This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Low reputation app

Hi,

Sophos did notify me while charging my freshly factory resetted Samsung Tablet about a "low reputation app".

All my Sasmung devices seem to update/install apps while charging. Atleast the Sophos notification idicates they do. Its the same Scan result as normally installed/updated apps. They do this while "automated Updates" are DISABLED in PlayStore. I updated all my Apps manually before charging my Phone. The Number of Apps before this Sophos notification and after it was the same. So no additional app was installed. I also have disabled installation of apps via unknown sources. The path in the 2nd picture indicates a PlayStore loaded app anyways.

I had this kind of a message from Sophos on another Samsung device too (1 year ago so i dont remember the code/id). On others i never got a warning from Sophos. Even on similar device (aka same Android version).

Another "security" app on my Tablet notifies my about app installations too. At 03:20 i didnt show any installation.

I could find anything online regarding this strange number/code shown by Sophos. My guess would be that it is same kind of internal code/id for PlayStore Apps ...

The storage/... path was empty when i checked it. Sophos says the file/app was removed from safety assessment seconds after the warning message. What does this mean?

Might this be a false positive?

Thx.

This thread was automatically locked due to age.

Parents

0 filipi nic over 4 years ago

I believe this was a ".apk" file which was detected. So you/some program will need to run it to infect the device. This app was flagged as a low reputation application and app reputation is a part of Sophos Mobile Security's Live Protection feature which means it was detected in real time. The path of the app suggests that this was placed in the external SD card so there could be many ways how it was placed in that location. Did anything show up in a full scan? Walgreenslistens
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 filipi nic over 4 years ago

I believe this was a ".apk" file which was detected. So you/some program will need to run it to infect the device. This app was flagged as a low reputation application and app reputation is a part of Sophos Mobile Security's Live Protection feature which means it was detected in real time. The path of the app suggests that this was placed in the external SD card so there could be many ways how it was placed in that location. Did anything show up in a full scan? Walgreenslistens
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 Lukas Lohn over 4 years ago in reply to filipi nic

No, nothing showed up in a full scan.

"The storage/... path was empty when i checked it. Sophos says the file/app was removed from safety assessment seconds after the warning message. "

Sophos always had a strange behaviour on Samsumg devices (confirmed by other Samsung users). There are many entries in the scan protocoll even when nothing is installed or the routine scan is running. See "https://community.sophos.com/products/mobile/f/sophos-mobile-security-for-android/112018/what-is-this-scheduled-scan-finished-0-object-scanned" for example. So i doubt there really was an installation of something. Atleast its not a installation initiated by a user via PlayStore.

I dont have an SD-Card installed in the devices i tested it with. The search results for this paths are misleading. It should be the "download folder" for PlayStore.
Cancel
Vote Up 0 Vote Down

Cancel