Possible Browser Hijack: czgmr.dll

[Amy Michel]

In the last week I had been experiencing extreme slowness in loading and
using Microsoft Internet Explorer (but not Netscape or Firefox) on my WinXP
SP2 machine. In particular, when I would visit certain sites it would
re-direct me automatically. In particular, when I would type in
www.bestbuy.com my browser would "think" for a bit and then re-direct me to
www.buy.com. Other websites would send me places that I was not intending
on going after I typed in a URL.

I have Norton Anti-Virus running all the time and performed the advaced
scan, ran the usual Ad-Aware, Spy Bot, HijackThis, and Microsoft's Beta
Anti-Spyware app in my attempt to try an find some sort of
virus/trojan/browser hijacker/etc. running. It found a few tracking cookies
for ad-related websites, but nothing major. I got rid of the cookies, went
so far as re-starting my machine, opened up IE again, and the exact same
problem happened.

Uggh! I took at look through my registry to see if there were things loaded
in software/microsoft/etc. that would be cause for alarm but I did not find
anything. Further analysis of HijackThis log files made while I was running
different apps (running IE, Netscape, Firefox, Outlook, AIM, etc.) did not
show any files out of the ordinary.

Then I thought about when my computer started acting this way. So I simply
performed a file search (including hidden files) of all files changed in the
timeframe I felt my machine starting having issues.

Going through that list I found the issue.

I found the following files loaded onto my machine, actually in multiple
places with timestamps all within a minute of each other:
- czgmr.dll
- czgmra.xml
- czgmre.xml

When I opened the XML file it appeared to be compiled code of sorts as it
was not the usual XML format that could easily be read. It's timestamep
changed each time I loaded IE for the first time after a reboot of Windows.

Upon a Safe Mode restart, I pulled the files named above and put them in the
Trash, and everything is now working normally.

It was quite strange that no virus/ad/spyware scan that I performed found
any of these files and I cannot seem to find any references to these files
when I Google them.

Has anyone else seen this issue on their machines or know anything more
about the files I listed?

 

[Bill Sanderson]

Please hold on to these crtters, they may be of use to researchers.
Names are sometimes not useful guides--some bugs use randomly constructed
names.

It'd be nice to submit all three files to these multi-vendor antivirus
scanners:

http://www.virustotal.com
http://virusscan.jotti.org

You've done excellent detective work, but I don't see where you have removed
whatever startup vector item made this bug active on your machine--and that
worries me--there's presumably a piece still left, perhaps de-fanged due to
the loss of the other pieces, but perhaps helpful in identification.

Does checking out the various areas in Tools, advanced tools, system
explorers find anthing, perhaps with a comparable date--that might be
relevant?

 

[Spider]

Amy,
In addition to what Bill has suggested, also open Microsoft Anti Spyware and
go to Advanced Tools and click on System Explorer. In the Networking
section, look at the HOST file. That file should be basically blank other
then a single entry dealing with 127.0.0.1. Are you seeing anything else in
there?

--


Spider
http://web.tampabay.rr.com/spider1
http://spider1.blogspot.com/