(Solved) Why didn't Avast Quick Scan

find this PUP?

and the question is?

Isn’t it obvious?

Why didn't Avast Quick Scan find this PUP
would be easier if you did not post half the question in the topic title and other half in the post, but the hole question in the post

Anyway, probably because it is in a location where quick scan does not scan … seems to be just a registry key / leftover

Quickscan = quick because it does not scan the hole computer :wink:

It is fairly obvious the detection is not a file but a Registry Key.

  • PUP or not a registry key without the associated file is inert.

What we can’t see is the complete text of the location in your image as it appears to be missing what the software is or any file name.

This is the location.

Still cant see the complete path, a screen shot from within the Quarantine would be much better.

Registry Keys: 1
PUP.Optional.InstantSupport, HKU\S-1-5-21-2432266188-2506439190-3645350612-1001\SOFTWARE\InSTab, Quarantined, [7e57587bd1c81a1c2c9739947d86e21e],

probably related to this

https://malwaretips.com/blogs/remove-instant-support-popup/

@Pondus,
I haven’t gotten any Instant Support pop-up ads.

PUP.Optional.InstantSupport, HKU\S-1-5-21-2432266188-2506439190-3645350612-1001\SOFTWARE\InSTab, Quarantined, [7e57587bd1c81a1c2c9739947d86e21e]
avast has probably blocked or removed it some time, when you scanned now avast detected the leftover registry key

Run a scan with Malwarebytes just to be sure the crap is gone

I just run a scan with MalwareBytes and it didn’t find anything.

That is what I thought, essentially an empty/inert registry entry, without an associated file. Not to mention that this is pointing at some sort of Quarantine location - for InSTab - I have absolutely no idea what this if for or what program this is associated with.

But there are indications it (InstantSupport) could be malware related - http://www.bleepingcomputer.com/virus-removal/remove-instant-support.

The reg key looks to be from a MBAM scan as Avast does not register reg keys just files

Yes - that is why -midnight was asking, why didn’t avast detect this.

But broken over the topic Subject and a continuation of that line in the post.

@DavidR,

MalwareBytes put this threat in Quarantine.

Great - from your above post/s it looks like MBAM is detecting its own quarantine entry as seen as a registry PUP. Colour me confused.

I thought it put the PUP in quarantine.

From your images clearly not - it might be able to delete the registry entry, but it can’t put it into quarantine as it isn’t a file. Unless it is able to export the registry key (.reg file), but none of your images or info shows that.

But as I have said, what gets me is MBAM detecting a registry entry that is for its own quarantine area.

I ran 3 more MalwareBytes scans and each one showed 0 threats so this PUP should be gone now?