windymiller

Home (Premium) 2.1.4.1018 Database version v2015.04.02.06 Suddenly detecting Trojan.Agent.ED in two of my Office 2003 files (winword.exe & gdiplus.dll). Is this a false positive? MBAM-protection log-20140402.txt OFFICE11 FILES.zip

Late last night, MBAM detected Backdoor.Bredavi in C:\Program Files\Quick View Plus\Program\en\qvpse3lo.dll Subsequent Quick Scan & Flash Scan were clean, but Full Scan found two further instances in restore files. Is this a newly-discovered threat in old files, or a False Positive? I deleted the quarantined file (is there any way to restore it, other than via my backups?), so can't attach it. But now see that the same threat has been detected in a file with the same name in a different folder: C:\Program Files\Quick View Plus\Program\c\qvpse3lo.dll This file is attached. I've also attached the developer-mode Full Scan log file. Please can you tell me whether this is a False Positive or a real infection? Many thanks. mbam-log-2011-11-29 (11-05-06).txt qvpse3lo.zip

Hello Mainard, Thanks for this. However, since I am using True Image v9, not 2011, I must repeat my original questions, namely - 1. Is there an equivalent 'workaround' for True Image v9 (An earlier poster, Dave Schimmel, had already posted this workaround for TI 2011)? And 2. Why have Malwarebytes not resolved this conflict, since they were first alerted to it in v1.45 and the software is now up to v1.50? (I don't personally understand what opening an Acronis image in R/W mode means, but I note that rmgalley above suggests that this workaround is a far from ideal solution. So I would hope that Malwarebytes are working on a proper fix for this?) Thanks, Ruth

Hello Mainard, Here are the OTL and ProcMon log files, as requested. I opened ProcMon immediately before clicking on "Proceed" to assign the drive letter for my plugged Acronis image. I left Acronis sitting at the "assigning drive letter to partition 1 of 1" message for just a few seconds before doing End Task on the Acronis application in Task Manager, and then closed ProcMon. I then had to power off the laptop (it wouldn't shut down). But the log file seems to be readable. I hope these help to track down the cause of the problem. Thanks, RuthMBAM Log.zip OTL.Txt Extras.Txt

Sorry, I made a typo in my previous post. I meant to write: ...with *all* versions of True Image, from v8 up to 2011

Hi Mainard, The issue is not with *creating* the Acronis backups. I can also do this without any problem. I can also successfully *check* the created archive. And I can restore individual files from the backup image. The issue, for myself and for other posters above (with *all* versions of True Image, from v8 up to 2001), is that we are unable to *PLUG* the created image, in order to browse the backed up folders & files. Acronis shows "assigning letter to partition 1 of 1" and then hangs indefinitely on that message. I have to End Task in Task Manager in order to get out of this screen. Please can you check whether you are able to plug your created backup images? I note that all of the posters above (myself included) are running Win XP SP3. So this might be a contributing factor. I will run OTL, as requested (although, unfortunately, I have installed several more apps on my laptop today). Regards, Ruth

Hello Mainard, Can I ask what this application does? Is it checking my laptop for malware? I am certain that my machine is clean, as I have just (yesterday) rebuilt it from scratch with a new hard drive. The only things I have installed so far are: - Windows XP, upgraded to SP3, with all Windows Updates - The necessary hardware drivers - McAfee AntiVirus Plus (latest version, downloaded yesterday) - MBAM PRO 1.50 - Firefox 4.0.1 - Cyberlink PowerDVD XP - Acronis TrueImage 9.0 Thanks, Ruth

With al00's post above, and my own recent experience, you can add Acronis TI v8 and v9.0 to the list. My first thought was that my version of ATI must be too old, and I was about to upgrade to the latest version in a bid to resolve this issue. I'm glad that I googled the problem first, and found this forum entry. Clearly I would have been no better off with the latest version of True Image. But, given that Malwarebytes were alerted to this issue in v1.45, I'm disappointed to find that the issue is still there in MBAM v1.50. And I'm surprised that more people haven't complained about the issue. Are there really so few of us using MBAM PRO and Acronis True Image (and XP SP3)? Or it is just that no-one else has connected the issue to MBAM? If any of the earlier posters is aware of any updates to this issue, I'd appreciate it if they could add a posting. Many thanks, Ruth Dell XPS M1710; Intel Core2 T7200 2GHZ, 3.25Gb RAM, Win XP Home SP3, McAfee AntiVirus Plus (v15.0?); Acronuis True Image 9.0 build 2,302; MBAM PRO 1.50

Dave, I have recently discovered this same problem with my copy of Acronis True Image 9.0 (and MBAM PRO 1.50). But I can't find the option you've suggested in my version of ATI. Do you know if there's an equivalent workaround in ATI 9.0? In my version, I select the image to plug in a screen titled "Backup Archive Exploring". But there's no "Optional Steps" anywhere on that screen or the next one. Many thanks, Ruth