Android InstantRun - Norton Security Detects Trojans

Question

A week ago, Norton Security began looking for a Trojan horse (Trojan.Gen.NPE.2) in the R.class file:

app \ build \ intermediates \ transforms \ instantrun \ debug \ folders \ 1 \ 5 \ main \ android \ support \ v4 \ r.class

and

app \ build \ intermediates \ transforms \ instantrunslicer \ debug \ folders \ 1 \ 5 \ slice_2 \ android \ support \ v4 \ r.class

Verification link virustotal.com: https://www.virustotal.com/pl/file/282f4e09c102cd93c2f849c9fe9ed570188f5a03395ab84d2457a7c64d7acb1c/analysis/1499458308/

And the code:

package android.support.v4; import com.android.tools.fd.runtime.IncrementalChange; import com.android.tools.fd.runtime.InstantReloadException; public final class R { public static final long serialVersionUID = 830508538663712626L; public R() { IncrementalChange var1 = $change; if(var1 != null) { Object[] var10001 = (Object[])var1.access$dispatch("init$args.([Landroid/support/v4/R;[Ljava/lang/Object;)Ljava/lang/Object;", new Object[]{null, new Object[0]}); Object[] var2 = (Object[])var10001[0]; this(var10001, (InstantReloadException)null); var2[0] = this; var1.access$dispatch("init$body.(Landroid/support/v4/R;[Ljava/lang/Object;)V", var2); } else { super(); } } R(Object[] var1, InstantReloadException var2) { String var3 = (String)var1[1]; switch(var3.hashCode()) { case -1968665286: super(); return; case -71951640: this(); return; default: throw new InstantReloadException(String.format("String switch could not find \'%s\' with hashcode %s in %s", new Object[]{var3, Integer.valueOf(var3.hashCode()), "android/support/v4/R"})); } } } 

Is this a false alarm?

Answer 1

I can’t add exceptions to Symantec on my laptop because its laptop is company and excludes the possibility of using applications, files or folders. Therefore, to get started, I turned off instant start to continue. I can’t even install the application on my emulator and get stuck with installation errors.

You can turn off instant start by removing the immediate start in the settings in Android Studio.

NOTE. This is just a workaround, not a permanent solution.

Answer 2

You can report this false positive to Symantec and fix it.

https://submit.symantec.com/false_positive/