PUP not detected by avast.

[davexnet]

Here's the virustotal info
https://www.virustotal.com/en/file/161ae070c0ae04e550d583535e14b546b927ed13bb173a3a6e4ad5bb4aeefe06/analysis/1398443523/

Malwarebytes recognized and quarantined it.

[Secondmineboy]

Go to settings>Active protection>File system/Web shield and to second option from the bottom in the left list, choose scan for potentially unwanted programs.

[Eddy]

HaHaHa, not detected?
Avast : NSIS:InstMonetizer-AW [PUP]

[CraigB]

Looks like avast has detected it to me.

[davexnet]

yes - I see it in the virustotal report.  However, I kept a copy of the folder that contains this item
(4 files in a folder within the local settings\temp directrory) .  When Malwarebytes detected it
and before it was quarantined I copied this folder to a separate drive.  After MBAM free quarantined
the original files, I scanned the copied folder with avast and it didn't detect anything.

Perhaps my pattern is not up to date?  I'll check.

It's not that - I right click the folder, scan it, and it says no threat detected.
As far as I can see, I do have PUP activated with avast! free.

[Paul_D]

This thread simply highlights the fact that there is no one size fits all Malware fighter, and there never will be. So Avast didn't detect one PUP. Big deal.

Avast's primary function is viruses.

MalwareBytes is the most aggressive PUP hunter.

SuperAntiSpyware is the most aggressive cookie cleaner.

Furthermore, the key word in PUP is "Potentially". One man's unwanted program may be another man's highly desirable deliberately installed program. I have a few of those. The only qualification for a PUP is that it may have been installed by stealth. Technically, Chrome is a PUP, although as far as I know none of the PUP hunters look for it.

[davexnet]

I see what you're saying, but there's more to the issue.
The virustotal report I linked to shows that avast!detects it.

However, when I scan the same files on my system, there is no detection.

How many places within the GUI does one have to check/enable detection of PUP?

Perhaps somewhere during the avast! installation, there should be a big question -
"Do you want avast!to detect Potentially Unwanted Programs yes/no ?"

Regarding the PUP setting on this screen.  I set it, but then I check it later and it's unchecked again.
Is this supposed to be a permanent setting or not?

[Pondus]

The only qualification for a PUP is that it may have been installed by stealth.

Malwarebytes PUP criteria. http://www.malwarebytes.org/pup/

[Para-Noid]

Once you tick a box then click "OK" the setting should stick.
Which version of v2014 are you running?

The reason the PUP's are not ticked is that many users wouldn't know the difference between a "good" PUP and a "bad" PUP.
That said, some PUP's are good, while others are not good. The keyword is "potentially".

[DavidR]

@ davexnet
I would say that the difference in VT finding it is that they would have the scan settings set to scan for PUPs.

You have found one area to enable PUPs scanning, but that is for the on-demand scans (needs to be set for each scan type, see below), which personally I don't bother with. As most of the files scanned in an on-demand scan are either dormant or inert, then the point in checking is lessened. The avastUI > Settings > Active Protection > File System Shield is the on-access resident scanner and you can/should set that to check for PUPs if that is what you want.

If I remember the Web Shield is set to scan for PUPs, if not that is an other area, the Mail Shield also has a PUPs scanning option, this is off by default I believe.

Why it isn't being detected in the on-demand scan rather depends on which scan you have set it on. Each different on-demand scan Quick; Full System Scan; Custom scan, etc. has to be set to scan for PUPs. Is it possible that you have set it for only one scan but are running a different scan.

[davexnet]

When I look at (right click the  avast icon)/open avast user interface/scan/settings/sensitvity
it show that scan for PUPs is checked.

However, when I using Windows Explorer and I navigate to the folder containing this PUP,
I right click the folder/scan.  After 10 seconds or so a box opens up and tells me
SCAN COPMPLETE - no threat found.  In this same box on the right you see "settings".
Clicking on this brings me back to the similar "avast scan settings".  Clicking on "sensitivity"
(on the left) now shows "scan for PUPs to be unselected.  Something odd going on here.

Secondly, as I mentioned, using avast this way does not detect anything amiss,
yet the avast entry in virustotal detects it.

I can upload the folder if you'd like to test this.
EDIT I've just DavidR's new post, David I do have PUP selected, but see the anomaly I mentioned above.
Perhaps you can tst this for me.

[DavidR]

I can't really check it as I don't have anything on my system that would be classified as a PUP to scan.

However according to this you aren't setting the correct one for the explorer scan.

When I look at (right click the  avast icon)/open avast user interface/scan/settings/sensitvity
it show that scan for PUPs is checked.

The Explorer scan settings are in a different place avastUI > Settings > Antivirus - scroll down to 'Special Scans' and use the Settings > Sensitivity option. But by default the explorer scan (AshQuick.exe) is the most thorough scan and it should scan for PUPs.

If not than at some point I have set it to scan for PUPs and that setting remains set. See image, whilst my image settings broadly look similar, all of the various Sensitivity setting screens look similar, so we really need to know which one you are looking at. e.g. is it the same one I mentioned, avastUI > Settings > Antivirus - scroll down to 'Special Scans' and use the Settings > Sensitivity ?

[davexnet]

DavidR,
you're right, I had not turned on PUP scanning in the "special scans" you mentioned.
Once I did that, the PUP was detected in Windows Explorer/right click.

It seems the GUI has room for improvement.  Too many places you have to remember.
Thanks for the tips!

One interesting thing, although it's detected by this explorer scan, I can still use copy/paste in explorer to
 move the infected file from one location to another with impunity.  Shouldn't be detected there also?

Dave

[DavidR]

You're welcome.

[davexnet]

DavidR, 
please see my update above, I added another circumstance.
regards -
Dave