cnijzsq.dll - Dangerous
cnijzsq.dll
Manual removal instructions:
Antivirus Report of cnijzsq.dll:
cnijzsq.dll
We suggest you to remove zsipady.dll from your computer as soon as possible.
Zsipady.dll is Trojan/Backdoor.
Kill the file zsipady.dll and remove zsipady.dll from Windows startup.
Malware dropper: file.exe
Removed: c:\windows\system32\zsipady.dll
-------------------------------------------------------------------------------------
Classification:
Code:
Antivirus Version Last Update Result
F-Secure 8.0.14470.0 2009.10.14 Trojan-Dropper.Win32.Boaxxe.ac
Kaspersky 7.0.0.125 2009.10.14 Trojan-Dropper.Win32.Boaxxe.ac
McAfee 5770 2009.10.13 Suspect-02!9A856C53A8A6
Microsoft 1.5101 2009.10.14 -
NOD32 4507 2009.10.14 -
Symantec 1.4.4.12 2009.10.14 Trojan.Dropper
Additional information
File size: 204288 bytes
MD5 : 9a856c53a8a6195ce88f7aa1eec92746
SHA1 : f992d46c083659b28bef49e4a6f77123e9132ce0
-------------------------------------------------------------------------------------
Installation
When the program is executed, it creates the following registry subkeys and values:
----------------------------------
Keys added:9
----------------------------------
HKLM\SOFTWARE\Classes\CLSID\{3B3B5023-B120-45F6-80B1-BA86D04D66F1}
HKLM\SOFTWARE\Classes\CLSID\{3B3B5023-B120-45F6-80B1-BA86D04D66F1}\InprocServer32
HKLM\SOFTWARE\Classes\CLSID\{3B3B5023-B120-45F6-80B1-BA86D04D66F1}\ProgID
HKLM\SOFTWARE\Classes\Anzqsyzt
HKLM\SOFTWARE\Classes\Anzqsyzt\CLSID
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3B3B5023-B120-45F6-80B1-BA86D04D66F1}
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\yrkyntqw
HKLM\SYSTEM\CurrentControlSet\Services\ooffeyur
HKLM\SYSTEM\CurrentControlSet\Services\ooffeyur\Parameters
----------------------------------
Values added:21
----------------------------------
HKLM\SOFTWARE\Classes\CLSID\{3B3B5023-B120-45F6-80B1-BA86D04D66F1}\ProgID\: "Anzqsyzt"
HKLM\SOFTWARE\Classes\CLSID\{3B3B5023-B120-45F6-80B1-BA86D04D66F1}\InprocServer32\: "c:\windows\system32\zsipady.dll"
HKLM\SOFTWARE\Classes\CLSID\{3B3B5023-B120-45F6-80B1-BA86D04D66F1}\InprocServer32\ThreadingModel: "Apartment"
HKLM\SOFTWARE\Classes\CLSID\{3B3B5023-B120-45F6-80B1-BA86D04D66F1}\: ""
HKLM\SOFTWARE\Classes\CLSID\{3B3B5023-B120-45F6-80B1-BA86D04D66F1}\Version: 0x00000047
HKLM\SOFTWARE\Classes\Anzqsyzt\CLSID\: "{3B3B5023-B120-45F6-80B1-BA86D04D66F1}"
HKLM\SOFTWARE\Classes\Anzqsyzt\: ""
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\yrkyntqw\Asynchronous: 0x00000000
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\yrkyntqw\Impersonate: 0x00000000
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\yrkyntqw\DLLName: "zsipady.dll"
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\yrkyntqw\Logoff: "WLEventLogoff"
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\yrkyntqw\Logon: "WLEventLogon"
HKLM\SYSTEM\CurrentControlSet\Services\Schedule\AtTaskMaxHours: 0x00000048
HKLM\SYSTEM\CurrentControlSet\Services\ooffeyur\Parameters\ServiceDll: "C:\WINDOWS\system32\zsipady.dll"
HKLM\SYSTEM\CurrentControlSet\Services\ooffeyur\ImagePath: "%SystemRoot%\System32\svchost.exe -k netsvcs"
HKLM\SYSTEM\CurrentControlSet\Services\ooffeyur\Description: "Direct Parallel Link"
HKLM\SYSTEM\CurrentControlSet\Services\ooffeyur\DisplayName: "Direct Parallel Link Helper"
HKLM\SYSTEM\CurrentControlSet\Services\ooffeyur\ErrorControl: 0x00000001
HKLM\SYSTEM\CurrentControlSet\Services\ooffeyur\ObjectName: "LocalSystem"
HKLM\SYSTEM\CurrentControlSet\Services\ooffeyur\Start: 0x00000002
HKLM\SYSTEM\CurrentControlSet\Services\ooffeyur\Type: 0x00000020
----------------------------------
Values modified:12
----------------------------------
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\netsvcs: '6to4 AppMgmt AudioSrv Browser CryptSvc DMServer DHCP ERSvc EventSystem FastUserSwitchingCompatibility HidServ Ias Iprip Irmon LanmanServer LanmanWorkstation Messenger Netman Nla Ntmssvc NWCWorkstation Nwsapagent Rasauto Rasman Remoteaccess Schedule Seclogon SENS Sharedaccess SRService Tapisrv Themes TrkWks W32Time WZCSVC Wmi WmdmPmSp winmgmt wscsvc xmlprov napagent hkmsvc BITS wuauserv ShellHWDetection helpsvc WmdmPmSN'
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\netsvcs: '6to4 AppMgmt AudioSrv Browser CryptSvc DMServer DHCP ERSvc EventSystem FastUserSwitchingCompatibility HidServ Ias Iprip Irmon LanmanServer LanmanWorkstation Messenger Netman Nla Ntmssvc NWCWorkstation Nwsapagent Rasauto Rasman Remoteaccess Schedule Seclogon SENS Sharedaccess SRService Tapisrv Themes TrkWks W32Time WZCSVC Wmi WmdmPmSp winmgmt ooffeyur wscsvc xmlprov napagent hkmsvc BITS wuauserv ShellHWDetection helpsvc WmdmPmSN'
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore\DisableSR: 0x00000001
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore\DisableSR: 0x00000000
HKLM\SYSTEM\CurrentControlSet\Services\Schedule\NextAtJobId: 0x00000001
HKLM\SYSTEM\CurrentControlSet\Services\Schedule\NextAtJobId: 0x00000002
HKLM\SYSTEM\CurrentControlSet\Services\sr\Start: 0x00000004
HKLM\SYSTEM\CurrentControlSet\Services\sr\Start: 0x00000000
HKLM\SYSTEM\CurrentControlSet\Services\sr\ImagePath: "\SystemRoot\system32\DRIVERS\sr.sys"
HKLM\SYSTEM\CurrentControlSet\Services\sr\ImagePath: "system32\DRIVERS\sr.sys"
HKLM\SYSTEM\CurrentControlSet\Services\sr\Parameters\FirstRun: 0x00000001
HKLM\SYSTEM\CurrentControlSet\Services\sr\Parameters\FirstRun: 0x00000000
----------------------------------
Files added:4
----------------------------------
C:\WINDOWS\system32\Restore\MachineGuid.txt
C:\WINDOWS\system32\cnijzsq.dll
C:\WINDOWS\system32\zsipady.dll
C:\WINDOWS\Tasks\At1.job
----------------------------------
Files [attributes?] modified:0
----------------------------------
----------------------------------
Folders added:0
----------------------------------
----------------------------------
Folders deleted:0
----------------------------------
----------------------------------
Total changes:46
----------------------------------
-------------------------------------------------------------------------------------
Detected by UnHackMe:
Item Name: {3B3B5023-B120-45F6-80B1-BA86D04D66F1}
Author: Microsoft Corporation
Related File: c:\windows\system32\zsipady.dll
Type: Browser Helper Objects
Item Name: yrkyntqw
Author: Microsoft Corporation
Related File: zsipady.dll
Type: Winlogon Notification
Item Name: ooffeyur
Author: Unknown
Related File: C:\WINDOWS\system32\zsipady.dll
Type: Svchost DLLs
After first reboot detected by UnHackMe:
Item Name: {3B3B5023-B120-45F6-80B1-BA86D04D66F1}
Author:
Related File: c:\windows\system32\zsipady.dll
Type: Browser Helper Objects
Removal Results: Success
Number of reboot: 1
-------------------------------------------------------------------------------------
Recommended software:
UnHackMe anti-rootkit and anti-malware
http://www.unhackme.com
RegRun Security Suite (Good choice for removal and protection)
| cnijzsq.dll | Malware |
| cnijzsq.dll | Dangerous |
| cnijzsq.dll | High Risk |
Zsipady.dll is Trojan/Backdoor.
Kill the file zsipady.dll and remove zsipady.dll from Windows startup.
Malware dropper: file.exe
Removed: c:\windows\system32\zsipady.dll
-------------------------------------------------------------------------------------
Classification:
Code:
Antivirus Version Last Update Result
F-Secure 8.0.14470.0 2009.10.14 Trojan-Dropper.Win32.Boaxxe.ac
Kaspersky 7.0.0.125 2009.10.14 Trojan-Dropper.Win32.Boaxxe.ac
McAfee 5770 2009.10.13 Suspect-02!9A856C53A8A6
Microsoft 1.5101 2009.10.14 -
NOD32 4507 2009.10.14 -
Symantec 1.4.4.12 2009.10.14 Trojan.Dropper
Additional information
File size: 204288 bytes
MD5 : 9a856c53a8a6195ce88f7aa1eec92746
SHA1 : f992d46c083659b28bef49e4a6f77123e9132ce0
-------------------------------------------------------------------------------------
Installation
When the program is executed, it creates the following registry subkeys and values:
----------------------------------
Keys added:9
----------------------------------
HKLM\SOFTWARE\Classes\CLSID\{3B3B5023-B120-45F6-80B1-BA86D04D66F1}
HKLM\SOFTWARE\Classes\CLSID\{3B3B5023-B120-45F6-80B1-BA86D04D66F1}\InprocServer32
HKLM\SOFTWARE\Classes\CLSID\{3B3B5023-B120-45F6-80B1-BA86D04D66F1}\ProgID
HKLM\SOFTWARE\Classes\Anzqsyzt
HKLM\SOFTWARE\Classes\Anzqsyzt\CLSID
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3B3B5023-B120-45F6-80B1-BA86D04D66F1}
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\yrkyntqw
HKLM\SYSTEM\CurrentControlSet\Services\ooffeyur
HKLM\SYSTEM\CurrentControlSet\Services\ooffeyur\Parameters
----------------------------------
Values added:21
----------------------------------
HKLM\SOFTWARE\Classes\CLSID\{3B3B5023-B120-45F6-80B1-BA86D04D66F1}\ProgID\: "Anzqsyzt"
HKLM\SOFTWARE\Classes\CLSID\{3B3B5023-B120-45F6-80B1-BA86D04D66F1}\InprocServer32\: "c:\windows\system32\zsipady.dll"
HKLM\SOFTWARE\Classes\CLSID\{3B3B5023-B120-45F6-80B1-BA86D04D66F1}\InprocServer32\ThreadingModel: "Apartment"
HKLM\SOFTWARE\Classes\CLSID\{3B3B5023-B120-45F6-80B1-BA86D04D66F1}\: ""
HKLM\SOFTWARE\Classes\CLSID\{3B3B5023-B120-45F6-80B1-BA86D04D66F1}\Version: 0x00000047
HKLM\SOFTWARE\Classes\Anzqsyzt\CLSID\: "{3B3B5023-B120-45F6-80B1-BA86D04D66F1}"
HKLM\SOFTWARE\Classes\Anzqsyzt\: ""
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\yrkyntqw\Asynchronous: 0x00000000
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\yrkyntqw\Impersonate: 0x00000000
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\yrkyntqw\DLLName: "zsipady.dll"
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\yrkyntqw\Logoff: "WLEventLogoff"
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\yrkyntqw\Logon: "WLEventLogon"
HKLM\SYSTEM\CurrentControlSet\Services\Schedule\AtTaskMaxHours: 0x00000048
HKLM\SYSTEM\CurrentControlSet\Services\ooffeyur\Parameters\ServiceDll: "C:\WINDOWS\system32\zsipady.dll"
HKLM\SYSTEM\CurrentControlSet\Services\ooffeyur\ImagePath: "%SystemRoot%\System32\svchost.exe -k netsvcs"
HKLM\SYSTEM\CurrentControlSet\Services\ooffeyur\Description: "Direct Parallel Link"
HKLM\SYSTEM\CurrentControlSet\Services\ooffeyur\DisplayName: "Direct Parallel Link Helper"
HKLM\SYSTEM\CurrentControlSet\Services\ooffeyur\ErrorControl: 0x00000001
HKLM\SYSTEM\CurrentControlSet\Services\ooffeyur\ObjectName: "LocalSystem"
HKLM\SYSTEM\CurrentControlSet\Services\ooffeyur\Start: 0x00000002
HKLM\SYSTEM\CurrentControlSet\Services\ooffeyur\Type: 0x00000020
----------------------------------
Values modified:12
----------------------------------
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\netsvcs: '6to4 AppMgmt AudioSrv Browser CryptSvc DMServer DHCP ERSvc EventSystem FastUserSwitchingCompatibility HidServ Ias Iprip Irmon LanmanServer LanmanWorkstation Messenger Netman Nla Ntmssvc NWCWorkstation Nwsapagent Rasauto Rasman Remoteaccess Schedule Seclogon SENS Sharedaccess SRService Tapisrv Themes TrkWks W32Time WZCSVC Wmi WmdmPmSp winmgmt wscsvc xmlprov napagent hkmsvc BITS wuauserv ShellHWDetection helpsvc WmdmPmSN'
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\netsvcs: '6to4 AppMgmt AudioSrv Browser CryptSvc DMServer DHCP ERSvc EventSystem FastUserSwitchingCompatibility HidServ Ias Iprip Irmon LanmanServer LanmanWorkstation Messenger Netman Nla Ntmssvc NWCWorkstation Nwsapagent Rasauto Rasman Remoteaccess Schedule Seclogon SENS Sharedaccess SRService Tapisrv Themes TrkWks W32Time WZCSVC Wmi WmdmPmSp winmgmt ooffeyur wscsvc xmlprov napagent hkmsvc BITS wuauserv ShellHWDetection helpsvc WmdmPmSN'
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore\DisableSR: 0x00000001
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore\DisableSR: 0x00000000
HKLM\SYSTEM\CurrentControlSet\Services\Schedule\NextAtJobId: 0x00000001
HKLM\SYSTEM\CurrentControlSet\Services\Schedule\NextAtJobId: 0x00000002
HKLM\SYSTEM\CurrentControlSet\Services\sr\Start: 0x00000004
HKLM\SYSTEM\CurrentControlSet\Services\sr\Start: 0x00000000
HKLM\SYSTEM\CurrentControlSet\Services\sr\ImagePath: "\SystemRoot\system32\DRIVERS\sr.sys"
HKLM\SYSTEM\CurrentControlSet\Services\sr\ImagePath: "system32\DRIVERS\sr.sys"
HKLM\SYSTEM\CurrentControlSet\Services\sr\Parameters\FirstRun: 0x00000001
HKLM\SYSTEM\CurrentControlSet\Services\sr\Parameters\FirstRun: 0x00000000
----------------------------------
Files added:4
----------------------------------
C:\WINDOWS\system32\Restore\MachineGuid.txt
C:\WINDOWS\system32\cnijzsq.dll
C:\WINDOWS\system32\zsipady.dll
C:\WINDOWS\Tasks\At1.job
----------------------------------
Files [attributes?] modified:0
----------------------------------
----------------------------------
Folders added:0
----------------------------------
----------------------------------
Folders deleted:0
----------------------------------
----------------------------------
Total changes:46
----------------------------------
-------------------------------------------------------------------------------------
Detected by UnHackMe:
Item Name: {3B3B5023-B120-45F6-80B1-BA86D04D66F1}
Author: Microsoft Corporation
Related File: c:\windows\system32\zsipady.dll
Type: Browser Helper Objects
Item Name: yrkyntqw
Author: Microsoft Corporation
Related File: zsipady.dll
Type: Winlogon Notification
Item Name: ooffeyur
Author: Unknown
Related File: C:\WINDOWS\system32\zsipady.dll
Type: Svchost DLLs
After first reboot detected by UnHackMe:
Item Name: {3B3B5023-B120-45F6-80B1-BA86D04D66F1}
Author:
Related File: c:\windows\system32\zsipady.dll
Type: Browser Helper Objects
Removal Results: Success
Number of reboot: 1
-------------------------------------------------------------------------------------
Recommended software:
UnHackMe anti-rootkit and anti-malware
http://www.unhackme.com
RegRun Security Suite (Good choice for removal and protection)
Dmitry Sokolov:
I created UnHackMe in 2006 to fix the problem that antivioruses did not fix: detecting rootkits.
Since that time I work every day to fix the issues that antiviruses cannot.
If your antivirus have not helped you solve the problem, you should try UnHackMe.
We are a small company and you can ask me directly, if you have any questions.