Solved

threat found: com.android.mms



Show first post

91 replies

Help! My antiviral says there is a critical threat in my messaging. It won't let me remove the messaging app. What do I need to do???
Userlevel 7
Badge +56
@BB613 wrote:
@ wrote:
GZOne Commando w Android keeps getting a spyware threat for Android Messaging app which I can't uninstall or keep Webroot for flagging. I also cannot use my messaging app because the shield pops up.
Welcome to the community.
 
I suggest you contact information to Tech Support by submitting a support ticket. They will be able to help you out.
 
Please do let us know what they say and come back often and share your experiences!
 
Beth
There is no need to contact support as they already know about the issue and it will be fixed in the next 24 to 48 hours.
 
From Support:
 
Hello,

Thank you for contacting Webroot Support. We apologize for any inconvenience this issue may have caused.

It does appear the detection in question was a false positive. We have re-evaluated the definition detecting the application you report and corrected the false positive on our end. Within the next 24-48 hours we will release a new definition set with those corrections and you should no longer see that detection. In the meantime, you may choose the option to "Ignore this threat" and this will prevent Webroot from displaying the alert again for that particular app. We appreciate your report and thorough troubleshooting!

Regards,

The Webroot Mobile Threat Research Team
*HOPEFULLY* there will be no more rolling out a new definition file just as the tech support desk goes dark for the day.
This is something that should never happen to begin with, but to roll out new defintions at the end of the business day, come on.
 
As has been noted elsewhere, this is a false positive. Just have Webroot ignore it.
Userlevel 7
Badge +56
@ wrote:
*HOPEFULLY* there will be no more rolling out a new definition file just as the tech support desk goes dark for the day.
This is something that should never happen to begin with, but to roll out new defintions at the end of the business day, come on.
 
They said they were sorry and they didn't go dark at least WSA doesn't remove it without your permission right? ;)
 
They have Support Worldwide so there is always someone to help 24/7/365
 
Thanks for everyone's understanding in this matter!
 
Daniel 😉
Userlevel 6
@ wrote:
Help! My antiviral says there is a critical threat in my messaging. It won't let me remove the messaging app. What do I need to do???
Welcome to the community!
 
Have a look at the posts from albuchs and TripleHelix on page 4 of this thread. If you are having the same message as the others who posted in this thread, the issue will be fixed in the next 24-48 hours.
 
If you are experiencing a different issue, please contact Tech Support by submitting a support ticket Please do let us know.
 
Sorry for the inconvenience
 
Thank you,
 
Beth
Support:
Have the same threat alert.
Will not complete scam of mobile device unless I select ignore.
Threat has two names:
under messaging apps: called : com.android.mms
also known as : Android.SmsSpy
Unable to remove or quarantine threat
Not sure if this is in device or SD card
RSS topic feed was also blocked.
Hope this helps.
KDR406
Userlevel 7
Badge +56
@ wrote:
Support:
Have the same threat alert.
Will not complete scam of mobile device unless I select ignore.
Threat has two names:
under messaging apps: called : com.android.mms
also known as : Android.SmsSpy
Unable to remove or quarantine threat
Not sure if this is in device or SD card
RSS topic feed was also blocked.
Hope this helps.
KDR406
Please see above here: https://community.webroot.com/t5/Webroot-Mobile-for-Android/threat-found-com-android-mms/m-p/137449#M2995
 
Thanks,
 
Daniel
SAME HERE
CANT UNINSTALL
THINK SUPPORT IS IN PROCESS OF WRITING NEW SCRIPT TO MUTE THE ALERT
READ SOMETHING ABOUT A FALSE /NEGATIVE
RSS FEED NOT WORKING
KDR406
Userlevel 6
@ wrote:
SAME HERE
CANT UNINSTALL
THINK SUPPORT IS IN PROCESS OF WRITING NEW SCRIPT TO MUTE THE ALERT
READ SOMETHING ABOUT A FALSE /NEGATIVE
RSS FEED NOT WORKING
KDR406
 
 
Welcome to the community!
 
Please take a look at this thread https://community.webroot.com/t5/Webroot-Mobile-for-Android/threat-found-com-android-mms/m-p/137461#M2999
 
albuchs and TripleHelix both shared from support that the issue will be fixed in the next 24-48 hours.
 
Sorry for the inconvenience.
 
Beth
Userlevel 6
@ wrote:
@BB613 wrote:
@ wrote:
GZOne Commando w Android keeps getting a spyware threat for Android Messaging app which I can't uninstall or keep Webroot for flagging. I also cannot use my messaging app because the shield pops up.
Welcome to the community.
 
I suggest you contact information to Tech Support by submitting a support ticket. They will be able to help you out.
 
Please do let us know what they say and come back often and share your experiences!
 
Beth
There is no need to contact support as they already know about the issue and it will be fixed in the next 24 to 48 hours.
 
From Support:
 
Hello,

Thank you for contacting Webroot Support. We apologize for any inconvenience this issue may have caused.

It does appear the detection in question was a false positive. We have re-evaluated the definition detecting the application you report and corrected the false positive on our end. Within the next 24-48 hours we will release a new definition set with those corrections and you should no longer see that detection. In the meantime, you may choose the option to "Ignore this threat" and this will prevent Webroot from displaying the alert again for that particular app. We appreciate your report and thorough troubleshooting!

Regards,

The Webroot Mobile Threat Research Team
So sorry Daniel!
 
When I responded, the post was in a different thread and I was not sure if it was in fact the same issue. I have referred all other inquiries to this thread.
 
Beth
Userlevel 2
I have read through all of the pages of this thread up to thus far, but I have not gone through the other related threads.  I'm far from an expert on WebRoot and also must admit that aside from the contents of this thread I have relatively little knowledge of this situation other than my own experience.  Please forgive me for any lack of knowledge I may have on the subject.  So, just as I suspected when this popped up on my phone it is a false positive.
 
Not really saying anything that anyone else hasn't said so far; however, here are my thoughts on this issue.  I know I would (and I'm guessing at least a few others would) have liked to have had some form of official comunication out reach from Webroot notifying about the issue.  An e-mail to users with a registered Android device or even some type of in app notification pushed out would have been very valuable to me.  I know I was really worried and confused for at least a few hours as I was unable to really research the issue to find out what it was about.  To top it all off I was in the middle of a semi-important text conversation when the alert came in.  Another thing I would have found invaluable would have been for the app to provide more information on the infection than just a name.  Maybe a brief description and the location of the infected files to help me understand the nature of the infection.
 
Don't get me wrong these are not meant to be viewed as complaints.  These are intended to be viewed as suggestions or improvements that would perhaps make a situation like this better in the future.
 
I'm sure WebRoot will have the situation handled shortly, but in the mean time it is not too late to send out that message and help those that may still be out of the loop on the situation.
 
Now, perhaps this has already happened or is already available.  If so please disregard that part of this post.
Just came up on my htc one, thought I was the only one Haha
Support posted this was a false/negative scripting alert.
They will release a fix for it with 24-48 hrs
Go to your webroot mobile app and find the FORCE UPDATE of definitions tool. Also set your scan settings from weekly to daily. This was a result of a Google sms unblock setting within Chrome or gmail. Look for the fix before 08/09/14
Userlevel 6
Welcome to the community seven_7_vii_th!
 
Thank you for your feedback.
 
In regards to this issue, users like you who experienced it have reported the issue. The issue was not  known prior to the user reports. Others who experience it as well may look here first to find an answer or they may turn to support for an answer.
 
Two peple did post the response from support. They responded promptly that the  issue will be fixed within 24 - 48 hours. 
 
Webroot employees do frequently visit the community. It is the feedback from users like you who post  that helps the Webroot Team to know what the users needs are, what features they would like and to keep Webroot  the best security protection out there.
 
Feel free to post your ideas in the Ideas Exchange and please do come often and share your experiences. Sharing helps all the members as we learn from one another and then can help each other out as well!
 
Beth
Support says it is a false positive
Userlevel 6
@ wrote:
Just came up on my htc one, thought I was the only one Haha
Welcome to the community!
 
Beth
Add Kdr406 to group post
Userlevel 7
Badge +62
@ wrote:
Support posted this was a false/negative scripting alert.
They will release a fix for it with 24-48 hrs
Go to your webroot mobile app and find the FORCE UPDATE of definitions tool. Also set your scan settings from weekly to daily. This was a result of a Google sms unblock setting within Chrome or gmail. Look for the fix before 08/09/14
:DWelcome kdr406, to the Communiuty Forum! Forcing an Update KB Appreciate your help in the matter.
 
 
 
Thank you,
 
 
Userlevel 7
Badge +62
@ wrote:
Just came up on my htc one, thought I was the only one Haha
Hello and Welcome to the Community Forum 210gnx, Happy to have you here!:D
 
Sorry you were having problems with your HTC One, Thats an awesome phone by the way! I used to have the HTC Thunderbolt and that was a sweet phone.
 
I hope you have looked on our KB Here as well!
 
Have a great day 210gnx!
 
 
Userlevel 7
Badge +62
@ wrote:
I have read through all of the pages of this thread up to thus far, but I have not gone through the other related threads.  I'm far from an expert on WebRoot and also must admit that aside from the contents of this thread I have relatively little knowledge of this situation other than my own experience.  Please forgive me for any lack of knowledge I may have on the subject.  So, just as I suspected when this popped up on my phone it is a false positive.
 
Not really saying anything that anyone else hasn't said so far; however, here are my thoughts on this issue.  I know I would (and I'm guessing at least a few others would) have liked to have had some form of official comunication out reach from Webroot notifying about the issue.  An e-mail to users with a registered Android device or even some type of in app notification pushed out would have been very valuable to me.  I know I was really worried and confused for at least a few hours as I was unable to really research the issue to find out what it was about.  To top it all off I was in the middle of a semi-important text conversation when the alert came in.  Another thing I would have found invaluable would have been for the app to provide more information on the infection than just a name.  Maybe a brief description and the location of the infected files to help me understand the nature of the infection.
 
Don't get me wrong these are not meant to be viewed as complaints.  These are intended to be viewed as suggestions or improvements that would perhaps make a situation like this better in the future.
 
I'm sure WebRoot will have the situation handled shortly, but in the mean time it is not too late to send out that message and help those that may still be out of the loop on the situation.
 
Now, perhaps this has already happened or is already available.  If so please disregard that part of this post.
Welcome seven_7_vii_th
 
I missed your post yesterday and appreciate your feedback as well! I agree that an email would be helpful in these security issues! Maybe you could put this in our Ideas Exchange Here
 
Hopefully all this was sorted out for you! Please don't don't be a stranger and join in the Forum for we learn alot and we do have fun!
 
Thanks Again,:D
Userlevel 7
A fix has been pushed to QA and a new def will be released shortly. Thanks for your patience! 
Userlevel 7
Badge +62
Thank you Roy for the information as you state here,

A fix has been pushed to QA and a new def will be released shortly. Thanks for your patience! 🙂
If we ignore then it will not scan that app in the future. It that really what we want to do? Wouldn't we want our text apps scanned for spyware etc?
Userlevel 7
Thats isnt how it works, its not a blanket whitelist of all messenging apps or that application. If the application gets an update and thus changes that ignore setting wont apply any more.

Reply