Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

In a January 14, 2009 report, CSO Online said an unnamed Russian hacker left Microsoft a friendly message inside a variation of Win32/Zlob. The note praised the company’s response to threats and wished its staff a happy New Year. French security researcher S!Ri found the sample; the report did not establish that the message’s author created Zlob.

What did the message say?

CSO Online reproduced the note as: “Just want to say ‘Hello’ from Russia. You are really good guys. It was a surprise for me that Microsoft can respond on threats so fast,” followed by “Happy New Year, guys, and good luck!” The message appeared in a Win32/Zlob variation and was addressed to Microsoft. CSO Online’s January 14, 2009 report attributed it to an unnamed Russian hacker.

The report also recounted an earlier message, from the previous October: “I want to see your eyes the man from Windows Defender’s team.” It said French security researcher S!Ri found the newer note on a Friday, but does not establish an exact discovery date from that description.

How was the message connected to Zlob?

The report described a period Zlob scam in which a person was sent a link presented as an interesting video and then prompted to install a multimedia codec to watch it. The supposed codec was malicious software. This describes the historical lure in the 2009 account, not the current prevalence of the technique.

Free tools Windows power users keep installed

One-click scans. No signup required.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
#1 Best Overall
Sale
Norton 360 Deluxe 2027 Antivirus, 3 Devices, Auto-Renews [Download]
  • ONGOING PROTECTION Download instantly & install protection for 3 PCs, Macs, iOS or Android devices in minutes!
  • TOP-PERFORMING VPN Faster speeds, more server locations, and greater connection control to protect your privacy across all your devices, including Smart TVs.
  • ADVANCED SCAM PROTECTION Help spot hidden scams online. With the built-in Genie AI assistant, you’ll never wonder if a message or email is suspicious again.
  • REAL-TIME PROTECTION Advanced security protects against existing and emerging malware threats, including ransomware and viruses, and it won’t slow down your device performance.
  • DARK WEB MONITORING Identity thieves can buy or sell your information on websites and forums. We search the dark web and notify you should your information be found.

Finding a note in a sample labelled Win32/Zlob did not prove its author created the malware family. Joe Stewart, identified in the report as a SecureWorks researcher, cautioned that “Zlob is one of those things that gets mislabeled by AV companies a lot.” He explained that fake-codec prompts associated with multimedia files could lead to infections given the Zlob label. The report therefore supports a narrower conclusion: the message was found in a Zlob-labelled variation, while the author’s connection to the family remained uncertain.

What did Microsoft say?

CSO reported that Microsoft had not caught this sample before S!Ri found it. Microsoft spokesman Tareq Saade commented on the hacker’s claim that operations were ending: “It warms my heart that they’re ‘closing soon,’” he wrote in a blog post, as quoted by CSO.

Rank #2
Sale
McAfee Total Protection 2027 Antivirus Software for 3 Devices | Auto-Renews
  • THREAT DETECTION – Stay one step ahead. Suspicious links, risky sites, viruses, and scams, caught automatically before they reach you.
  • PERSONAL INFO PROTECTION – Keep your personal info safer. Identity monitoring watches for your exposed info and tells you what to do about it.
  • SECURE CONNECTIONS – Just a few easy clicks, and we'll automatically protect your info on public Wi‑Fi, every time you connect.
  • GUIDED ACTION – Know what matters and what to do next. Clear alerts and simple guidance make it easy to take action.
  • MORE THAN ANTIVIRUS – Scam protection, identity monitoring, VPN, web protection, and antivirus work together to protect you, all in one place.

Saade also addressed why a follow-up sample might escape notice: “Considering the enormous amount of malware we go through every day, it can be difficult to track follow up samples like this.” These statements are reproduced here as CSO quoted them; the original Microsoft blog post was not independently reviewed for this account.

Was the hacker really offered a Microsoft job?

The CSO report says the hacker claimed Microsoft had once offered him a job helping improve Windows Vista’s security. The report does not independently substantiate that claim, so it should not be treated as a confirmed offer or evidence of a relationship with Microsoft.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Rank #3
Sale
Norton 360 Deluxe 2027 Antivirus, 5 Devices, Auto-Renews [Download]
  • ONGOING PROTECTION Download instantly & install protection for 5 PCs, Macs, iOS or Android devices in minutes!
  • TOP-PERFORMING VPN Faster speeds, more server locations, and greater connection control to protect your privacy across all your devices, including Smart TVs.
  • ADVANCED SCAM PROTECTION Help spot hidden scams online. With the built-in Genie AI assistant, you’ll never wonder if a message or email is suspicious again.
  • REAL-TIME PROTECTION Advanced security protects against existing and emerging malware threats, including ransomware and viruses, and it won’t slow down your device performance.
  • DARK WEB MONITORING Identity thieves can buy or sell your information on websites and forums. We search the dark web and notify you should your information be found.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

What the 2009 report establishes—and what it does not

  • Reported observation: a message addressed to Microsoft was found in a Win32/Zlob variation, and S!Ri found the sample before Microsoft did.
  • Reported content: the note praised Microsoft’s response to threats and included a New Year greeting.
  • Unconfirmed attribution: the report did not prove the writer was Zlob’s creator.
  • Unverified personal claim: the supposed Windows Vista security job offer came from the hacker’s account.

The source is CSO Online / IDG News Service’s January 14, 2009 story, “Hacker Leaves Microsoft Trojan Message.” It is a historical news report, not a current malware warning.

Best Value
Sale
McAfee Total Protection 2027 Antivirus Software for 5 Devices | Auto-Renews
  • THREAT DETECTION – Stay one step ahead. Suspicious links, risky sites, viruses, and scams, caught automatically before they reach you.
  • PERSONAL INFO PROTECTION – Keep your personal info safer. Identity monitoring watches for your exposed info and tells you what to do about it.
  • SECURE CONNECTIONS – Just a few easy clicks, and we'll automatically protect your info on public Wi‑Fi, every time you connect.
  • GUIDED ACTION – Know what matters and what to do next. Clear alerts and simple guidance make it easy to take action.
  • MORE THAN ANTIVIRUS – Scam protection, identity monitoring, VPN, web protection, and antivirus work together to protect you, all in one place.
Rank #4
Bitdefender Total Security 2026 – Complete Antivirus and Internet Security Suite – 5 Devices | 1 Year Subscription | PC/Mac | Activation Code by Mail
  • SPEED-OPTIMIZED, CROSS-PLATFORM PROTECTION: World-class antivirus security and cyber protection for Windows (Windows 7 with Service Pack 1, Windows 8, Windows 8.1, Windows 10, and Windows 11), Mac OS (Yosemite 10.10 or later), iOS (11.2 or later), and Android (5.0 or later). Organize and keep your digital life safe from hackers
  • SAFE ONLINE BANKING: A unique, dedicated browser secures your online transactions; Our Total Security product also includes 200MB per day of our new and improved Bitdefender VPN
  • ADVANCED THREAT DEFENSE: Real-Time Data Protection, Multi-Layer Malware and Ransomware Protection, Social Network Protection, Game/Movie/Work Modes, Microphone Monitor, Webcam Protection, Anti-Tracker, Phishing, Fraud, and Spam Protection, File Shredder, Parental Controls, and more
  • ECO-FRIENDLY PACKAGING: Your product-specific code is printed on a card and shipped inside a protective cardboard sleeve. Simply open packaging and scratch off security ink on the card to reveal your activation code. No more bulky box or hard-to-recycle discs. PLEASE NOTE: Product packaging may vary from the images shown, however the product is the same.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.