Page 1 of 2 12››
April 4, 2012 12:30 Trojan Citem.ZQ #196760
Reply with Quote | Quick Reply | Top
malkymalk

Avatar

Novice
Join Date: 2.4.2012
Posts: 4
My PC appears to be infected with this trojan. First showed up during AVG's daily scan of the computer, two days ago.

The scanner cannot remove the trojan, I think because it appears to be embedded within imm32.dll.

I've tried using AVG's rescue disk but this does not find any evidence of the problem.

Have also tried using system restore to roll back a few days. That also didn't work. Rather confusingly, the AVG scan that I launched after system restore, found no problems. Yet the scheduled daily scan, which coincidentally started just a few minutes after my manual scan, DID find the trojan.

Advice on how to deal with this would be much appreciated: attached are MSINFO record, GMER scan, AVG scan record.

Incidentally, I can't find any detail about what this trojan does. Is there any info?
April 5, 2012 08:36 Re: Trojan Citem.ZQ #196808
Reply with Quote | Quick Reply | Top
Pokornyz

Avatar

Administrator
Join Date: 29.11.2010
Posts: 8245
Hello malkymalk,

In order to further analyze please provide us with rootkit scan GMER result.

Thank you



AVG Team
How-To articles | FAQ | Free Support
April 5, 2012 12:31 Re: Trojan Citem.ZQ #196829
Reply with Quote | Quick Reply | Top
consciouscorner

Avatar

Novice
Join Date: 5.4.2012
Posts: 2
Also have issue with citem.zq - imm32.dll..

I tried running the command line AVG scan in safe mode and it ended up deleting the imm32.dll. All looked clean with an additional scan but one program would not start without the imm32.dll. I dropped a fresh imm32.dll from an identically configured workstation and the resident shield alerts immediately returned with the new .dll.

This started on Tuesday, April 3rd. I have also tried cleaning with Malwarebytes (free version) and it now shows clean.

Please let me know if you guys come up with anything.
April 5, 2012 12:44 Re: Trojan Citem.ZQ #196832
Reply with Quote | Quick Reply | Top
Pokornyz

Avatar

Administrator
Join Date: 29.11.2010
Posts: 8245
Hello consciouscorner,

Please refer to the following article for help on your issue: How To Handle Suspicious False Positive Detection?

Thank you



AVG Team
How-To articles | FAQ | Free Support
April 5, 2012 14:00 Re: Trojan Citem.ZQ #196835
Reply with Quote | Quick Reply | Top
consciouscorner

Avatar

Novice
Join Date: 5.4.2012
Posts: 2
Thanks!..

It looks like it was a false positive after all. The update this morning did the trick. Thanks so much for the quick response!
April 5, 2012 14:23 Re: Trojan Citem.ZQ #196842
Reply with Quote | Quick Reply | Top
Pokornyz

Avatar

Administrator
Join Date: 29.11.2010
Posts: 8245
Hello consciouscorner,

We are happy to see that your issue is resolved.

Thank you for posting back



AVG Team
How-To articles | FAQ | Free Support
April 6, 2012 16:53 Re: Trojan Citem.ZQ #196982
Reply with Quote | Quick Reply | Top
malkymalk

Avatar

Novice
Join Date: 2.4.2012
Posts: 4
(once again)..

OK, so I posted this on 4 April but AVG have decided to lock the post after solving not my problem, but that of someone who followed up my post! :disappointed: Try again, guys?

--- original post---

My PC appears to be infected with this trojan. First showed up during AVG's daily scan of the computer, two days ago.

The scanner cannot remove the trojan, I think because it appears to be embedded within imm32.dll.

I've tried using AVG's rescue disk but this does not find any evidence of the problem.

Have also tried using system restore to roll back a few days. That also didn't work. Rather confusingly, the AVG scan that I launched after system restore, found no problems. Yet the scheduled daily scan, which coincidentally started just a few minutes after my manual scan, DID find the trojan.

Advice on how to deal with this would be much appreciated: attached are MSINFO record, GMER scan, AVG scan record.

Incidentally, I can't find any detail about what this trojan does. Is there any info?
---

EDIT.. Thread reopened & post merged.
April 11, 2012 08:56 Re: Trojan Citem.ZQ #197289
Reply with Quote | Quick Reply | Top
nemethste

Avatar

Administrator
Join Date: 1.11.2011
Posts: 1730
Hello malkymalk,

In order to get rid of this kind of infection please restore master boot record in offline mode.

Right after the MBR is restored, please scan your computer with updated AVG Rescue CD to kill all remains of infection.

After all above mentioned procedures are done, please provide us with new Gmer and AVG scan results so we can confirm that your computer is clean.

Thank you.



AVG Team
How-To articles | FAQ | Free Support
June 6, 2012 19:28 Re: Trojan Citem.ZQ #206841
Reply with Quote | Quick Reply | Top
malkymalk

Avatar

Novice
Join Date: 2.4.2012
Posts: 4
nemethste wrote
Hello malkymalk,

In order to get rid of this kind of infection please restore master boot record in offline mode.

Right after the MBR is restored, please scan your computer with updated AVG Rescue CD to kill all remains of infection.

After all above mentioned procedures are done, please provide us with new Gmer and AVG scan results so we can confirm that your computer is clean.

Thank you.




Hello again

Ok, so its taken me a long time to do this but now done. :embarrassed:

Have scanned several times now and infection is not now being detected. However, start up and shut down for PC is verrrry slow, which worries me that something could still be present.

Attached scan and GMER report as requested - would welcome your feedback.
June 6, 2012 20:20 Re: Trojan Citem.ZQ #206851
Reply with Quote | Quick Reply | Top
Gary Bee

Avatar

Novice
Join Date: 29.7.2010
Posts: 296
Hi Malkymalk,

malkymalk wrote
However, start up and shut down for PC is verrrry slow, which worries me that something could still be present.

While performing multiple scans in pursuit of a virus, my PC also slowed dramatically. It turned out to be a limit in the MS IDE Driver on the number of DMA errors a drive may have. If exceeded, the driver reverts to PIO (aka Lame Disk Mode) and does not reset itself. You can check this by using the Device Manager.
(From My Computer, right click Hard Disk Drives and Properties, select the Hardware tab and then the [Device Manager] button. From the list, expand the IDE Controllers, and on Primary IDE Channel right click and Properties. Select the Advantaged Settings tab.)

If the Transfer Mode has “DMA if available”, and the Current Transfer Mode has “Ultra DMA Mode” or something similar, your okay. But if Current is “PIO”. You have the problem. Some people have indicated that just changing the requested Transfer Mode to “PIO”, and then back to “DMA if available” resets it, but almost all have not.

The Good News, it can be reset. Read this article and use the VB Script to reset the count. Hope this is it, because it’s easy to fix. One other thing, if after re-enabling the DMA it reverts back to "PIO" in a short period of time then it is an actual hardware problem.


Helping People Not Get Stung Since 1970
A V C © - Almost Very Clever
[which implies some cleverness, but staying humble (or is that bumble)]
Gary
Page 1 of 2 12››