This weekend I installed a popular Windows antivirus in my PC laptop. The installer offered the android app, and I denied it.

Nonetheless, a couple hours later all my android devices had the antivirus' app pushed onto them, even the ones that were lying around unused for a week.

It means that none of the devices (three tablets and three phones) were ever connected to the PC in the previous or following days. And the installation notification for the antivirus app had Google play's icon.

I haven't order the download of the antivirus from the play store to the devices.

It seems the antivirus software or its installer did it from the PC. I have several google programs (drive, chrome, etc) installed on the notebook.

Due to Moderator request, the name of the antivirus is Avast free.

  • 1
    I would rather leave the antivirus software unnamed if possible (I am not attacking it), but if the community requests, I have no objections on sharing it. – Mindwin Apr 22 '15 at 13:30
  • 1
    Sharing the name would be useful. Were all of your devices connected to the PC? Disabling the "Unknown Sources" setting for app installs might do the trick if it is not coming from the Play Store. – Matthew Read Apr 22 '15 at 13:51
  • Disable ADB from developer settings. That way Windows programs can't install any apps on your device. – GiantTree Apr 22 '15 at 14:52
  • @GiantTree the devices were never connected to the PC in the previous of following days. And the installation notification for the antivirus app had Google play's icon. – Mindwin Apr 22 '15 at 14:54
  • This question probably needs some clean up (e.g. clarify the issue on title) since your issue is a specific case with Avast Antivirus. – Andrew T. Apr 22 '15 at 20:29

You (or someone else) probably accidentally click this banner on the main screen.

install banner

And "Accept" the offer.

auto install on Android device

(Note: this dialog may also pop-up on reboot)

- OR -

Avast pushed the installation silently (which I still doubt since it didn't happen on my case).

Avast gets the Google accounts saved on the Chrome, and it's possible for them to offer their products on connected devices.

Thank you for contacting our support center with your concerns.

We have got it from your Chrome account. If you are signed (permanently) to your Google account in some web browser, Avast can read your devices added to this account and offer our products. This situation can't be blocked.

(Source: Google Forum)

Additional reading: "How did Avast get my Google account info and install itself automatically onto my phone when I hit 'accept' on the desktop app?" on Reddit.

  • Avast is hijacking AUTHENTICATION info from the browser. Very nice to know. It is a good think they keep it ethical-ish (oh wait)... – Mindwin Apr 22 '15 at 21:18

To me it seems like a malicious firewall. It can attempt to interfere with your connection to the Google Play website, inject a script in it and the script fires all events needed to download that specific app on all your devices.
I would recommend uninstalling this "popular" antivirus as it seems malicious to me.

Note, that even though you do not access the Google Play website yourself, any application is able to launch a web browser in the background; especially an instance of the Internet Explorer. As long as you have a valid session/cookie in any of your web browsers, an application is able to extract that session/cookie and use it on its own.
Injecting a script to fire all events, needed to install an app on your device is just one thing an application can do.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.