Avast WEBforum

Consumer Products => Avast Mobile Security => Avast Mobile Security for Android => Topic started by: mauro1970mvr on May 04, 2013, 07:21:24 PM

Title: PUP and dSploit
Post by: mauro1970mvr on May 04, 2013, 07:21:24 PM
why does it avast consider some intrusive programs as PUP instead of actually detecting real threats?

Avast Mobile Security sees the app dSploit a network detection and sniffing utility app as PUP. I have seen the source and there is no malware in it. I reported this as a false positive but it's still detected as malware.

Avast desktop does the same thing with programs that run the 'net user' command.

What is the criteria to determine what PUP is or is not.?
Wouldn't Avast Theft be considered PUP as well? After all its behavior is far more intrusive than the apps Avast detects as PUP.
Title: Re: PUP and dSploit
Post by: SugarD-x on May 13, 2013, 02:04:57 AM
I'm getting the same thing running "Where's My Droid" in parallel to Avast! Anti-Theft, (due to my phone not being rooted, it's a nice combination). It claims it's PUP too, but it's clearly not.
Title: Re: PUP and dSploit
Post by: Flippy on May 21, 2013, 11:33:20 AM
Hello folks,

well here is quick review what Pup detection is ->

A PUP (potentially unwanted program) is a program that may be unwanted, despite the possibility that users consented to download it. PUPs include spyware, adware, and dialers, and are often downloaded in conjunction with a program that the user wants.

If you could send me strictly version of your aplication I can check if its real Pup or not..

Thank you and best regards,

Filip Chytrý
Virus Analyst
Title: Re: PUP and dSploit
Post by: SugarD-x on May 21, 2013, 09:14:42 PM
If you could send me strictly version of your aplication I can check if its real Pup or not..
http://play.google.com/store/apps/details?id=com.alienmanfc6.wheresmyandroid

I'm fairly certain that is a false positive as it has been around longer than Avast! has been on Android. :P
Title: Re: PUP and dSploit
Post by: REDACTED on May 22, 2013, 08:51:10 AM
Bump this issue as despite reporting this as a false positive through your android app, i get this notification daily...
Title: Re: PUP and dSploit
Post by: Flippy on May 22, 2013, 01:31:55 PM
Well this applications has unstandard behavior. So thats a reason to detected it as PUP. Its able to track your phone or setup other stuff in system. If you really wanna use this aplication there is nothing easier than switch off Pup notifications in Avast.
Title: Re: PUP and dSploit
Post by: SugarD-x on May 22, 2013, 02:14:41 PM
Well this applications has unstandard behavior. So thats a reason to detected it as PUP. Its able to track your phone or setup other stuff in system. If you really wanna use this aplication there is nothing easier than switch off Pup notifications in Avast.
It is supposed to track your phone. It does the same thing as Avast! Anti-Theft does. It's a well-known app that has been around for a very long time on Android.
Title: Where's My Droid
Post by: tscateh on May 22, 2013, 06:52:12 PM
I am also having issues with a False Positive report on Where's My Droid.  When I called in to the support line, they told me to re-install Avast!, but that has not resolved my issue with it.  Please FIX THIS ASAP.  It's incredibly irritating.

I don't want to turn off PUP detection, since there might actually be malware out there.  But it isn't this valid app.

tscateh!
Title: Re: PUP and dSploit
Post by: Lisandro on May 22, 2013, 11:51:08 PM
I am also having issues with a False Positive report on Where's My Droid.  When I called in to the support line, they told me to re-install Avast!, but that has not resolved my issue with it.  Please FIX THIS ASAP.  It's incredibly irritating.

I don't want to turn off PUP detection, since there might actually be malware out there.  But it isn't this valid app.

tscateh!

If it is a PUP we cannot change this fact. Like Flippy said, you'll have to disable the PUP detection. PUPs are not false positives.
Title: Re: PUP and dSploit
Post by: SugarD-x on May 22, 2013, 11:54:42 PM
I am also having issues with a False Positive report on Where's My Droid.  When I called in to the support line, they told me to re-install Avast!, but that has not resolved my issue with it.  Please FIX THIS ASAP.  It's incredibly irritating.

I don't want to turn off PUP detection, since there might actually be malware out there.  But it isn't this valid app.

tscateh!

If it is a PUP we cannot change this fact. Like Flippy said, you'll have to disable the PUP detection. PUPs are not false positives.
How is that not a false positive? Avast! is improperly detecting the program because of how it works, when it's specifically meant to work that way. That would be like saying another anti-virus program detecting Avast! Anti-Theft as a PUP is valid.
Title: Re: PUP and dSploit
Post by: bassrick on May 28, 2013, 08:17:31 PM
I would add that there should be NO REASON why the "Where's My Droid" app cannot be added to the list of PUP's that should be ignored by Avast and allowed to run.  The mobile app gives you an ignore button, but all it does is ignore the alarm, but it disables my the app. 

If you can't fix it, short of disabling PUP's, then I guess I need to find another protection app.
Title: Re: PUP and dSploit
Post by: svehlak on May 30, 2013, 05:22:44 PM
This application contains some structures, which are very similar to malware and it is actually detected not only by AVAST, but either by other AV companies. I sent the APK to our virus lab and we will see what can we do; anyway, author / developer of this application is probably OK with this detection, so there is no reason for us to stop detect is as PUP.
Title: Re: PUP and dSploit
Post by: bassrick on June 03, 2013, 08:38:58 PM
Has the author stated when they will remove the detection and allow the program to work?  Next week, next month, next year?
Title: Re: PUP and dSploit
Post by: Lisandro on June 03, 2013, 11:19:03 PM
Has the author stated when they will remove the detection and allow the program to work?  Next week, next month, next year?
I think the author cannot remove the detection, only avast! team can manage its own detection. But, the author, could modify the code to avoid this detection as PUP. But, will he go for it? Won't the app lose its purposes?
Title: Re: PUP and dSploit
Post by: swalker23 on June 05, 2013, 04:26:16 AM
It is something Avast has to do.  I emailed alienman tech and he is doing what he can to fix the problem.  Several antivirus/malware apps fix their issue with this.  I am getting very annoyed with the PUP message also.

Message in play store:
** Antivirus warnings **
If you have an antivirus app that is reporting Where's My Droid as a virus you may need to update your antivirus app. We contacted many app developers about this false report and many have fixed it in recent updates.
Title: Re: PUP and dSploit
Post by: johnec on June 18, 2013, 05:54:17 PM
One of the big annoyances for me is that if I loose my phone and send it an sms message: wmd ring, which should make the phone ring until I find it, it only rings once. Then avast pops up a window with a button "allow for 15 minutes". No more rings until the button is pressed. It's pretty hard to find a lost phone after only one ring. :(
Title: Re: PUP and dSploit
Post by: svehlak on July 06, 2013, 08:40:07 PM
Sorry, but it seems that you are mixing things together - which SMS message you have sent to the device? There is no dialog for 15 minutes - there is simillar dialog for web shield (in case you will browse through malware site). What is wmd?