AdwCleaner bad VirusTotal result 4/55

[bawldiggle]

AdwCleaner has been recommended from several quarters.

I have downloaded "adwcleaner_3.308.exe" from the author ...
https://toolslib.net/downloads/viewdownload/1-adwcleaner/

But scans by VirusTotal and Metascan return negative results

VirusTotal
- fresh scan 31-Aug-2014
https://www.virustotal.com/en/file/...2c3dcf6d9970ebf88de816b399eedce80b1/analysis/
- found FOUR threats
- 55 scan engines
1. CMC | Trojan.Win32.Generic!O
2. Cyren | W32/GenBl.9DED4724!Olympus
3. Kingsoft | VIRUS_UNKNOWN
4. Symantec | Trojan.Gen.SMH

Metascan
- historical scan 28-Aug-2014
https://www.metascan-online.com/en/scanresult/file/04deade535e34ded9122572979e4b875
- found ONE threat
- 40 scan engines
1. Filseclab | Trojan.Pirminay.aakt.xzed

I find it so frustrating to find a recommendation (even on sevenforums.com) only to be confronted with added crapware.

What gets me going is AdwCleaner is full of the crap that it boasts about detecting and removing

OpenCandy is not alone as sneakware. Babylon(fs) does not like being uninstalled.

Any ideas where I might find a clean adware detector and removal tool. Malwarebytes does not view "OpenCandy" as malware.

Thank you

 

[DavidE]

Malwarebytes does not view "OpenCandy" as malware.

For me Malwarebytes (Ver 2) does detect and quarantine "OpenCandy".
In Settings / Detection and Protection, set PUP protection to "Treat detections as malware".

 

[MoxieMomma]

Hi:

To add to DavidW7ncus's excellent advice about MBAM...

I suspect that the problem is not with AdwCleaner, but with the AV vendors who for many reasons (marketing/financial/etc) choose not to recognize many legitimate malware-removal tools from other sources. Essentially, the detection at VT would be considered a "False Positive".

AdwCleaner is used thousands of times a day at many computer disinfection forums.
And it is hosted at bleepingcomputer.com, which AFAIK, only hosts downloads that are "malware-free":
AdwCleaner Download

It sounds to me as if you might already be infected -- at least with PUPs/adware/junkware?
You might want to get some free, expert cleanup help, either here or at another computer disinfection forum?

<just a thought>

Cheers,

 

[Tookeri]

A tip: Always check on herdProtect too because they say they're good at detecting false positives!

Clean 0/68
A number of engines detected this file but were erroneous detections (false positives).
Malware scan of adwcleaner_3.308.exe 2b9afd04d0325d2cbaa3e3bf16a59b63e2ee35e1 - herdProtect

 

[DonnaB]

@ GrayGhost2,

I just downloaded AdwCleaner from here, both BC's and the authors site and both files offered were executables that downloaded straight to my desktop. You do not have to go through the install process which is where most of your crapware comes from during installation.

AdwCleaner is a "portable software", and some AV software may detect malware removal tools.

There is no crapware included in the executable downloads. Those are false positives and the AV databases need to be updated to prevent this.

 

[mjf]

The site
AdwCleaner Download
(CAUTION)
has been given as a download site previously.
and Norton quarantines it reporting Trojan "Trojan.Gen.SMH"

so I'd agree with GrayGhost2 and don't think it should be recommended at this stage.

 

[derekimo]

The site
AdwCleaner Download
(CAUTION)
has been given as a download site previously.
and Norton quarantines it reporting Trojan "Trojan.Gen.SMH"

so I'd agree with GrayGhost2 and don't think it should be recommended at this stage.

I doubt bleepingcomputer has any malicious content, it is a security based site.

I think we are dealing with a false positive, probably based on what it takes for Adwcleaner to do it's job.

Here's Norton's view on the site itself,

https://safeweb.norton.com/report/show?url=http://www.bleepingcomputer.com/

 

[mjf]

Yes Norton does consider the site secure. I could imagine it is possible to be false positives (by a number of anti virus software). Still, there is a dilemma in deciding to use it given that it is just an additional safety check.
Check a risk with a risk?

 

[Layback Bear]

It not a dilemma to me.

I use the Bleeping Computer site because I trust them.

I just downloaded it and scanned it with Malwarebytes, Super Anti Spyware, and Microsoft Security Essentials.
No problems found.

I do not use the authors site.
I can't read that site and the last time I ended up with a bunch of trash.

I have used Eset online scanner several times in the past when AdwCleaner was installed and it never flagged it.

Like many sites have reported about fake anti virus, and Malwarebytes programs their is a good chance that their are fake AdwCleaner also.

Seem like when a product works and becomes popular someone makes a fake.

 

[derekimo]

Here is the authors site,

https://toolslib.net/downloads/viewdownload/1-adwcleaner/

Interesting to note, the last commenter says the same thing you did about Norton flagging it.

I just tried to report this to Norton as a possible false positive but they want something from a log or clipboard and I don't have Norton.

Would you mind submitting it Michael?

https://submit.symantec.com/false_positive/standard/

 

[Layback Bear]

Update.

I just run complete scan with MSE, SAS and Malwarebytes of my complete system. AdwCleaner was installed and none of them found a problem with my system.
I then ran a sfc /scannow everything was fine.
I then remove AdwCleaner using the program.
**After that you will have to remove the logs because they are left behind after removing AdwCleaner.
Then I check regedit and did find 1 AdwCleaner.exe
So it does leave a little foot print behind after removing it and its logs.

Before you ask; yes I can run all those scans one at a time that fast. The only quick scan I ran was MSE. I will run a full scan with MSE in a minute.
MSE really doesn't run slow it just seem to check in lots of places.
I'm running it now. It's using from 14 to 30% cpu but very little ram.

Edit: MSE long scan found nothing.

 

[derekimo]

I submitted the false positive report to Norton anyway, it might help if a Norton user would submit it as well to give them the other info they wanted.

 

[andrew129260]

What usually happens in this scenario is someone clicks an ad or the wrong download link, or another page and gets a free toolbar or whatever with it.

Some scanners used by virus total are detecting the way the program behaves, not necessarily marking it as a threat, but suspicious. Anti-virus software of all types will usually analyze the file and see how it works and what it does when executed. Jrt, adwcleaner can all be detected like this due to the way they work.

Bleeping computer is the only site you should get it from, not download.com or anywhere else.

This is the download button one should click: (nothing else)

 

[derekimo]

I submitted the false positive report to Norton anyway, it might help if a Norton user would submit it as well to give them the other info they wanted.

Their response:

In relation to submission [3609337].

Upon further analysis and investigation we have verified your submission and as such this detection will be removed from our products.

The updated detection will be distributed in the next set of virus definitions, available via LiveUpdate or from our website at Virus Definitions & Security Updates - Symantec Corp.

Decisions made by Symantec are subject to change if alterations to the Software are made over time or as classification criteria and/or the policy employed by Symantec changes over time to address the evolving landscape.

 

[mjf]

With the latest (at time of this post) definitions and security updates I get

They appear to give the site a tick as you'd expect but not the exe.

Update: Eventually accepted as OK!

 

[Jacee]

Good job derekimo!!

 

[andrew129260]

@MJF,

They may have removed it from there definitions, but Heuristics will still probably flag it due to the way it is coded/works.

http://internet-security-suite-revi...s/what-is-heuristic-antivirus-detection-.html

 

[derekimo]

Good job derekimo!!

Thanks Jacee.

@MJF,

They may have removed it from there definitions, but Heuristics will still probably flag it due to the way it is coded/works.

What is Heuristic Antivirus Detection? - TopTenREVIEWS

Check his edit, they finally cleared it.

 

[andrew129260]

Good news

 

[cyrilhubert]

Update.

I just run complete scan with MSE, SAS and Malwarebytes of my complete system. AdwCleaner was installed and none of them found a problem with my system.
I then ran a sfc /scannow everything was fine.
I then remove AdwCleaner using the program.
**After that you will have to remove the logs because they are left behind after removing AdwCleaner.
Then I check regedit and did find 1 AdwCleaner.exe
So it does leave a little foot print behind after removing it and its logs.

CCleaner may be, clean up the left behind regedit.