Malware Found

Avast Mobile Security
1

Hi there, when scanning my samsung mobile, Avast is detecting malware on the “Visual Voicemail” application. The message says
“it is installed in the system partition and cannot be uninstalled. Instead, you must deactivate the app from system settings.” When I go to the app in the settings, it does not have a disable option.

Question:

  1. Has anyone else seen malware on this app? Or on a manufacturer’s app?
  2. Any idea how to disable?

Thanks

2
[b]The message says[/b] "it is installed in the system partition and cannot be uninstalled. Instead, you must deactivate the app from system settings."
Is this the message avast give? i dont see any malware mentioned
3

Sorry I skipped that portion of the full message. It says “Malware detected on the Visual Voicemail app” …

4

No malware name ?

5

No malware name was given

I ended up just clean reinstalling my phone out of caution… not sure if this was the right approach but was overly worried.

Have you heard of this type of malware attached to a Samsung app? without a name? is it a “possible” malware or false positive perhaps?

6

Update:

I did a factory reset, turned on my phone and only logged into to google to download Avast from the playstore. No other apps installed or any other use.

I scanned my phone and this message is still coming up on a cleaned new phone. Could it be attached to my google account somehow?

The exact message is:

"Malware detected

Visual voicemail contains malware that could harm your device. it is installed in the system partition and cannot be uninstalled. Instead, you must deactivate the app from system settings."

7

Sorry for the additional posts, but would a factory reset wipe malware on the system partition (as the note seems to indicate it’s located there)? Any help is appreciated.

8

It could be that avast by “malware” mean PUP = Possible Unwanted Program ?
Or it is a False Positive ? somone from avast need to answer

https://lifehacker.com/what-to-do-when-your-budget-android-phone-arrives-with-1840929271

https://blog.malwarebytes.com/android/2020/07/we-found-yet-another-phone-with-pre-installed-malware-via-the-lifeline-assistance-program/

When i buy Android phones i always buy one that comes with a clean android and no extra crapware … like Nokia
https://www.androidauthority.com/best-smartphones-stock-android-844672/

9

Thanks @pondus

Not sure what to do here. It’s possible that the malware can be in the system partition? Any recommendations here? Note, I’ve already done a factory reset.

10

I had a “malware” detection on a Sprint system file a few days ago. I checked the file with the VirusTotal app and it was clean. I reported it as a false positive through the Avast app and now it is no longer detected.

11

Hi @Simion, thanks for the reply. Appreciate it.

So you viewed “VirusTotal” as being more reliable than Avast I guess?

And if Avast removes it as malware, have they done their due diligence or do they just take it out if someone reports it as false positive?

Thanks a bunch in advance

EDIT: my bad - didn’t know what VirusTotal was

I downloaded VirusTotal for android and the result for the app was:

green check mark - 1/75 Clean

How do I interpret the “1 detected”? Oddly enough, the AV that detected is not AVAST, even though AVAST for mobile is flagging it as malware.

Can someone with experience using VirusTotal help interpret these results?

12

I downloaded VirusTotal for android and the result for the app was:

green check mark - 1/75 Clean

How do I interpret the “1 detected”? Oddly enough, the AV that detected is not AVAST, even though AVAST for mobile is flagging it as malware.

Can someone with experience using VirusTotal help interpret these results

When I checked the results, even the google playstore has 1 issue detected… “Windows: Trojan” — are these normal??

13

updated with more info

14
Can someone with experience using VirusTotal help interpret these results
Screenshots are a big help for those who cant see what you see ;)
15

Here are the screenshots. The first is from avast and the other 2 are from when I ran virustotal and 1 out of 76 AVs (drweb) found something.

On a related note, even Google play store has a detection by 1 AV. Is this normal? Will most phones have at least 1 detection for some of these apps?

16

:slight_smile: thx

17
[b]How do I interpret the "1 detected"?[/b] Oddly enough, the AV that detected is not AVAST, even though AVAST for mobile is flagging it as malware.
That detection is a false positive, unless the file is very new but then you should see more detecting it as days goes
18

Yeah, looks like a false positive. Send the file to Avast as a false positive from within their app. Also, you can choose to ignore the detection of that file until Avast corrects their signatures.

19

When it gets reported as a false positive, does avast investigate it? Or just take my word for it?

Thanks for the replies. Feeling less worried.

20

No they won’t just take your word for it.

It will be investigated and if found to be an FP then the virus signature would be corrected/modified.