? if so can you e-mail link to me @
    vn13azooka@yahoo.com

    9 August 2009 at 5:52 am
  • 75 }
    leveliker said:

    Всем привет!
    Программа HACSoft PM-Bot, предназначена для массовой рассылки персональных сообщений по форумам.
    описание:
    1. Работает со многими типами форумов: ExBB, IPB1, IPB2, IPB2 MR, miniBB, phpBB2, PunBB, vBulletin2, vBulletin 3(по 5 сообщений за раз), vBulletin3 MR(по 5 сообщений за раз)
    2. Форумы описываются в специальных драйверах, т.е. при желании софт можно настроить и на другие форумы.
    3. Отсылка от нескольких юзеров одновременно (обход антифлуда).
    4. Работа через прокси-сервер.
    5. И многое другое…

    Программа обновилась до версии 1.6, не поддавайтесь на уловки мошенников со взломанной, устаревшей и не работающей версией программы.
    Цена 4500 руб. Возможно покупка через гаранта.
    Контакты: icq 574444591
    Жду всех а аське.

    12 December 2009 at 2:05 am
  • 76 }
    jesegeary said:

    Уважаемые читатели. С Рождеством христовым хочется вас поздравить. Админу сайта отдельное пожелание-побольше читателей на блоге, креативных интересных статей и всего всего всего :)

    9 January 2010 at 2:02 pm
  • 77 }
    jesegeary said:

    Хороший сайт. Так держать!!!

    10 January 2010 at 5:11 pm

Leave your response!

Add your comment below or subscribe to these comments via RSS.
Be nice. Keep it clean. Stay on topic. No spam.