wzcsvbxm.dll warning - ALSO CHANGE YOUR PASSWORDS

[Royal]

I found a helpful website for checking any processes on your computer when you have no idea what they mean. http://www.processlibrary.com/directory/

Just type the .exe or .dll you see in process manager and it will tell you if its safe or not.

[Shuemue]

That's only helpful to a point, it's a relatively simple thing to disguise a file or process as something else.

[The Blackrose]

WinPcap is used by Ethereal/Wireshark.

Can't remember what other programs are distributed with it.

I believe Cain and Abel comes packaged with it too.

Type it on a stand alone box. Copy to a flash drive/lolfloppy. Copy paste onto the onscreen keyboard. Just a thought.

Because no one ever reads the copy buffer, amirite?

[Senoska]

WinPcap is used by Ethereal/Wireshark.

Can't remember what other programs are distributed with it.

I believe Cain and Abel comes packaged with it too.

Type it on a stand alone box. Copy to a flash drive/lolfloppy. Copy paste onto the onscreen keyboard. Just a thought.

Because no one ever reads the copy buffer, amirite?

Exactly. That's really really insecure. I would say even worse then just typing it. Check if POL has focus and log the clipboard if they hit CRTL+V at the login screen, or something. It wouldn't be that hard to do.

As for the HJT logs, all of them look really clear to me. I see nothing wrong with them.

[LinktheDeme]

best way atm is just use their interface keyboard since it'll be a bit before they make a hack for it

[Aikar]

the results to windower are because someone also made a topic about this on our forums and google indexed that forum thread.

[Korietsu]

I do believe that that dll you see is related to the windows zero configuration utility. IIRC, my last computer lost its wireless capability due to the corruption of that file along with another WZC file.

[Tarage]

Tarage probably had Ethereal installed considering I know he took a class that uses it.

I did? That'd be news to me, because I don't even remember why I installed it.

[Shuemue]

In that case, are you certain you installed it yourself? As TBR pointed out, it's deployed with some pretty effective hacking software.

Yeah, yeah, I know it's not really called 'hacking software' but we all know network security utilities generally work both ways.

[Senoska]

Not sure if this is related, but I was playing FFXI fine, started it today:

just randomly started getting this error:
http://img58.imageshack.us/img58/1189/ffxierrorpv4.jpg

Thinking it was a directx issue I tried to reinstall Dx9 and I got this:
http://img95.imageshack.us/img95/3759/setuprq3.jpg

[Mafai]

Both cases of smart.dll I saw were not visible in HJT. I could only see it hooking everything using a program to view the modules attached to a program.

To the above poster, smart.dll was causing video card errors not allowing ffxi to load. Not that error specifically, but maybe you are on Vista so the error is different?

[Senoska]

Both cases of smart.dll I saw were not visible in HJT. I could only see it hooking everything using a program to view the modules attached to a program.

To the above poster, smart.dll was causing video card errors not allowing ffxi to load. Not that error specifically, but maybe you are on Vista so the error is different?

There is no smart.dll in my system32 folder.

[Mafai]

I was using a program called CurrProcess to scan what was attached to my POL.

http://www.nirsoft.net/utils/cprocess.html

To do this.

1.) Run Program and right click POL.

2.) Choose "Process Modules HTML Report.

Look thru this list for things that do not look right. Entries such as:

wzcsvbxm.dll
smart.dll

Also scan thru the Product Name field.
Microsoft® Windows® Operating System is valid... the past viruses did not replicate the ® correctly.

Example of smart.dll was this.

==================================================
Module Name : smart.dll
Base Address : 0x013C0000
Module Size : 0x0000C000
Version : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
Description : Framebuffer Display Driver
Company : Microsoft Corporation
Product Name : Microsoft? Windows? Operating System
Modified Date : 5/26/2008 11:07:07 AM
File Size : 35,840
Filename : C:\WINDOWS\system32\smart.dll
File Attributes : A
==================================================

Remember this could be the same virus, just hooking your system differently and with a different file name.

[Tricen]

My friend thinks he got some kind of logger on his PC. He doesn't use BG and asked me for help so I figured I post his hijackthis thing here, if anything looks suspicious please let me know D:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:33:49 PM, on 6/23/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\system32\LxrJD31s.exe
C:\Program Files\Microsoft LifeCam\MSCamS32.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\vVX3000.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\PROGRA~1\Nero\data\Xtras\mssysmgr.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\MSN Messenger\livecall.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\PlayOnline\SquareEnix\PlayOnlineViewer\pol.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [LifeCam] "C:\Program Files\Microsoft LifeCam\LifeExp.exe"
O4 - HKLM\..\Run: [VX3000] C:\WINDOWS\vVX3000.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [PhotoShow Deluxe Media Manager] C:\PROGRA~1\Nero\data\Xtras\mssysmgr.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Startup: syn.jar
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {01010200-5E80-11D8-9E86-0007E96C65AE} (SupportSoft Installer) - https://ra.qwest.com/sdccommon/download/tgctlins.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary...r.cab50997.cab
O16 - DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} (MJLauncherCtrl Class) - http://messenger.zone.msn.com/EN-US/...jolauncher.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab50997.cab
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary...r.cab56986.cab
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: InCD Helper (read only) (InCDsrvR) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: Lexar JD31 (LxrJD31s) - Unknown owner - C:\WINDOWS\SYSTEM32\LxrJD31s.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

--
End of file - 8044 bytes

[Cephius]

Just a note to people trying to pick out a bad dll... a lot of the times these loggers install themselves into the C:\windows\system32 directory, and the easiest way to see if something fishy is to organize your system32 folder by date and see which files were recently created or modified. Any .dll file that is 0 kb in size and/or recently created is something that you should flag as suspicious immediately. Google it, if it comes up as possible malware, try renaming or deleting it. If you get locked out, chances are it's a virus/malware

[Yarko]

This dll was on my PC since like 2 weeks ago (I kept getting POL error messages on startup every other time I launched POL), found out what it was like 5 days later and deleted it under safe mode. It never came back up and I haven't typed my password for ages now, since it was saved. But I got hacked nonetheless today. I wanted to change password the other day just to be sure , typed all the 3 psws (old one, 2 new one) with a mix of the screen keyboard and copy-pasting single letters in a random order, but I got an error cause I must have inserted one of them wrong, and gave up cause it took 30 minutes and I had limbus (lol). Well now this happened.. so I advise you to change your psw asap if you have or had this DLL.

[stix]

I haven't been following any of the recent hacks at all...but from what I've seen if they all involve keyloggers, wouldn't it just be much, much safer to save your username and PW in POL? I don't think i've ever entered them with my keyboard at least....ever. Assuming most of you guys play on your own consoles/computers just wondering why that isn't considered a solution.

[Yarko]

I haven't been following any of the recent hacks at all...but from what I've seen if they all involve keyloggers, wouldn't it just be much, much safer to save your username and PW in POL? I don't think i've ever entered them with my keyboard at least....ever. Assuming most of you guys play on your own consoles/computers just wondering why that isn't considered a solution.

and I haven't typed my password for ages now, since it was saved. But I got hacked nonetheless today

[stix]

I haven't been following any of the recent hacks at all...but from what I've seen if they all involve keyloggers, wouldn't it just be much, much safer to save your username and PW in POL? I don't think i've ever entered them with my keyboard at least....ever. Assuming most of you guys play on your own consoles/computers just wondering why that isn't considered a solution.

and I haven't typed my password for ages now, since it was saved. But I got hacked nonetheless today

Ok, so if it's not a keylogger, what is it?

[Izzy]

I haven't been following any of the recent hacks at all...but from what I've seen if they all involve keyloggers, wouldn't it just be much, much safer to save your username and PW in POL? I don't think i've ever entered them with my keyboard at least....ever. Assuming most of you guys play on your own consoles/computers just wondering why that isn't considered a solution.

and I haven't typed my password for ages now, since it was saved. But I got hacked nonetheless today

Ok, so if it's not a keylogger, what is it?

What does it matter? It takes your password regardless of if you type it or have it saved.