Davebis Posted April 19, 2021 ID:1452054 Share Posted April 19, 2021 MB is alerting and quarantining the following file: C:\Program Files\AVAST Software\Avast\setup\instup.dll - this is when Avast has updated and needs a reboot of the device. I have checked this file on ViruTotal and it has not been found to be malicious: https://www.virustotal.com/gui/file/6cffbda20caaebe365dcbb9d4d104744cad8eac9d17e7f58e4cb21357c92ccd4/detection Link to post Share on other sites More sharing options...
TwinHeadedEagle Posted April 19, 2021 ID:1452057 Share Posted April 19, 2021 (edited) Hi, I couldn't reproduce the detection. Could you send as a detection report? Edited April 19, 2021 by TwinHeadedEagle Link to post Share on other sites More sharing options...
EddieF1 Posted April 19, 2021 ID:1452067 Share Posted April 19, 2021 Good Day We are also seeing this behaviour, is it a false positive? Link to post Share on other sites More sharing options...
TwinHeadedEagle Posted April 19, 2021 ID:1452076 Share Posted April 19, 2021 We need a scan log. It can be found on this location C:\ProgramData\Malwarebytes\MBAMService\ScanResults Sort by date and provide a latest one. Link to post Share on other sites More sharing options...
EddieF1 Posted April 19, 2021 ID:1452081 Share Posted April 19, 2021 Good Day I dont seem to have the C:\ProgramData\Malwarebytes\MBAMService\ScanResults path on this machine...possibly an older program version on this machine even though DB is the newest? Link to post Share on other sites More sharing options...
Staff shadowwar Posted April 19, 2021 Staff ID:1452083 Share Posted April 19, 2021 can you try here please? C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\Logs I scanned here and i am unable to reproduct with 1.x engine. Link to post Share on other sites More sharing options...
EddieF1 Posted April 19, 2021 ID:1452092 Share Posted April 19, 2021 Good Day Attached logs as requested, please let me know if you require anything else Regards MBAM Logs.zip Link to post Share on other sites More sharing options...
Staff shadowwar Posted April 19, 2021 Staff ID:1452093 Share Posted April 19, 2021 This should be fixed next update. I would recommend upgrading the the latest version of malwarebytes. It would of been immune from this false positive. Link to post Share on other sites More sharing options...
Tony41 Posted April 19, 2021 ID:1452202 Share Posted April 19, 2021 Hello, I am still getting the email alert stating "Trojan.Dropper Quarantined C:\Program Files\AVAST Software\Avast\setup\instup.dll". By any chance do you know if the fixed update has been pushed? Link to post Share on other sites More sharing options...
Staff shadowwar Posted April 19, 2021 Staff ID:1452229 Share Posted April 19, 2021 it was pushed in this update. 2021-04-19 2:41PM v2021.04.19.06 Link to post Share on other sites More sharing options...
JimA1 Posted April 20, 2021 ID:1452365 Share Posted April 20, 2021 I do not believe this has been fixed. I have the Malwarebytes database updated to version v2021.04.20.04 and Malwarebytes continues to show C:\Program Files\AVAST Software\Avast\setup\instup.dll as quarantined. I am unable to update the Avast application or its virus definitions. When I go into the Quarantine display it lists the Avast instup.dll four times with "Trojan.Dropper" shown in the "Vendor" column. If I select 'Restore All' or highlight any of the four listings of instup.dll and press 'Restore,' nothing happens and the items remain in the quarantine display. Please advise. Link to post Share on other sites More sharing options...
mbressman Posted April 20, 2021 ID:1452376 Share Posted April 20, 2021 Can confirm this still seems to be an issue even with the following update: Date: 2021/04/20 10:02:25 -0400 Database Version: v2021.04.20.05 I've added the file to the "Ignore List" but would prefer it just get fixed on Malwarebytes' end. Link to post Share on other sites More sharing options...
Staff Atribune Posted April 20, 2021 Staff ID:1452378 Share Posted April 20, 2021 Could you all please submit your logs from C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\Logs Thanks Link to post Share on other sites More sharing options...
Staff Atribune Posted April 20, 2021 Staff ID:1452383 Share Posted April 20, 2021 Also could you each please zip and attach the actual file that is being detected. Link to post Share on other sites More sharing options...
mbressman Posted April 20, 2021 ID:1452389 Share Posted April 20, 2021 No idea if the instup.dll file contains any sensitive information. Is there a secure way to send to you? Link to post Share on other sites More sharing options...
Staff Atribune Posted April 20, 2021 Staff ID:1452390 Share Posted April 20, 2021 I've sent you a PM. Link to post Share on other sites More sharing options...
EddieF1 Posted April 20, 2021 ID:1452408 Share Posted April 20, 2021 Good Day, Please find attached Logs.zip Link to post Share on other sites More sharing options...
Staff cli Posted April 21, 2021 Staff ID:1452434 Share Posted April 21, 2021 A new DB update was pushed with the fix. I scanned with the DB version v2021.04.21.01 and no longer see a detection. Please update your database and verify. Thanks. Link to post Share on other sites More sharing options...
mbressman Posted April 21, 2021 ID:1452435 Share Posted April 21, 2021 Just tried updating and then doing a right-click context menu custom scan with Malwarebytes of the C:\Program Files\AVAST Software\Avast\setup directory (after removing the file exception from malwarebytes) and it came back clean - so looks like the update fixed it. Thanks! Link to post Share on other sites More sharing options...
Staff cli Posted April 21, 2021 Staff ID:1452436 Share Posted April 21, 2021 Glad to hear. Thanks for confirming. :) Link to post Share on other sites More sharing options...
JimA1 Posted April 21, 2021 ID:1452437 Share Posted April 21, 2021 I still need some help at this point. I see the post from cli that a fix has been distributed and the response from mbressman that the fix worked. I have updated the Malwarebytes database to version v2021.04.21.01 but still have Avast instup.dll file showing four times in the Malwarebytes Quarantine listing. Pressing Restore All' or highlighting any of the four listings of instup.dll and pressing 'Restore' still does not remove any of them from the Quarantine listing. I tried to locate instup.dll in the Windows Explorer in the location shown in the Malwarebytes quarantine listing to do a right-click menu scan of it, but do not see the file shown in the Windows Explorer display. I am still unable to update the Avast software or its virus definitions. How can this be fixed? Link to post Share on other sites More sharing options...
Porthos Posted April 21, 2021 ID:1452439 Share Posted April 21, 2021 1 hour ago, JimA1 said: Pressing Restore All' or highlighting any of the four listings of instup.dll and pressing 'Restore' still does not remove any of them from the Quarantine listing. Please restart the computer before you ever try to UN quarantine an item. Link to post Share on other sites More sharing options...
JimA1 Posted April 21, 2021 ID:1452480 Share Posted April 21, 2021 5 hours ago, Porthos said: Please restart the computer before you ever try to UN quarantine an item. Porthos, thanks for your response and for the tip. I have restarted the computer and am still unable to remove the Avast instup.dll file from the quarantine list. Would appreciate it if someone could tell me what else i can do to remove the instup.dll from quarantine and regain the ability to update the Avast application and its virus definitions. Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted April 21, 2021 Root Admin ID:1452576 Share Posted April 21, 2021 Hello @JimA1 Let us get some logs please. Please download Farbar Recovery Scan Tool and save it to your desktop. Note: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit Double-click to run it. When the tool opens click Yes to disclaimer. Press the Scan button. It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply. The first time the tool is run, it also makes another log (Addition.txt). Please attach it to your reply as well. Thank you Link to post Share on other sites More sharing options...
JimA1 Posted April 22, 2021 ID:1452593 Share Posted April 22, 2021 Hi AdvancedSetup, Thanks for your response. I am attaching a 7z file with the First.txt and Addition.txt files generated from the scan done by the Farbar Recovery Scan Tool . Please let me know if I have provided you with what you asked for. Thanks again for your help! Farbar_Recovery_Logs_042121.7z Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now