Android Avast Anti-Theft false positive

[PapierKorb]

Hi,

I have the Avast Anti-Theft app (Play Store link), which hasn't received in almost three years, so it's still version 4.2.0. During its latest scan, Malwarebytes for Android (3.7.1.1) started reporting it as "Android/Monitor.AntiTheft.AVA". Yesterday I selected to ignore it, but today Malwarebytes sent a notification that a new scan is required because previously I "ignored dangerous malware". Is that intentional (if so the wording is a tad extreme, and the notifications shouldn't bother me daily)? Otherwise, I'd just like to report it as a false positive.

Thanks

[mbam_mtbr]

Hi @PapierKorb,

Malwarebytes for Android is taking a more aggressive stance against stalkerware.

Therefore, apps that used to be clean may now be detected as Monitor.  Monitor is a subset of Potentially Unwanted Programs (PUPs), thus it’s NOT considered malware.  

The main purpose of detecting these Monitor apps is to make unsuspecting users aware of their presence.  Especially in cases of domestic abuse where abusers have physical access to victims mobile devices.  This particular version of Avast Anti-Theft fulls under this category.

If you are aware of the presence of these apps, you can simply ignore them using this method:

1. Run a scan.
2. On the results screen, below each checkbox is drop-down arrow. Click on the arrow.
3. From the list of options, select “Ignore Always.” Future scans will no longer detect the app as suspicious.

If you change your mind and like to stop ignoring, you can do so at any time by:

1. Tap Menu icon
2. Tap Scanner
3. Tap Whitelist (upper right corner)
4. Remove from list

We apologize for inconvenience, but due to the extreme outcomes of not letting unsuspecting victims aware of these apps, we will continue to take a hard stance on Monitor apps.

Thank you for understanding,

Nathan

[PapierKorb]

Hi Nathan,

thanks for that info, now I know how to react to this myself.

While I don't disagree with your decision to report potentially unwanted apps to users, I still think the implementation could be improved. In particular, the wording "dangerous malware" is misleading (actually it's technically wrong, that software was not created with "malicious" intent). Ideally, and other antivirus software does this already, Malwarebytes would explain the situation briefly, i.e. point out that this piece of software is generally benign, but might be unwanted.

Cheers
Philipp

[mbam_mtbr]

Hi @PapierKorb,

Agreed!  I'll chat with mobile dev and see if we can update the wording on PUP/Monitor apps when detected.

Nathan