Getting false antivirus warnings on your Android APK?

CodeWizard

So, we've been in contact with a couple of antivirus providers about the false positives they're generating on some of your live Android projects. We're looking for more details though. If you've seen reports of false positives on your apps please take a moment to upload your APK to http://virustotal.com and report back the scan result link.

We're trying to get more samples to help pinpoint the issue. At this point it looks like it may be some vestigial Mobwin code. But, more info would be super helpful!

Here's an example link you can look at: https://www.virustotal.com/en/file/900c9aa5497636324964b514a69852229b3f22137247d807edaa05b9e175b198/analysis/

Thanks!

DeadlySeriousMedia

Yup!

https://www.virustotal.com/en/file/f0d0a52d0b57936438f9577477634cb4a4afaa2fec4e4d47aa50217e79fa49a8/analysis/1385053487/

artfish

https://www.virustotal.com/en/file/33ecc698bb82422fceed599d6c6e4ff17bb9200a185eb1aef9790d26e5565aa1/analysis/1385056987/

(I uploaded a butchered version of my game to get it in under the file size max.)
Thanks for looking at this @codewizard

DigiChain

https://www.virustotal.com/en/file/495cfa647d8068e15e1593addc27e0173f6d9ed42fa5cc2b1c00af3d9286e488/analysis/1385071203/

dgackey

Thanks @DigiChain... keep 'em coming folks.

adent42

To help us out, if your app has been rejected, please send us the portfolio url (http://publish.gamesalad.com/game/) for the version of the game you published.

matarua

@Codewizard that is a cool tool

Crazybreadman

Here's one I published a couple weeks ago.
https://www.virustotal.com/en/file/11003f86fdb47258306e989b55d32a09b6a7b726b2427336f563a7d197b9d56e/analysis/1385080804/

neoman

Here is one of mine ... If you need more please let me know ...

https://www.virustotal.com/en/file/431cc2c90062481f541e64c622bccf6fdb0b1e8592afe005c94f7967fbf94baa/analysis/1385086113/

imGua

My app is two times bigger than the allowed maximum

jonmulcahy

here's one of mine I built today:
https://www.virustotal.com/en/file/7b7e361a1f09c91c933c2ddbd8c72c3fdb6ec3894078d40e9964fabb0d6aeae1/analysis/1385090523/

BBEnk

@CodeWizard

I've ran 3 and there the same as above do you actually need to see the reports?

CodeWizard

@BBEnk
If they're the same you could probably just skip it.

BBEnk

@BBEnk
If they're the same you could probably just skip it.

OK well everything I see on jonmulcahy are on mine. >-

-Timo-

I also have the same

what now?

CodeWizard

We're doing a test build with Mobwin and Mobclix removed to see if that resolves the issue. More news when I have it.

myke66

i have not done anything with mobwin or mobclix and im getting positives.

https://www.virustotal.com/en/file/6b20f94060b0aed6eeec60802a25c66f9333626c29fe6437814a628bca894a53/analysis/1385191794/

http://publish.gamesalad.com/games/53335

made exclusively on the windows creator if that helps.

jonmulcahy

i have not done anything with mobwin or mobclix and im getting positives.

https://www.virustotal.com/en/file/6b20f94060b0aed6eeec60802a25c66f9333626c29fe6437814a628bca894a53/analysis/1385191794/

http://publish.gamesalad.com/games/53335

made exclusively on the windows creator if that helps.

its nothing you do, it's part of the publishing process, if you check your report you'll see references to both.

512bit

Here's my results:

First scan in early October (10-02-13):
https://www.virustotal.com/en/file/7ca996e54b3e974f102ee9c115810a2327e2e031b907a6b15638c7aa7eecae65/analysis/

And today's scan:
https://www.virustotal.com/en/file/7ca996e54b3e974f102ee9c115810a2327e2e031b907a6b15638c7aa7eecae65/analysis/1385405938/

I did get a bad user review… It's a medical app, very niche, so one bad review makes a big dent on overall feedback.

512bit

One more app:

https://www.virustotal.com/en/file/52c220a0f99fa3a865d8db89bee8b173200e5f1035063b1037e42ccfa41ebbdb/analysis/

From a new release. My first rating on GP was one star… Probably because of this scan.

DeepBayGames

@CodeWizard
Has there been any breakthroughs with this? I'm getting close to the point of submitting my game to Amazon (Kindle) and was wondering if I should hold off until this issue is resolved. However I am also aiming to get the game in for the November, Amazon deadline, so am concerned with time running out. Any insight would be appreciated!

neoman

@DeepBayGames I reckon submit it now to Amazon and get your free pro month then update the APK at a later date when there is a fix ... It does not look like it is a simple fix as GS support are still trying to pinpoint where the issue is ... That is my two cents ... ;-)

imGua

@DeepBayGames I reckon submit it now to Amazon and get your free pro month then update the APK at a later date when there is a fix ... It does not look like it is a simple fix as GS support are still trying to pinpoint where the issue is ... That is my two cents ... ;-)

My opinion is different. I think it's better to miss Amazon promotion, to submit an app without a antivirus problems, to not get bad reviews and disappointed users.

DeepBayGames

imGua said: "My opinion is different. I think it's better to miss Amazon promotion, to submit an app without a antivirus problems, to not get bad reviews and disappointed users."

I agree. A month of free GS is not my motivation for releasing to Amazon. Downloads are the goal. I'd much rather wait until the false antivirus warning is resolved. Any chance of success has to start with the best user experience possible. Sounds like the GS team is getting close to resolving this. Hopefully soon...

artfish

Alright guys, just got another 1 star.
"Bought it, yes great price, looking good BUT my Norton Mobile Security (everybody knows that Norton is reliable) says it's a security risk! Permissions are suspiciously bad! I had to remove it. Isn't weird that a game can accesss your contacts list (and not only!)? ...yeah! I thought so!"

Not going to sugar coat it, this sucks bad. Please keep this issue a priority...it's costing us money. And on that note, Thanks for your hard work guys and gals.

LittlePhoenix

@artfish
These virus detected reviews started happening to me back in April 2013 just after my app was made free app of the day and you have to try really hard to convince your customers that your app is safe and get them to change their review / comment and rating.
I had some success with customer Sam98
If you are interested in the dialog I had with the customer have a look at
Sam98 review... http://www.amazon.com/Cutie-Mini-Monsters-Counting-Numbers/product-reviews/B00ARRDTX6

It would be great to have this fixed as my apps are being heavily promoted again..
Here is my Virustotal scan:
https://www.virustotal.com/en/file/ad03a438d4fdfce5ef3f0f9c847d8df80f7b3df50083e13327a62608cd4bebcd/analysis/1386218668/

artfish

@LittlePhoenix Thanks! I respond to every single review I get and have commented on this one as well. Hope to get a dialog going, but we'll have to wait and see.

BlackCloakGS

This is now fixed. It will be in the next nightly build

https://www.virustotal.com/en/file/df2201f027ca9ab5e80378efdee16788af139cd8547305d6a2ff14f8011e94f5/analysis/1386611646/

artfish

Great news!

DeepBayGames

Very glad to hear this is fixed! @BlackCloakGS, can you please give an eta as to this will be incorporated in the next stable release? I would love to publish to the Amazon store this week but do not want to do so with the current release that is resulting in the false positive antivirus issues.

matarua

This is now fixed. It will be in the next nightly build

https://www.virustotal.com/en/file/df2201f027ca9ab5e80378efdee16788af139cd8547305d6a2ff14f8011e94f5/analysis/1386611646/

@BlackCloakGS that is great news - glad to hear it and a major step forward - thanks so much!