Classes.dex and virus scan

[djm2305]

Hi All,

I've been using B4A V1.80 for a while and have a simple project I was working on learning B4A. Today I noticed there was a V1.92, so I downloaded it and installed it over the top.

Now my simple project will not compile as the CA virus scanner keeps quarantining the classes.dex file each time.

This was also happening with V1.80, but I found an answer in these forums and replaced the Designer.apk with a later one and this issue went away.

I have tried using the 'good' Designer.apk with B4A V1.92 but it does not solve the problem this time.

I have AV scanned the whole B4A installation and there are no virus detected. I have updated CA A/V to the latest definitions as well.

If I compile my application, then CA A/V triggers and the compile never completes.
(This was all working fine 2 hours ago before updating to V1.92.)

CA A/V claims classes.dex contains the AndroidOS/SMSTroj.C!generic virus.

I have installed B4A V1.90 over the top and this issue has gone away.

I have installed B4A V1.92 again over the top and the virus scanner is triggering again on classes.dex when compiling.

I think I will wait for V1.93..

Regards,
Darryl

 

[Erel]

Designer.apk is not related in anyway with classes.dex. Classes.dex is the result of compiling your code with the official Android SDK tool. This is a false positive.

 

[Kevin]

I would agree with Erel that it is a false positive. While I haven't seen your specific problem, I have seen many false positives before.

Most virus scanners offer a way of ignoring certain files. I'd check into how to go about doing that with your virus software.


Long rambling begins here........
I don't know how similar it is, but this reminds me of a problem I had with one of my Windows programs a while back. I had several customers complaining of my program containing a key logger, and after looking into it I realized that there was a legitimate keystroke logger (generally for corporations who spy on their employees) that happened to use the same 3rd party imaging component as my software.

Because the people who designed the virus software didn't really know what they were dealing with, they flagged the component itself as a key logger virus. This happened with two different virus software brands and I was able to get both of them to correct the false positive. As I pointed out to them... just because a known virus uses a Windows component (OCX/DLL) does not mean that the component's mere presence indicates a virus. If a known virus used MSCOMCTL.DLL (a common windows component) would they flag that component's mere presence as a virus? I think not.

You might want to also consider contacting them to correct your problem too.

 

[pluton]

I think that your Antivirus reporting LeadBolt Ads.

Look at my log in Eset Smart Security 4:

 

[wonder]

Sorry to resurrect an old topic, but I'm getting the following error in Filezilla:

Status:    Connected
Status:    Starting upload of C:\Users\Bruno\Desktop\HyperBlox\Objects\HyperBloX.apk
Command:    CWD /public_html/stuff
Response:    250 CWD command successful
Command:    PWD
Response:    257 "/public_html/stuff" is the current directory
Command:    SIZE HyperBloX.apk
Response:    550 SIZE not allowed in ASCII mode
Command:    TYPE I
Response:    200 Type set to I
Command:    PASV
Response:    227 Entering Passive Mode (66,96,162,133,81,105)
Command:    STOR HyperBloX.apk
Response:    150 Opening BINARY mode data connection for HyperBloX.apk
Response:    550-Virus Detected and Removed: Andr.Trojan.Locker
Response:    550 HyperBloX.apk: Operation not permitted
Error:    File transfer failed after transferring 10,346,102 bytes in 34 seconds

Response: 550-Virus Detected and Removed: Andr.Trojan.Locker

My app uses the following libs:

What can I do?

 

[Erel]

Create a new project and add the libraries one after another to see which library causes it.

 

[wonder]

Thanks!

So far I've removed AdBuddiz and I'm still getting the same error. I'm not entirely sure, but this happened after I added Encryption. Could it be?

 

[Erel]

There is no virus in the Encryption library. Maybe it creates a false alarm because of the encryption related methods.

 

[NJDude]

It seems the scanner ClamWin is to blame, so far, that's the only one reporting that virus (Andr.Trojan.Locker).

 

[wonder]

There is no virus in the Encryption library. Maybe it creates a false alarm because of the encryption related methods.

I compiled an empty project, using nothing more than the Core lib.
Still getting the virus warning:
Response: 550-Virus Detected and Removed: Andr.Trojan.Locker