False positive Android App - Android:Evo-gen [Trj]

[app.babycam]

Hello,

I am the developer of the BabyCam Android app https://play.google.com/store/apps/details?id=com.arjonasoftware.babycam

On July 28, I published an update to my app (2.19) and shortly after, messages began to arrive from users indicating that the app had been detected to have a virus on their phone. My Xiaomi phone, which also has Avast antivirus, said the same thing. Luckily I was able to quickly disable the update in the Play Store.

I reported this issue on the form --> https://www.avast.com/false-positive-file-form.php#mac but have not received a response yet.

From the virustotal.com website I analyzed the apk and it told me that "Android: Evo-gen [Trj]" had been detected.

I've been crazy about this issue ever since, trying to find out what change I made in the app that could cause this situation and I managed to discover it:

-Until version 2.17, the minimum version that the app supported was Android 4.0 (SDK API 14)
-In version 2.18, I uploaded the minimum version to Android 4.1 (SDK API 16).
-In version 2.19 (detected as "virus"), I downgraded back to Android 4.0 (SDK API 14).

The change to API 14 again is the one that causes the detection of the supposed virus, if I change to API 16, without touching a single line of code, it is no longer detected as a virus.

Here you can see the links to the analysis on the virustotal.com website of the new version 2.21 that I am going to distribute again in the Play Store, the one with API 16 is OK, and the one with API 14 KO (I repeat, there is no difference in my code on both builds):

API14: https://www.virustotal.com/gui/file/f1890dd3846453248d569168306de0ab827db1a0505b9328f2d27aa334600522
API16: https://www.virustotal.com/gui/file/f491b20274725e548572842c2451c017e873f295b82cd2371852b91c765f4ec5

I think it is something very important and that it should be reviewed from Avast. It cannot be that a developer decides to change the minimum version of the Android SDK and this causes Avast to detect it as a virus.

Note that your antivirus seems to be installed by default on millions of phones. There are more app developers having this Avast false positive issue with "Evo-gen", just do a Google search to see this.

Because of this, many people will have removed my app from their phones and probably won't install it again, apart from putting negative reviews and wasting my time and money. Now every time I generate a new version I will have to analyze it with your antivirus and thus avoid this type of unpleasant surprises.

I hope that if there is any other developer who reads this in the future, it can at least help them

If you need any additional information, I am at your disposal.

Thanks in advance.

[bob3160]

Reported to Avast just received the following reply:
"detection disabled a couple minutes ago, will be fixed soon"
Once they've updated the detection, this should no-longer be detected.
Sorry for your troubles, hope that helps.
For future reference,
Report Suspicious File or URL:  https://www.avast.com/false-positive-file-form.php

[app.babycam]

Thank you so much for your quick response, I have already verified that the apk is no longer detected as a virus!

[bob3160]

Thank you so much for your quick response, I have already verified that the apk is no longer detected as a virus!

Good news.