AVast und Acronis

[Asyn]

Nachdem MBAM fündig wurde, bitte auch die restlichen Logs posten. (1./3./4.)

[Seuche]

Also eine Extras.txt öffnet sich nicht.
Hier die restlichen Logs.

[Asyn]

1. AdwCleaner mit der Option "Löschen" (lt. Anleitung) ausführen und das neue Log posten.
2. Danach auch OTL (nach Anleitung) erneut laufen lassen und das neue Log posten.

PS: Verstehst du auch Englisch..??

[Seuche]

Den Adware-Cleaner hatte ich schon mit der Option Löschen laufen lassen.
Der SCan-von OTL war nach dem Löschen von Adware-Cleaner. Ich habe ihn trotzdem erneu laufen lassen.  Es bleibt dabei, dass sich keine Extras.txt öffnet.

Englisch ist kein Problem.

[Asyn]

1. Den Adware-Cleaner hatte ich schon mit der Option Löschen laufen lassen.
2. Der SCan-von OTL war nach dem Löschen von Adware-Cleaner. Ich habe ihn trotzdem erneu laufen lassen.  Es bleibt dabei, dass sich keine Extras.txt öffnet.

3. Englisch ist kein Problem.

1. OK, war aus deinem ersten Log nicht ersichtlich.
2. Gut, ist nicht so schlimm.
3. Wunderbar, ich informiere jetzt einen unserer Experten, er wird deine Logs analysieren. (Bitte etwas Geduld.)

[Seuche]

Vielen Dank für den tollen Support!

[Asyn]

Vielen Dank für den tollen Support!

Sehr gerne..!!

[essexboy]

I feel we are looking at two false positives here, Avast on the Acronis backups and MBAM on the TDSS reg key

All I can see is a few waifs and strays
How is the computer behaving ?

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

Run OTL

• Under the Custom Scans/Fixes box at the bottom, paste in the following
  
  
  

Code: [Select]

:OTL
IE:64bit: - HKLM\Software\Microsoft\Internet Explorer\SearchURL\e,# = %23
IE:64bit: - HKLM\Software\Microsoft\Internet Explorer\SearchURL\e,& = %26
IE:64bit: - HKLM\Software\Microsoft\Internet Explorer\SearchURL\e,? = %3F
IE:64bit: - HKLM\Software\Microsoft\Internet Explorer\SearchURL\e,+ = %2B
IE:64bit: - HKLM\Software\Microsoft\Internet Explorer\SearchURL\e,= = %3D
IE:64bit: - HKLM\Software\Microsoft\Internet Explorer\SearchURL\eb,# = %23
IE:64bit: - HKLM\Software\Microsoft\Internet Explorer\SearchURL\eb,& = %26
IE:64bit: - HKLM\Software\Microsoft\Internet Explorer\SearchURL\eb,? = %3F
IE:64bit: - HKLM\Software\Microsoft\Internet Explorer\SearchURL\eb,+ = %2B
IE:64bit: - HKLM\Software\Microsoft\Internet Explorer\SearchURL\eb,= = %3D
IE:64bit: - HKLM\Software\Microsoft\Internet Explorer\SearchURL\eba,# = %23
IE:64bit: - HKLM\Software\Microsoft\Internet Explorer\SearchURL\eba,& = %26
IE:64bit: - HKLM\Software\Microsoft\Internet Explorer\SearchURL\eba,? = %3F
IE:64bit: - HKLM\Software\Microsoft\Internet Explorer\SearchURL\eba,+ = %2B
IE:64bit: - HKLM\Software\Microsoft\Internet Explorer\SearchURL\eba,= = %3D
IE:64bit: - HKLM\Software\Microsoft\Internet Explorer\SearchURL\ebay,# = %23
IE:64bit: - HKLM\Software\Microsoft\Internet Explorer\SearchURL\ebay,& = %26
IE:64bit: - HKLM\Software\Microsoft\Internet Explorer\SearchURL\ebay,? = %3F
IE:64bit: - HKLM\Software\Microsoft\Internet Explorer\SearchURL\ebay,+ = %2B
IE:64bit: - HKLM\Software\Microsoft\Internet Explorer\SearchURL\ebay,= = %3D
FF - prefs.js..extensions.enabledAddons: plugin@yontoo.com:1.20.00
O3 - HKU\S-1-5-21-3317819263-2815075959-1927655280-1000\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKU\S-1-5-21-3317819263-2815075959-1927655280-1000\..\Toolbar\WebBrowser: (no name) - {40C3CC16-7269-4B32-9531-17F2950FB06F} - No CLSID value found.
O3 - HKU\S-1-5-21-3317819263-2815075959-1927655280-1000\..\Toolbar\WebBrowser: (no name) - {C424171E-592A-415A-9EB1-DFD6D95D3530} - No CLSID value found.

:Commands
[resethosts]
[emptytemp]
[CREATERESTOREPOINT]
[Reboot]

• Then click the Run Fix button at the top
  
• Let the program run unhindered, reboot the PC when it is done
• Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

[Seuche]

Was it okay to fix it not for all users, as shown on your reply?
Here are the logs.

The system has sometimes problems with the internet-explorer. It says that the ie is not working correct and the that he is looking  for a solution. After clicking on okay the system works propper again for hours or days.

[essexboy]

It may be worth updating to IE 10 http://ie.microsoft.com/testdrive/info/downloads/default.html

Apart from that is all well

[Seuche]

Okay, but we have still the problem from the beginning.
I did a new backup after cleaning all and restart.
Backup was the system drive C:\. And after a scan with avast to the acronis-backup-files i found this.



So the interpretation of the acronis files and the scan to c: must be different.

[essexboy]

That is .. As far as I can see a false positive on Avast's part and may be due to the way the files are packed

[Seuche]

So you think, that there are no virus in the tib-file?

[essexboy]

That is my assessment, yes they are clean

[Seuche]

Okay, thanks a lot!