wzcsvbxm.dll warning - ALSO CHANGE YOUR PASSWORDS

[Tarage]

I thought about putting this in the newbie section, but since it is a technical problem and is possibly connected to the BG security breach, I put it here.

I was using Internet Explorer with no sort of protection when the breach happened. Before this, I was also completely unprotected. Since then, I have switched to Firefox and done everything suggested. However, something slightly worrisome has started to happen since the breach. Whenever I start PoL from my desktop, it preforms an illegal operation according to windows. Now, the program itself either continues to run fine, or black-screens. However in either case, trying to launch FFXI fails. Recently, it caused my entire computer to have to be re-booted because of a black screen. On the second loading of PoL, the problem goes away.

Does anyone have any ideas as to what is happening? Has anyone else experienced this? I'd like to avoid a full re-install if possible.

EDIT: I am running under the suspicion that my account has been hijacked. Please beware. I don't know if wzcsvbxm.dll is responsible, but it would be better to check anyway.

[Guyverarmor]

I have had this happen to me once before, like last year. put my computer into safe mode and cleaned the shit out of it. apperently a backdoor trojan got in and infected the system. Go ahead and try that first....

If not,

[#686578]

It's probably lupus, and probably caused by not posting this in the technical section

[Fistandantilus]

It's probably lupus, and probably caused by not posting this in the technical section

http://image.hazardstrip.com/ico/spr...verlupus_2.gif

Couldn't help myself.

[Tarage]

Apparently the module failing is wzcsvbxm.dll. Any idea what that is?

[Mizango]

Apparently the module failing is wzcsvbxm.dll. Any idea what that is?

Hmmm, are you using a wireless router by chance? If so what kind? This seems too familiar, I just cant quite put my finger on it...

Edit for clarity: As in "kind" I mean is it an 802.11 wireless router?

[Tarage]

Apparently the module failing is wzcsvbxm.dll. Any idea what that is?

Hmmm, are you using a wireless router by chance? If so what kind? This seems too familiar, I just cant quite put my finger on it...

Edit for clarity: As in "kind" I mean is it an 802.11 wireless router?

I am, but I'm not using the wireless part for FFXI. I'll get the model number tomorow if it's important. The only part I use wireless for is my handhelds.

[Skjie]

Apparently the module failing is wzcsvbxm.dll. Any idea what that is?

Hmmm, are you using a wireless router by chance? If so what kind? This seems too familiar, I just cant quite put my finger on it...

Edit for clarity: As in "kind" I mean is it an 802.11 wireless router?

I think you're thinking of the wireless zero configuration, which is wzcsapi.dll. Gibberish dlls like that are 90% of the time related to having a virus/trojan. Vundo is a common one right now.

[Tarage]

I have reason to believe my account has been stolen from me. Please check if you have this wzcsvbxm.dll I don't know, but it could be the virus. Be careful.

[Suterusu]

http://www.google.com/search?hl=en&q=wzcsvbxm.dll


Maybe a windower plugin related .dll?


If this was a real security threat (not saying it isn't) google would normally have multiple pages referencing it, along with the symptoms(sp) and possible ways to fix it.

[Tarage]

http://www.google.com/search?hl=en&q=wzcsvbxm.dll


Maybe a windower plugin related .dll?


If this was a real security threat (not saying it isn't) google would normally have multiple pages referencing it, along with the symptoms(sp) and possible ways to fix it.

I don't know. I too checked google, and both of those links report the same symptoms of crashing PoL. Also, the dll in question has since vanished from my computer. I don't know, but it's better to be safe than sorry. I don't know what caused this problem.

[Ashira]

JUST A NOTE:

The iframe put on BG linked to a defunct server from what I recall in those threads, so there should be no issues related to that frame on BG.

What I personally think is that the hackers are working on a backlog... they got a LOT of information from all the original iframes and probably could not go through everything all at once.

CHANGE YOUR PASSWORD
CHANGE YOUR PASSWORD
CHANGE YOUR PASSWORD
CHANGE YOUR PASSWORD
CHANGE YOUR PASSWORD

Especially now with the onscreen keyboard... reposition the POL window if you must for more security.

And for fuck's sake, update your damn browsers and flash plugins. /sigh

[Senoska]

Especially now with the onscreen keyboard... reposition the POL window if you must for more security.

And for fuck's sake, update your damn browsers and flash plugins. /sigh

Repositioning won't do anything as the keyboard location is static, if you know the X,Y of the POL window you can hook the mouse and snag a password. You can use your Keyboard on the software keyboard. I suggest using a mix of keyboard(left right up down keys) and mouse commands to type in your password.

[Suterusu]

Type it on a stand alone box. Copy to a flash drive/lolfloppy. Copy paste onto the onscreen keyboard. Just a thought.

[Mizango]

JUST A NOTE:

The iframe put on BG linked to a defunct server from what I recall in those threads, so there should be no issues related to that frame on BG.

What I personally think is that the hackers are working on a backlog... they got a LOT of information from all the original iframes and probably could not go through everything all at once.

CHANGE YOUR PASSWORD
CHANGE YOUR PASSWORD
CHANGE YOUR PASSWORD
CHANGE YOUR PASSWORD
CHANGE YOUR PASSWORD

Especially now with the onscreen keyboard... reposition the POL window if you must for more security.

And for fuck's sake, update your damn browsers and flash plugins. /sigh

This can't be stressed enough. Unfortunately a lot of people are afflicted with the "It cant happen to me syndrome".

[Kuponut]

Sorry, stupid question~ How do you use the pop up keyboard pad thing they added? I don't really see an option to use it anywhere.

[Nirokun!]

click the box where you enter the info, or press enter when the box is highlighted blue

[Ashira]

Especially now with the onscreen keyboard... reposition the POL window if you must for more security.

And for fuck's sake, update your damn browsers and flash plugins. /sigh

Repositioning won't do anything as the keyboard location is static, if you know the X,Y of the POL window you can hook the mouse and snag a password. You can use your Keyboard on the software keyboard. I suggest using a mix of keyboard(left right up down keys) and mouse commands to type in your password.

Ah, I didn't realize that, that the keyboard was static, since I haven't tried moving it around at all. Thanks for that info.

And yeah, sorry to the OP; I helped him get his account frozen since no one else was awake this morning. After speaking with the GM, the account was frozen, though the GM couldn't tell me anything as to whether the account was moved around or anything.

But.. Tarage did tell me that he used IE and didn't really update anything until the outdated frame showed up on BG - then he finally switched to Firefox. And he said he never changed his password, ever, from when the exploits first started showing up.

Which furthers my thoughts that this is still a backlog that the people are working off of, from people who got infected off when these things first started showing up.

CHANGE YOUR PASSWORDS

Do it from a PS2 if you have to, or, on another freakin' computer on a txt file on a disk and cut and paste if you have to. Or as Senoska suggested, with keyboard arrows and mouse commands mixed.

At this point, honestly, anything happening is on the users themselves. The iframes aren't out there currently that we've seen; they've been found, you've been told how to protect yourself and your system... SAVE YOURSELVES.

[aurik]

http://www.download.com/Trend-Micro-Hij ... 27353.html

Anyone who gets hacked, please run hijackthis and post a log so that we can find out how the hackers gained access.

[Glade]

Account got jacked last night. It got moved to Carbuncle Server. Here's my log:

PS. Not a damn clue how to read this lol.


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:49:04 PM, on 21/06/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\acer\epm\epm-dm.exe
C:\Acer\eManager\anbmServ.exe
C:\Program Files\Launch Manager\PowerKey.exe
C:\Program Files\Launch Manager\HotkeyApp.exe
C:\Acer\Empowering Technology\eRecovery\Monitor.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\PlayOnline\SquareEnix\PlayOnlineViewer\pol.e xe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://google.icq.com/search/search_frame.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://google.icq.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://sympatico.msn.ca/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://global.acer.com/
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SEARCH~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [preload] C:\Windows\RUNXMLPL.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [EPM-DM] c:\acer\epm\epm-dm.exe
O4 - HKLM\..\Run: [ePowerManagement] C:\Acer\ePM\ePM.exe boot
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [PowerKey] "C:\Program Files\Launch Manager\PowerKey.exe"
O4 - HKLM\..\Run: [LManager] "C:\Program Files\Launch Manager\HotkeyApp.exe"
O4 - HKLM\..\Run: [CtrlVol] "C:\Program Files\Launch Manager\CtrlVol.exe"
O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\Monitor.exe
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton AntiVirus\osCheck.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Joel Billingsley\Start Menu\Programs\IMVU\Run IMVU.lnk (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/ms ... b31267.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Me ... b31267.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/Mi ... b31267.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.mail.live.com/mail/w1/resou ... NPUpld.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/Fac ... loader.cab
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Me ... b31267.cab
O16 - DPF: {A2E05F45-F127-4092-B9F7-9A02C3E04C77} (HGPlugin7USA Class) - http://gamedownload.ijjimax.com/gamedow ... in7USA.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZI ... b47946.cab
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su2/CTL_V02002/ ... /CTPID.cab
O23 - Service: Notebook Manager Service (anbmService) - OSA Technologies Inc. - C:\Acer\eManager\anbmServ.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\isPwdSvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe

--
End of file - 9527 bytes