Trojan Horse Dropper.Generic.IMA

Hello,

I would first recommend we try to identify and clean your malware up. Then the files that are infected we may or may not be able to restore. If this was a file infector like AWF or the Vundo variant you may be able to clean them, but that's not a guarantee.

I suggest that you download, run, and upload a HijackThis log from the link below.

http://www.trendsecure.com/portal/en-US/_download/HJTInstall.exe

Click on "Do a system scan and save a log file" button. Post the text from the log file. Do not have HJT fix anything at this point.

Please do not post the log into the comment window. Use "Attach File" under the comment window to post the log.

Yes it's a nasty one here. Not sure if you will be able to "clean" what is in your vault. Let's first try to get your PC clean as it is pretty infected.

Download SDFix (by Andy Machesta) and save it to your Desktop.
http://downloads.andymanchesta.com/RemovalTools/SDFix.exe

You should print out these instructions, or copy them to a NotePad file for reading while in Safe Mode, because you will not be able to connect to the Internet to read from this site.

Double click on SDFix.exe. It should automatically extract a folder called SDFix to your system drive (usually C:\). Please reboot your computer in Safe Mode by doing the following :
Restart your computer
After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
Instead of Windows loading as normal, a menu with options should appear;
Select the first option, to run Windows in Safe Mode, then press "Enter".
Choose your usual account.

Open the SDFix folder and double click on RunThis.bat to start the script.
Type Y and press Enter to begin the script.
It will start cleaning your PC and then prompt you to press any key to Reboot.
Press any key to restart the PC.
Your system will take longer than normal to restart as the fixtool will be removing files.
When the desktop loads the Fixtool will complete the removal and display Finished.
Press any key to end the script and to load your desktop icons.

A text file should automatically open, please upload that.

Please also upload a fresh HijackThis log.

Yes I agree it looks clean. The other thing I thought of is that the files you are referring to in the vault could be false positives. You mentioned they were important files to you. What are they? Were they created by you? You could upload them to Jotti or one of the others and have them scanned by several scanners.

Go to http://virusscan.jotti.org, click on Browse, and upload the following files for analysis, one at a time.

Hi Fritz,

Well I'd say since you are the creator I would hope you'd know whether they were safe or not ;)
AVG probably picked them up as bad because of the fact it didn't recognize them and they are executables...I'd say you're pretty safe and yes that is a false positive.

Good luck,
Dave