Trojan:Win32/Zlo.BC is a downloader trojan that infiltrates Windows systems to retrieve and execute additional malicious payloads from remote command-and-control servers. First documented in the mid-2010s as part of the larger Zlo trojan family, this variant specializes in establishing a foothold on infected machines and then fetching secondary threats—typically information stealers, banking trojans, or ransomware—based on instructions from its operators. While detections have declined as security vendors improved signatures, variants of the Zlo family continue to circulate through software bundles, malicious email attachments, and compromised websites.
The primary danger with any downloader trojan is that the initial infection is just the beginning. Once Zlo.BC executes, you're no longer dealing with a single threat but potentially multiple malware families simultaneously active on your system. The trojan operates quietly in the background, making outbound connections that antivirus software may not immediately flag as suspicious, all while downloading executables that can steal passwords, encrypt your files, or turn your computer into a botnet node.
Threat Profile
| Attribute | Details |
|---|---|
| Threat Family | Zlo trojan-downloader family |
| Common Aliases | Trojan.Downloader.Zlo.BC, Win32/Zlo.BC, Downloader:Win32/Zlob, TR/Dldr.Zlob (variant-specific detection names) |
| Platform | Windows XP through Windows 11 (32-bit and 64-bit); primarily targets x86 systems |
| First Documented | Mid-2010s as part of ongoing Zlo/Zlob campaigns |
| Primary Distribution | Software bundles, fake codec installers, malicious email attachments, drive-by downloads from compromised sites |
| Persistence Mechanisms | Registry Run keys, scheduled tasks, Windows startup folders; may inject into legitimate processes |
| Core Capabilities | Download and execute secondary payloads, establish command-and-control communication, evade detection through process injection, modify system settings to reduce security posture |
| Typical Artifacts | Random-named executables in %APPDATA% or %LOCALAPPDATA% subdirectories, registry entries under HKCU/HKLM\Software\Microsoft\Windows\CurrentVersion\Run, scheduled tasks with GUID-like names |
| Network Behavior | HTTP/HTTPS connections to rotating C&C domains, often using hardcoded IP addresses as fallback; downloads additional executables disguised with double extensions or encoded payloads |
| Payload Types Downloaded | Banking trojans (Zeus/Zbot family variants), information stealers, adware bundles, ransomware (in targeted campaigns), cryptocurrency miners |
| Detection Evasion | Polymorphic code techniques, process hollowing into explorer.exe or svchost.exe, anti-VM checks, delayed execution timers |
| Removal Difficulty | Moderate to high; may reinstall itself from hidden copies, requires thorough registry cleaning and secondary payload identification |
How It Spreads
Trojan:Win32/Zlo.BC travels through multiple infection vectors, most of which rely on user interaction disguised as legitimate software or media. The most common scenario involves fake video codec installers—users attempt to play a video file downloaded from a sketchy site or opened from an email attachment, only to be told they need a "special codec" to view the content. The installer they download is actually Zlo.BC bundled with a minimal media player shell. Once executed, the trojan silently installs while displaying a fake progress bar or error message to maintain the illusion of a failed legitimate install.
Software bundling represents another major distribution channel. Free utility applications downloaded from third-party software repositories often include Zlo variants in their installer packages. The trojan may be presented as an "optional offer" with pre-checked acceptance boxes, or simply installed silently alongside the legitimate program. Users focused on installing the advertised tool rarely notice the additional components being deployed. Compromised websites also serve the trojan through drive-by download exploits targeting outdated browser plugins—particularly older versions of Flash, Java, and Silverlight—where simply visiting the page triggers an automatic download without any visible warning.
Email campaigns remain a reliable infection method, particularly those impersonating shipping notifications, invoice alerts, or system security warnings. These messages contain attachments that appear to be PDF documents or Word files but are actually executable files with double extensions (like "Invoice_2847.pdf.exe") or Office documents with malicious macros that download and execute Zlo.BC when enabled.
- Fake codec and media player installers from video streaming or download sites
- Software bundles from freeware repositories and torrent sites
- Malicious email attachments disguised as documents or compressed archives
- Drive-by downloads from compromised websites exploiting browser vulnerabilities
- Malvertising campaigns on legitimate sites that redirect through exploit kits
- Fake software updates claiming to be Flash, Java, or Windows security patches
- Pirated software installers and key generators for commercial applications
What It Does On Your Machine
Upon execution, Trojan:Win32/Zlo.BC immediately establishes persistence to ensure it survives system reboots. The trojan copies itself to a hidden subdirectory within your user profile—typically a folder with a GUID-like name under %LOCALAPPDATA%\—and creates registry entries that trigger its execution at every Windows startup. These entries appear in the standard Run and RunOnce keys, often using innocuous-sounding names like "System Update Service" or "Windows Security Module" to avoid suspicion during casual inspection. More sophisticated variants create scheduled tasks that execute the payload at irregular intervals, making it harder to identify through simple startup monitoring.
The trojan's core function begins once persistence is established: contacting its command-and-control infrastructure to receive instructions. Zlo.BC maintains a list of hardcoded domains and IP addresses it cycles through, attempting to establish an outbound connection via HTTP or HTTPS. These connections often mimic legitimate web traffic—using standard user agents and sometimes even routing through compromised legitimate websites acting as proxies—to evade network-level detection. Once communication succeeds, the trojan receives a configuration file that dictates which secondary payloads to download based on your system's characteristics, geographic location, and the current campaign priorities of its operators.
The downloaded payloads execute with the same privileges as the initial trojan, which in most cases means standard user permissions. However, if the original infection occurred through a process running with elevated privileges, all subsequent payloads inherit that access level. This is where the real damage begins—banking trojans start monitoring browser activity and keystrokes to capture credentials, information stealers scan your system for stored passwords and cryptocurrency wallets, or ransomware begins encrypting your personal files. The downloader itself typically remains active throughout, ready to fetch additional modules or updates as directed by its operators.
System performance degradation is common once multiple payloads are active. You may notice your computer running slower than usual, especially during startup or when launching applications. Internet connectivity might become sluggish as the malware maintains persistent connections and uploads stolen data. In some cases, users report browser redirections, unexpected pop-up advertisements, or new browser toolbars appearing—symptoms that indicate adware was among the downloaded payloads. The trojan may also modify Windows security settings, attempting to disable Windows Defender, block access to security-related websites, or prevent antivirus software from updating its definitions.
Manual Removal — Step by Step
Disconnect from All Networks Immediately
Unplug your Ethernet cable or disable Wi-Fi before proceeding. This prevents the trojan from downloading additional payloads, uploading stolen data, or receiving commands to activate destructive functions. If you're on a laptop, work on battery power to avoid any potential firmware-level persistence mechanisms that might activate during shutdown.
Boot Into Safe Mode with Networking
Restart your computer and repeatedly press F8 (or Shift+F8 on newer systems) during boot to access the Advanced Boot Options menu. Select "Safe Mode with Networking" to load Windows with minimal drivers and startup programs, which prevents most malware—including Zlo.BC—from executing automatically. On Windows 10/11, you may need to access Safe Mode through Settings > Update & Security > Recovery > Advanced startup.
Open Task Manager and Identify Suspicious Processes
Press Ctrl+Shift+Esc to launch Task Manager. Switch to the Details tab and sort by CPU or memory usage. Look for processes with random names, executables running from AppData folders, or unfamiliar entries consuming resources. Right-click suspicious processes, select "Open file location," then note the full path before ending the task. Zlo.BC often appears as a random alphanumeric executable or uses names mimicking legitimate Windows services but running from user directories.
Remove Registry Persistence Entries
Press Win+R, type "regedit", and press Enter to open the Registry Editor. Navigate to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run and HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run. Look for entries with suspicious names or paths pointing to AppData directories. Right-click and delete any entries associated with the file paths you identified in Task Manager. Also check the RunOnce keys in the same locations and delete similar suspicious entries.
Delete Scheduled Tasks Created by the Trojan
Press Win+R, type "taskschd.msc", and press Enter to open Task Scheduler. Expand Task Scheduler Library and navigate through the Microsoft\Windows subfolder. Look for tasks with GUID-like names, generic descriptions, or actions pointing to executables in AppData folders. Right-click suspicious tasks and select Delete. Pay particular attention to tasks set to run at user logon or at regular intervals throughout the day.
Delete the Trojan's Files and Folders
Open File Explorer and navigate to the locations you noted earlier. Common paths include %LOCALAPPDATA% subfolders with GUID names and %TEMP% directory. Delete the entire folder containing the trojan executable. If Windows reports the file is in use, you may have missed a running process—return to Task Manager to ensure you've ended all related processes. Also check your Startup folder at C:\Users\[YourUsername]\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup and remove any suspicious shortcuts.
Run Malwarebytes and a Full System Scan
Download and install Malwarebytes Free (from malwarebytes.com—verify the URL carefully). Update its definitions, then run a full system scan. Malwarebytes specializes in detecting trojan-downloaders and will typically catch any remaining components, secondary payloads, or rootkit elements that manual removal missed. Quarantine all detected threats and allow the software to remove them. This step is critical because Zlo.BC often downloads multiple additional threats that have their own persistence mechanisms.
Reset Browser Settings If Symptoms Persist
If you're experiencing browser redirects, unwanted toolbars, or changed search engines, reset your browsers to default settings. In Chrome, go to Settings > Advanced > Reset and clean up > Restore settings to their original defaults. In Firefox, type "about:support" in the address bar and click "Refresh Firefox". In Edge, go to Settings > Reset settings > Restore settings to their default values. This removes any malicious extensions or modified settings left by downloaded adware components.
Change All Important Passwords
If any information-stealing payload ran on your system, assume your stored credentials are compromised. After confirming the infection is removed, change passwords for your email, banking, social media, and any other critical accounts. Do this from a known-clean device if possible. Enable two-factor authentication wherever available to add an extra security layer even if passwords are compromised in the future.
Reboot Normally and Monitor System Behavior
Restart your computer into normal mode and reconnect to the internet. Monitor your system's behavior over the next few days—watch Task Manager for unexpected processes, check your startup programs list (Ctrl+Shift+Esc > Startup tab), and verify your browser behavior is normal. Run a follow-up scan with both Malwarebytes and Windows Defender to confirm the system remains clean. If symptoms return, the infection may have rootkit-level persistence that requires professional removal.
Prevention
- Never download software from unfamiliar websites or third-party repositories. Obtain applications directly from the official vendor's website or Microsoft Store. Torrent sites, freeware archives, and software download aggregators frequently bundle malware with legitimate installers.
- Keep Windows and all applications updated with the latest security patches. Enable automatic updates for Windows, your browsers, and plugins. Many trojan-downloaders exploit known vulnerabilities in outdated software—patching eliminates these attack vectors before they can be leveraged.
- Treat email attachments from unknown senders with extreme suspicion. Never open unexpected attachments, even if they appear to come from legitimate companies. Verify the sender's address carefully (hovering over the "from" field often reveals spoofed addresses), and when in doubt, contact the supposed sender through a separate communication channel to confirm legitimacy.
- Use a reputable antivirus solution and keep it updated. Windows Defender is adequate for most users if kept current, but consider supplementing with Malwarebytes for periodic scans. Ensure real-time protection is enabled and that your security software updates its definitions daily.
- Disable macros in Office documents unless absolutely necessary. Configure Word, Excel, and other Office applications to disable macros by default and only enable them for documents from verified sources that you specifically need to use macros. Many trojan-downloaders spread through macro-enabled documents that execute malicious code when opened.
- Pay attention during software installations and decline bundled offers. Always choose "Custom" or "Advanced" installation options rather than "Express" or "Recommended". Read each screen carefully and uncheck boxes offering to install additional software, browser toolbars, or change your homepage and search settings.
- Use a standard user account for daily activities rather than an administrator account. Running as a non-admin limits the damage malware can do to system-level files and settings. Create a separate admin account for software installation and maintenance tasks, but use a standard account for web browsing, email, and general work.
- Implement network-level filtering if you run a small business. DNS-based filtering services can block access to known malicious domains that trojans use for command-and-control communication. This provides an additional layer of protection beyond endpoint security solutions.
Bring It In
Trojan-downloaders like Zlo.BC represent a particularly frustrating category of infection because the initial threat is just the delivery mechanism—you're often dealing with multiple distinct malware families by the time symptoms become noticeable. Manual removal can miss secondary payloads or overlook rootkit-level persistence that allows reinfection even after the obvious components are removed. If you've followed the manual steps above and still experience symptoms, or if you're not comfortable editing the registry and hunting through system directories, professional removal is the right call.
Computer Repair Roswell handles trojan-downloader infections daily in our Roswell shop. We use multiple commercial-grade scanning tools in combination, manually verify system integrity, and check for the secondary payloads that typically accompany these infections. Most malware removals are completed same-day, and we'll walk you through exactly what we found and how to avoid reinfection. Call us at (770) 787-9540 or stop by 1000 Woodstock Rd, Roswell, GA 30075. We're open Monday through Friday and can usually accommodate walk-ins, though calling ahead ensures we have a tech ready when you arrive.