Jump to content

AVAST instup.dll detected as a Trojan.Dropper


Recommended Posts

MB is alerting and quarantining the following file: C:\Program Files\AVAST Software\Avast\setup\instup.dll - this is when Avast has updated and needs a reboot of the device.

I have checked this file on ViruTotal and it has not been found to be malicious: https://www.virustotal.com/gui/file/6cffbda20caaebe365dcbb9d4d104744cad8eac9d17e7f58e4cb21357c92ccd4/detection

 

Link to post
Share on other sites

Hello,

 

I am still getting the email alert stating "Trojan.Dropper Quarantined      C:\Program Files\AVAST Software\Avast\setup\instup.dll". By any chance do you know if the fixed update has been pushed?

Link to post
Share on other sites

I do not believe this has been fixed.  I have the Malwarebytes database updated to version v2021.04.20.04 and Malwarebytes continues to show C:\Program Files\AVAST Software\Avast\setup\instup.dll as quarantined.  I am unable to update the Avast application or its virus definitions.  When I go into the Quarantine display it lists the Avast instup.dll four times with "Trojan.Dropper" shown in the "Vendor" column.  If I select 'Restore All' or highlight any of the four listings of instup.dll and press 'Restore,' nothing happens and the items remain in the quarantine display.  Please advise.

Link to post
Share on other sites

Can confirm this still seems to be an issue even with the following update:

Date: 2021/04/20 10:02:25 -0400
Database Version: v2021.04.20.05

I've added the file to the "Ignore List" but would prefer it just get fixed on Malwarebytes' end. 

Link to post
Share on other sites
  • Staff

A new DB update was pushed with the fix. I scanned with the DB version v2021.04.21.01 and no longer see a detection. Please update your database and verify. Thanks.

Link to post
Share on other sites

Just tried updating and then doing a right-click context menu custom scan with Malwarebytes of the C:\Program Files\AVAST Software\Avast\setup directory (after removing the file exception from malwarebytes) and it came back clean - so looks like the update fixed it.  Thanks!

Link to post
Share on other sites

I still need some help at this point.  I see the post from cli that a fix has been distributed and the response from mbressman that the fix worked.  I have updated the Malwarebytes database to  version v2021.04.21.01 but still have Avast instup.dll file showing four times in the Malwarebytes Quarantine listing.  Pressing Restore All' or highlighting any of the four listings of instup.dll and pressing 'Restore' still does not remove any of them from the Quarantine listing.  I tried to locate instup.dll in the Windows Explorer in the location shown in the Malwarebytes quarantine listing to do a right-click menu scan of it, but do not see the file shown in the Windows Explorer display.  I am still unable to update the Avast software or its virus definitions.  How can this be fixed? 

Link to post
Share on other sites
1 hour ago, JimA1 said:

Pressing Restore All' or highlighting any of the four listings of instup.dll and pressing 'Restore' still does not remove any of them from the Quarantine listing. 

Please restart the computer before you ever try to UN quarantine an item.

Link to post
Share on other sites
5 hours ago, Porthos said:

Please restart the computer before you ever try to UN quarantine an item.

Porthos, thanks for your response and for the tip. 

 

I have restarted the computer and am still unable to remove the Avast instup.dll file from the quarantine list.  Would appreciate it if someone could tell me what else i can do to remove the instup.dll from quarantine and regain the ability to update the Avast application and its virus definitions.

Link to post
Share on other sites
  • Root Admin

Hello @JimA1

Let us get some logs please.

 

Please download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system.
You can check here if you're not sure if your computer is 32-bit or 64-bit

  • Double-click to run it. When the tool opens click Yes to disclaimer.
  • Press the Scan button.
  • It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
  • The first time the tool is run, it also makes another log (Addition.txt). Please attach it to your reply as well.

Thank you

 

 

Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    No registered users viewing this page.

Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.