Trojan:Android/AVPass.C
Summary
Trojan:Android/AVPass.C is distributed in the guise of a Clock app; while active however, it steals information from the device and attempts to uninstall or bypass security-related apps installed on the device.
Removal
Once the scan is complete, the F-Secure security product will ask if you want to uninstall the file, move it to the quarantine or keep it installed on your device.
A False Positive is when a file is incorrectly detected as harmful, usually because its code or behavior resembles known harmful programs. A False Positive will usually be fixed in a subsequent database update without any action needed on your part. If you wish, you may also:
- Check for the latest database updates
First check if your F-Secure security program is using the latest updates, then try scanning the file again.
- Submit a sample
After checking, if you still believe the file is incorrectly detected, you can submit a sample of it for re-analysis.
Note: If the file was moved to quarantine, you need to collect the file from quarantine before you can submit it.
- Exclude a file from further scanning
If you are certain that the file is safe and want to continue using it, you can exclude it from further scanning by the F-Secure security product.
Note: You need administrative rights to change the settings.
Technical Details
Trojan:Android/AVPass.C is distributed in an app named 'Clock'. On installation, it creates several app icons in the device's App menu panel. The icons are named "system update", "360Antivirus" and "QQ"; the last two names refer to popular apps, but none of the icons actually lead to a program.
Clicking any of the icons silently starts the trojan in the background, while the newly created app icons are deleted. Meanwhile, the trojan harvests the following details from the device:
- SMS message and calls log
- GPS location data
- Contacts data
- Stored photos
- Phone's recording data
In addition, the trojan checks to see if any security/antivirus apps on an internal list are installed on the device. If found, the trojan requests for user root privileges in order to uninstall the security/antivirus app, or bypass it by modifying its database to prevent detection of the app.
More Support
Community
Ask questions in our Community.
User guides
Check the user guide for instructions.
Contact Support
Chat with with or call an agent.
Submit a Sample
Submit a file or URL for analysis.