Trojan from Google Play Store - False Positive?

[ForeverRogue]

Hello MBAM team. Long time user, first time poster. I have had the SHAREit app on my device for as long as I've had MBAM on my device. Only just recently MBAM has detected the maleware Android/Trojan.Dropper.Agent.AYA on my system, as per attached screenshot. It also points to /data/app/com.lenovo.anyshare.gps-1/base.apk and shows the icon for the SHAREit app on the right side next to the check mark. I could not locate the .AYA file, nor the base.apk file to zip and attach for you. Sorry. In case there was an issue with the app, I uninstalled and re-installed from the Play Store. MBAM once again detected the same maleware. I'm hoping you can confirm if this is a false positive or not.

Thank-you.

[erreci]

Hi Forever Rogue, I had exactly the same problem couple of hours ago. I resettled the tablet downloaded MBAM and scanned the empty device again and the trojan is still there. 

 

[AndroidGal]

I got a malware alert also for Android.trojan.dropper.agant.aya and linked to Shareit. Never came up before today.

[ForeverRogue]

erreci and AndroidGal thank you for adding your comments. Good to know it's not just me.

erreci it is odd that the trojan was still there after reset. Was SHAREit still on the device after reset? 

 

Will wait and see what the MBAM team has to say.

[a_Mbam]

Hi ForeverRogue,

Thanks for bringing this to our attention, this is an FP and we have corrected the rule. The fix will be published in our next update coming later this afternoon.

Regards,

-Armando

[ForeverRogue]

Thanks Armando for the confirmation and fix.

Keep up the great work.

[SJH18]

I have the same Problem on two Lenovo Tablets. Both are not rooted. The scan show the same pictures and find  Android/Trojan.Dropper.Agent.AYA

/system/priv-app/AnyShareROW/AnyShareROW.apk. Sophos say this file are okay. I believe that mbam show it correctly. All the posts have the same problem. The first tablet was bought December 2014, the second May 2015.