Android Question avast antivirus: all app deveolped with B4A result infected HiddenAds-DB

[Fabio Campanella]

Hello everyone. For a few days, all the APPs developed with B4A have become infected with the virus in question. Even if I always recompile the APP this problem. Yesterday I published an update on the Google Play Store but I didn't get any reports from google.
Are they false positives?
How do I tell my customers they should ignore this report? Is there a solution to the problem?
Thanks at all!!

Fabio

 

[Deleted member 103]

Is there a solution to the problem?

Yes! Simply uninstall the antivirus program.

 

[Erel]

1. Make sure to use your own private signing key.
2. Do you get this warning with the app downloaded from Google Play?

 

[Fabio Campanella]

1. Make sure to use your own private signing key.
2. Do you get this warning with the app downloaded from Google Play?

I Erel,
1. I Use multiple private signing key...
2. No, is verified by play protect.

 

[Erel]

1. Not needed but not relevant.
2. So just ignore that warning during detection or uninstall the overaggressive anti-virus.

 

[Fabio Campanella]

1. Not needed but not relevant.
2. So just ignore that warning during detection or uninstall the overaggressive anti-virus.

Yes Erel, the problem is that it occurs on some of my customers as well as on my mobile phone. How do I tell my client to uninstall the antivirus? : (... oh well ... I try to communicate to avast antivirus staff each of my APP and that they are false positives. Thanks anyway for your support.

 

[Dmitriy]

Same problem. Players in my game write about this in reviews on Google Play. They also write in support of Google Play, and Google recommends removing the application.

 

[Erel]

Let me say it clearly, there are no hidden ads (or anything else hidden) in your projects.

Players in my game write about this in reviews on Google Play. They also write in support of Google Play, and Google recommends removing the application.

Can you post a link to your app? Are you using your own private sign key?

 

[Deleted member 103]

How do I tell my client to uninstall the antivirus?

Tell all your customers that it is not necessary to have an antivirus on an Android smartphone.
The harm is greater than the benefits.

 

[Alvsky]

Hi all
I was just about to go write the same question and I found this thread.

So I am having the same problem. Avast and AVG recognizes the app as a threat.

This usually happens to all users with Huawei and Xiaomi devices as they have Avast as integrated AV program.

Problem is that users get the warning all the time and eventually has to remove the app.

I also use my private sign key and the app was downloaded from Google Play

This actually happened these days since I tested an old version of my app and it's also "infected"

 

[Erel]

You should report it as false positive: https://www.avast.com/false-positive-file-form.php

 

[Dmitriy]

Thanks. I hope that avast will remove its error from the database

 

[Pendrush]

Same virus alert is shown on Huawei and Xiaomi devices, this lead to mass app uninstall and one star rating on play store.
All my B4a apps are affected.

 

[marcick]

You should report it as false positive: https://www.avast.com/false-positive-file-form.php

Same problem.
Should I have to upload there my apk ? Or just a link to the playstore app ?

 

[Fabio Campanella]

Same problem.
Should I have to upload there my apk ? Or just a link to the playstore app ?

You have to upload your apk.

 

[Erel]

BTW, I tested it with B4A-Bridge APK and it didn't detect anything: https://www.virustotal.com/gui/file...4d5ba5b02d5dd09bc0edd7905384447f2a8/detection

Are you showing any ads? Using Firebase?

Continue reporting the false detections.

 

[marcick]

Virus total detect something on my apk.
I'm not showing any ads and yes, I'm using firebase for notifcations.

 

[Erel]

Make sure to report it.

 

[Alex_197]

I might be mistaken but it looks like China and the USA war. So Chinese cell phones will not recognize (or make you uninstall) and apps from the Google play market.

 

[marcick]

I have tested with VirusTotal an older version of my app and it doesn't report the HiddenAds infection.
So I have continued to upload all the newer versions to see where this issue start and it is between version 2.07 to 2.08.
In the code there is just a bug fix in 2.08, but looking to AndroidManifest.xml I see a difference:

This is 2.07 without infection

         <service android:name="com.google.firebase.components.ComponentDiscoveryService" >
                    <meta-data
                        android:name="com.google.firebase.components:com.google.firebase.analytics.connector.internal.AnalyticsConnectorRegistrar"
                        android:value="com.google.firebase.components.ComponentRegistrar" />
                     <meta-data
                        android:name="com.google.firebase.components:com.google.firebase.iid.Registrar"
                        android:value="com.google.firebase.components.ComponentRegistrar" />
        </service>

and this is 2.08 with infection

 <service android:name="com.google.firebase.components.ComponentDiscoveryService" >
                    <meta-data
                        android:name="com.google.firebase.components:com.google.firebase.analytics.connector.internal.AnalyticsConnectorRegistrar"
                        android:value="com.google.firebase.components.ComponentRegistrar" />
                     <meta-data
                        android:name="com.google.firebase.components:com.google.firebase.iid.Registrar"
                        android:value="com.google.firebase.components.ComponentRegistrar" />
                     <meta-data
                        android:name="com.google.firebase.components:com.google.firebase.auth.FirebaseAuthRegistrar"
                        android:value="com.google.firebase.components.ComponentRegistrar" />
        </service>

The text in the Manifest editor is identical between the two versions.
I don't know if this can be of interest to experts.

Edit: vs 2.07 was compiled on 29 Jun 2018, while 2.08 on 02 Nov 2018. Probably with some different library version or B4A version