Possible Browser Hijack: czgmr.dll

  • Thread starter Thread starter Amy Michel
  • Start date Start date
A

Amy Michel

In the last week I had been experiencing extreme slowness in loading and
using Microsoft Internet Explorer (but not Netscape or Firefox) on my WinXP
SP2 machine. In particular, when I would visit certain sites it would
re-direct me automatically. In particular, when I would type in
www.bestbuy.com my browser would "think" for a bit and then re-direct me to
www.buy.com. Other websites would send me places that I was not intending
on going after I typed in a URL.

I have Norton Anti-Virus running all the time and performed the advaced
scan, ran the usual Ad-Aware, Spy Bot, HijackThis, and Microsoft's Beta
Anti-Spyware app in my attempt to try an find some sort of
virus/trojan/browser hijacker/etc. running. It found a few tracking cookies
for ad-related websites, but nothing major. I got rid of the cookies, went
so far as re-starting my machine, opened up IE again, and the exact same
problem happened.

Uggh! I took at look through my registry to see if there were things loaded
in software/microsoft/etc. that would be cause for alarm but I did not find
anything. Further analysis of HijackThis log files made while I was running
different apps (running IE, Netscape, Firefox, Outlook, AIM, etc.) did not
show any files out of the ordinary.

Then I thought about when my computer started acting this way. So I simply
performed a file search (including hidden files) of all files changed in the
timeframe I felt my machine starting having issues.

Going through that list I found the issue.

I found the following files loaded onto my machine, actually in multiple
places with timestamps all within a minute of each other:
- czgmr.dll
- czgmra.xml
- czgmre.xml

When I opened the XML file it appeared to be compiled code of sorts as it
was not the usual XML format that could easily be read. It's timestamep
changed each time I loaded IE for the first time after a reboot of Windows.

Upon a Safe Mode restart, I pulled the files named above and put them in the
Trash, and everything is now working normally.

It was quite strange that no virus/ad/spyware scan that I performed found
any of these files and I cannot seem to find any references to these files
when I Google them.

Has anyone else seen this issue on their machines or know anything more
about the files I listed?
 
Please hold on to these crtters, they may be of use to researchers.
Names are sometimes not useful guides--some bugs use randomly constructed
names.

It'd be nice to submit all three files to these multi-vendor antivirus
scanners:

http://www.virustotal.com
http://virusscan.jotti.org

You've done excellent detective work, but I don't see where you have removed
whatever startup vector item made this bug active on your machine--and that
worries me--there's presumably a piece still left, perhaps de-fanged due to
the loss of the other pieces, but perhaps helpful in identification.

Does checking out the various areas in Tools, advanced tools, system
explorers find anthing, perhaps with a comparable date--that might be
relevant?
 
Back
Top