The Zlob Trojan, also known as Trojan.Zlob, is a trojan horse which masquerades as a needed video codec in the form of ActiveX to view pornographic movies. It was first detected in late 2005. However, it wasn't until mid-2006 that it starting gaining attention. Once installed, it displays popup ads with appearance similar to real Microsoft Windows warning popups, informing the user that their computer is infected with spyware. Clicking these popups trigger the download of a fake anti-spyware program in which the trojan horse is hidden.

According to F-Secure, a computer security firm, they have discovered 32 variants of this trojan. Some variants of the Zlob family, like the so-called DNSChanger, adds rogue DNS name servers to the Registry of Windows-based computers and network settings of Macintosh computers and therefore could potentially re-route traffic from legitimate web sites to other suspicious web sites.

PHSDL - Project Honeypot Spam Domains List tracks and catalogues Zlob spam Domains. Most of the domains on the list are redirects to porn sites that show a number of inline videos. Clicking on the video to play activates a request to download an ActiveX codec which is malware. It prevents the user from closing the browser in the usual manner. Other variants of Zlob Trojan installation are in the form of computer scan that comes as a Java cab..

The Zlob Team of computer crackers automatically submit forum comments with the use of automated script program like Xrumer creating forum spam If the links are clicked, the Zlob trojan will force itself into installation. These are typically in the form of medicine and pornography promoting but recently have included URLs to flower shops and glasses stores.