Spyware and Virus got you down? Well, I mean - got your computer down? Look no further.....
Search For Spyware and Virus Related Help

Thursday, March 08, 2007

How To Remove: Trojan Downloader Zlob.Media-Codec

How To Remove:
Trojan Downloader Zlob.Media-Codec


Overview: Trojan-Downloader.Zlob.Media-Codec disguises as required upgrade software for Windows Media Player to be able to view adult videos online. It contains malicious codes that downloads a variant of Trojan.Zlob which is the culprit for Rogue Antispyware Programs such as SpywareQuake, SpyFalcon Winfixer and others.

Category: Malware/Adware

Related Files and Process:
  • %program_files%\intcodec\iesplugin.dll
  • %program_files%\IntCodec\iesuninst.exe
  • %program_files%\IntCodec\isaddon.dll
  • %program_files%\IntCodec\isamini.exe
  • %program_files%\IntCodec\isamonitor.exe
  • %program_files%\IntCodec\isauninst.exe
  • %program_files%\IntCodec\pmmon.exe
  • %program_files%\intcodec\pmsngr.exe
  • %program_files%\IntCodec\pmuninst.exe
  1. Download SmitfraudFix and save it to a desired location. This will be in ZIP File.
  2. Extract all the files to your Desktop, it will create a folder SmitfraudFix.


    Note: When extracting or executing, some files might be detected as Potential Threat or Harmful Script. Please disable AntiVirus or Any Script Blocking Software temporarily. It may harm or make the Fix incomplete.
  3. Temporarily disable System Restore (WinME and Windows XP) [how?]
  4. Reboot your computer in SafeMode [how?]
  5. Browse the folder SmitfraudFix on your Desktop and double-click on smitfraudfix.cmd
  6. “Enter your Choice: (1,2,3,4,L,Q):” Press no. 2 to clean to the infections.
  7. Wait for the process to finish.
  8. If prompted for: Registry cleaning - Do you want to clean the registry? Press Y, as Yes
  9. It will check if your wininet.dll file is damaged, if so it will ask you to Replace Infected File? Press Y as Yes and hit Enter.
  10. In order to make sure that Adware is completely eliminated from your computer, carry out a full scan of your computer using AntiVirus and Antispyware Software. Another way to detect the virus using various Scanner Program without the need to install can be done with Free Online Virus Scanner.
http://www.vermontpcsolutions.com

6 comments:

Unknown said...

My dear Michael ....
i have been infected with that zlob virus for four or five days !! . I had a couple *'puter experts* in here telling me ( after hours of screwing around ) tell me i needed to just reformat the hard-drive . Last nite at like 2 or 3 in the morning , out of desperation , i googled *zlob virus* and up you popped . Read your stuff and I figured even I , could MAYBE do what you suggested . Did it and for the last 2-3 hours since....I am back up and running like normal !!!...I thank you , I thank you and you are now part of my *favorites* tab . Dammm , now ,i just hope some friend or family member gets this virus , so's i can show'em just how good i am !! LOLOL . YOU DA MAN MICHAEL !!!...
thanks again buddy....
larry in hamilton , ontario , canada .

Unknown said...

Hi again Michael....
My 'puter is still up and running well after doing your zlob fix . However , my roxio cd creator 5.0 platinum ( upgraded to 5.3.2.24 ) wont work now . I love this simple easy to use program and miss it badly already . Yes Michael I know you seem to deal with only virus but if you could help me out , i'd be forever thankful !!! . The install disk runs fine...installs and sets up but when i click to use it ...a window saying **cd creator engine cdr24 won't load **.....any chance you can spare me a hint or two as to what to do ?....god , don't tell me to use nero ....
thanks again from ontario canada...........cheers.....larry

Unknown said...

Hi Larry,

Have you tried removing roxio completely via the Control Panel and then reinstalling?

Unknown said...

hi michael....yes i did....apparently roxio leaves about 30 diff files behind when it is deleted.....there is a patch out there that will remove them , but , i can't find it . My trouble started when i lost my trusty roxio 5 platinum ...i couldn't get the driver for it anymore , so i went and got a retail *roxio 8 suite *.....half works and half don't. It was told to me because of the remaining files from 5 , 8 will never work right till they are totaly removed from 'puter . All i really want is my roxio 5 back lol...simple and easy to work and i have the disk / key ..everything...just no driver !! . Anyways.....if you have a idea,,,,i'm listening.....thanks again friend and have a great one eh ?.....larry

Some0ne said...

I have a question I got infected but instead I used AVG to scan I found the file but I use Windows XP so it wasn't Winnet.dll and AVG removed it to virus vault am I still infected or not?and the safe mode turning off shutdown my computer instantly.

Michael said...

If starting your computer in Safe Mode is causing your computer to "shutdown instantly"... it sounds like you might still have a problem. You might want to try scanning again with AVG, it would be best if you could scan with AVG while in Safe Mode but it sounds like this is not an option.

You could always install another free anti-virus product, or try an online scan to see if any other infections turn up..take a look at this page..http://www.vermontpcsolutions.com/antivirus-software.html - there are many free options.