Android Virus warning for Sonos App

Call Sonos support, there is nothing we other users can do and the moderators might not see your post anytime soon.

I’m pretty sure it’s not the Sonos app. You most likely for lack of a better phrase “Stepped in something” that’s tagging the Sonos app as invasive. Below is an AI compilation about the issue taken off Reddit.

Android.Heuristic.Adcheat.OutAppAD.ABS.FX

 is a detection name used by antivirus software to identify adware—specifically, a type of potentially unwanted application (PUA) or malicious app that displays intrusive, fraudulent, or out-of-app advertisements on an Android device. 

Reddit +1

Key Characteristics of this Adware

• Intrusive Advertisements: It generates ads that appear outside of the app's context, such as on the lock screen, notification panel, or over other applications.
• "Adcheat" Behavior: The "Adcheat" designation often refers to ad fraud, where the app falsely simulates clicks or views to generate revenue for the developer.
• Out-of-App Ads: It is designed to function while not in active use, running in the background to spam the user.
• Performance Impact: Symptoms include rapid battery drain, increased data usage, and a generally slower, less responsive device. 

   

  Reddit +4

How to Remove It

If your device has flagged this, it is recommended to take the following steps to remove the malicious application:

1. Boot in Safe Mode: Turn off your device, then hold the power button to turn it back on. When the logo appears, hold the volume down button to enter Safe Mode, which prevents third-party apps from running.
2. Locate the App: Go to Settings > Apps or Settings > Apps & Notifications. Look for recently installed applications, suspicious apps you do not recognize, or apps with no icon/name.
3. Uninstall the App: Select the suspicious app and choose "Uninstall." If the uninstall button is grayed out, deactivate its administrator rights in Settings > Security > Device Administrators.
4. Clear Browser Cache: Clear the cache and data for your web browsers (e.g., Chrome) to remove any malicious redirection scripts.
5. Restart the Phone: Exit Safe Mode by restarting the phone normally. 

    

   Reddit +4

Prevention Tips

• Use Play Protect: Ensure Google Play Protect is enabled in the Google Play Store settings to scan for harmful apps.
• Avoid Third-Party Sources: Only install applications from official, trusted sources like the Google Play Store.
• Check App Permissions: Be cautious of apps that request excessive permissions, such as the ability to "Display over other apps". 

   

  Reddit +2

Pretty sure it is the Sonos app. It gets flagged as having "Abnormal ad activity".

When I remove it and recan, I get no issue. When I re-install it and rescan, it gets flagged again.

Sounds like a false positive. I’d follow ​@Stanley_4 ‘s suggestion, and also contact the virus protection company. 

Probably the Sonos app, I got the flag too

What did Sonos Support say, when you called in as suggested by ​@Stanley_4 ?

Chatted with Sonos support bot. Just suggested deleting and reinstalling using their support site. Did this and it just sent me to Google Play store. Downloaded it again. No improvement.

That’s why I don’t trust the ‘bots, they often aren’t much help. I’d speak to a human. And honestly, whomever wrote the app that is generating this warning. As far as I’m aware, there is no issue with the Sonos app, so it would be a false positive, which should be corrected by the app that is throwing the error, and not the Sonos app. 

Banking apps have very high security checks. Gemini seems to be agreeing with the false positive approach with the banking app and the play protect combining to produce the warning. Personally I am thinking the Sonos 9th March has something to do with it. No other apps I have are being identified. Yet it does seem confusing as the play protect scan says the Sonos app is fine. 

And when I force stop the Sonos app I can get into my banking app. Weird, I know.

Not at all wierd, this is a bit generic, but the process is usually similar.

The protection apps get a good number of false positives in their initial check. They then do a second check against a whitelist that is supposed to identify the false positives in the first check. If an update, like Sonos did, triggers the first and the security app vendor hasn't updated the second list you get a false report.

Sonos can't rewrite their app to work around the false report, the vendor needs to be told of the problem and do the whitelist update.

As of this morning I am not getting an alert after install Sonos and re-running the AV scan.

Final post on this topic with a happy outcome. I've been using Bitdefender and Play Protect scanning. Both cleared Sonos but problem remained. Scanned with my Oppo antivirus and got the harmful app message, however also gave the option of white listing Sonos. This done, all is well. Google gave two options. Quit or Fix and each one applied to the banking app which had been affected. Never believed Sonos was harmful just couldn't find the right way to resolve. Thanks to all who assisted, empathized and educated me.