Software Updater and Open Candy

[bob3160]

The cause of the anomaly between the Boot Time AVAST scan report and an ordinary AVAST scan is probably simply because, by default, all AVAST's AV scan setting options have PUP detection turned off. Unless you enable it AVAST doesn't scan for PUPs.

However  the Boot Time option scans for everything and by default PUP detection is turned on. It can be turned off in the Boot Time scan Settings.

To get rid of Open Candy I'd do a manual scan with free Malwarebytes or Spybot. When I last had Open Candy sneak onto my computer both picked it up during my regular weekly scans.

How it got on to my system when I have AVAST set to include PUPs and everything I download manually is scanned with Malwarebytes as well suggests it was integrated into some otherwise trustworthy installer or update software.

Read the entire post, this has nothing to do with installing open candy through an installer.

[Pondus]

as it sounds a bit strange that an AV product detects a DLL of their own?

That is strange, have reported your post to avast as possible FP

you may upload the file to virustotal.com and check .... remeber to click rescan if scanned before to get a fresh result

[bob3160]

as it sounds a bit strange that an AV product detects a DLL of their own?

That is strange, have reported your post to avast as possible FP

you may upload the file to virustotal.com and check .... remeber to click rescan if scanned before to get a fresh result

Not really strange, it was a boot time scan so it checks for PUP's

[Pondus]

as it sounds a bit strange that an AV product detects a DLL of their own?

That is strange, have reported your post to avast as possible FP

you may upload the file to virustotal.com and check .... remeber to click rescan if scanned before to get a fresh result

Not really strange, it was a boot time scan so it checks for PUP's

So avast detecting a avast file as PUP is not strange?  >  aswRec.dll

[bob3160]

as it sounds a bit strange that an AV product detects a DLL of their own?

That is strange, have reported your post to avast as possible FP

you may upload the file to virustotal.com and check .... remeber to click rescan if scanned before to get a fresh result

Not really strange, it was a boot time scan so it checks for PUP's

So avast detecting a avast file as PUP is not strange?  >  aswRec.dll

No, open candy is a PUP.
What is strange is that it's contained within Avast. It was to have been removed some time ago.
That's strange that it has re-appeared.

[REDACTED]

 A boot time scan isn't meant to be run by a novice.
[/quote]
But if this is the case since most of Avast users are novices an option as boot time scan then should not be advised so easily or at least should be remarked with due warnings which is not the case.

[bob3160]

A boot time scan isn't meant to be run by a novice.

But if this is the case since most of Avast users are novices an option as boot time scan then should not be advised so easily or at least should be remarked with due warnings which is not the case.
No argument from me. But, that's up to Avast and would probably be a good idea.

[REDACTED]

as it sounds a bit strange that an AV product detects a DLL of their own?

That is strange, have reported your post to avast as possible FP

you may upload the file to virustotal.com and check .... remeber to click rescan if scanned before to get a fresh result

Not really strange, it was a boot time scan so it checks for PUP's

So avast detecting a avast file as PUP is not strange?  >  aswRec.dll

This is exactly why I have even mentions this today, FP are everyday issues but for an AV Software vendor to FP their own program structure is a bit concerning in my opinion

[bob3160]

as it sounds a bit strange that an AV product detects a DLL of their own?

That is strange, have reported your post to avast as possible FP

you may upload the file to virustotal.com and check .... remeber to click rescan if scanned before to get a fresh result

Not really strange, it was a boot time scan so it checks for PUP's

So avast detecting a avast file as PUP is not strange?  >  aswRec.dll

This is exactly why I have even mentions this today, FP are everyday issues but for an AV Software vendor to FP their own program structure is a bit concerning in my opinion
 

The detection was for Open Candy which isn't a false detection. Open Candy is a PUP.

[Cluster-Lizard2014]

The cause of the anomaly between the Boot Time AVAST scan report and an ordinary AVAST scan is probably simply because, by default, all AVAST's AV scan setting options have PUP detection turned off. Unless you enable it AVAST doesn't scan for PUPs.

However  the Boot Time option scans for everything and by default PUP detection is turned on. It can be turned off in the Boot Time scan Settings.

To get rid of Open Candy I'd do a manual scan with free Malwarebytes or Spybot. When I last had Open Candy sneak onto my computer both picked it up during my regular weekly scans.

How it got on to my system when I have AVAST set to include PUPs and everything I download manually is scanned with Malwarebytes as well suggests it was integrated into some otherwise trustworthy installer or update software.

Read the entire post, this has nothing to do with installing open candy through an installer.

I did read the posts and I didn't mean my later comments to imply that's how Open Candy got onto his system although who does know how it got there? Assuming it is OC and it is there, isn't it? Is that not of some importance?

The concern was twofold: 1). it being there and 2). why the Boot Time scan flagged up this problem but manual scans by AVAST and Malwarebytes didn't. I was just suggesting a possible reason for the latter; surely it's worth checking the simple things first. 

Malwarebytes not picking it up is more problematic but that too has the PUP detection setting: "Do Not Show In Results List" which may have been enabled. It also doesn't always get everything which is why a second scan by something else might be worth doing, if not Spybot then maybe AdwCleaner.

I keep on reading here that the Boot Time scan is a big boys tool and shouldn't be used by novices. But if AVAST finds anything on your computer and you remove it or send it to the Virus Chest it automatically recommends you do a boot time scan and and gives you the option to start it immediately.

Would many novices having just been told something nasty has been removed from their system think twice about that? They'd go ahead because AVAST has told them to do it.

So, IMHO, AVAST has to take much of the responsibility for them doing what they've been told to do if something then goes wrong or the scan flags up more problems prompting posts in this forum.           

[Pondus]

as it sounds a bit strange that an AV product detects a DLL of their own?

That is strange, have reported your post to avast as possible FP

you may upload the file to virustotal.com and check .... remeber to click rescan if scanned before to get a fresh result

Not really strange, it was a boot time scan so it checks for PUP's

So avast detecting a avast file as PUP is not strange?  >  aswRec.dll

This is exactly why I have even mentions this today, FP are everyday issues but for an AV Software vendor to FP their own program structure is a bit concerning in my opinion
 

The detection was for Open Candy which isn't a false detection. Open Candy is a PUP.

It is a FP if the file does not contain OpenCandy .... something that can be checked at VT

[MartinZ]

Yep Open Candy is PUP but the situation is really weird as it isn't included in the DLL. We had OC integrated for few months but that was approx 2 years ago...What avast version you have? and what file version is the aswRec.dll, please?
Thanks