All of sudden, it flags Samsung Internet as Trojan as in the picture.

It only asked me to block it, then navigate me to the app setting. You CANT block Samsung Internet if you want to browse internet. Right? Then the report says no threats found.

I tried Avast and Bitdefender, none of them detected anything.

Another false positive?

 

10 минут назад, K0908 сказал:

Another false positive?

Didn't you read the answers in your previous thread? Then read, it might be useful. 

It picked up the same alert twice with two different full scans. After scans with Avast and Bitdefender for no alerts, I cleared data and cache of Samsung Internet app, then I no longer picks up alert anymore with kaspersky.

I will bookmark the opentip website for the future reference. Thanks for the info.

I reanalyzed the totalvirus link in my previous post, and it no longer detected by Kaspersky. So that was a false positive. This one is probably the same. 

I heard Kaspersky started using AI detection now. Is this one of the side affect? I never had any false positive issue in my last decade of using Kaspersky. But it started to happen quite often now. 

29 minutes ago, K0908 said:

1. Samsung Internet base.apk

All of sudden, it flags Samsung Internet as Trojan as in the picture.

It only asked me to block it, then navigate me to the app setting. You CANT block Samsung Internet if you want to browse internet. Right? Then the report says no threats found.

I tried Avast and Bitdefender, none of them detected anything.

Another false positive?

 

Hello @K0908, 

Welcome again!

1. Also, where is that Samsung Internet base.apk from? 

Thank you🙏
Flood🐳+🐋

7 минут назад, K0908 сказал:

I heard Kaspersky started using AI detection now. Is this one of the side affect?

Some technologies are described in this article. It has been used for quite a long time. But I didn't notice that there are more false detections. And I don't think it's possible to make such conclusions based on a couple of detections.

9 hours ago, Flood and Flood's wife said:

Hello @K0908, 

Welcome again!

1. Also, where is that Samsung Internet base.apk from? 

Thank you🙏
Flood🐳+🐋

I have no idea. I have never used Samsung Internet App. When I tried to open the app instead of chrome, it asked me to accept terms and such. I have always been using chrome and brave on this phone since purchase.

9 hours ago, AlexeyK said:

Some technologies are described in this article. It has been used for quite a long time. But I didn't notice that there are more false detections. And I don't think it's possible to make such conclusions based on a couple of detections.

Let's hope no more false positives in near future. Kind of scary when a random alert pops up. 

3 hours ago, K0908 said:

I have no idea. I have never used Samsung Internet App. When I tried to open the app instead of chrome, it asked me to accept terms and such. I have always been using chrome and brave on this phone since purchase.

Let's hope no more false positives in near future. Kind of scary when a random alert pops up. 

Hello @K0908, 

Thank you for posting back & the information! 

An .apk would've required *you* to grant install permissions. 

IF (you've) no idea where it's from & IF (you) don't use it - uninstall it. 

The *genuine* Samsung Internet App is available from Google Play Store & (Samsung) Galaxy Store, see image below. 

For future help, it is scary😨 when random-alerts pop-up, but, there are actions *you* can take for *unknown* OR even *known* apps, get the exe OR .apk, upload it to VirusTotal & Kaspersky Threat Intelligence portal & scan; with the results  either come to Community OR log a case directly with Kaspersky Customer Service:  https://support.kaspersky.com/b2c#contacts -> request the Kaspersky Virus Lab to analyse the issue, always provide a *detailed-history* = full device OS & build, software version, problem start date, new problem, ongoing problem, actions taken to remediate, etc.

Thank you🙏
Flood🐳+🐋

Edited October 27, 2025Oct 27 by Flood and Flood's wife
formatting

The alert come back again. So after about half an hour trying to figure out what is it and where is it. basically this base.apk is the core of installed Samsung Internet system App. I went to the google play store, uninstalled update. Scanned. No alerts. However, when I try to install update, it triggers the alert again. But the second time, when I try to "block" it, it says it's neutralized this time. 

I tried to extract the apk but somehow ML manager is not generating the file. The newest update is Samsung Internet v29.0.0.59. I guess you guys can get it from the play store and test it. My phone is not rooted. I can't get the apk now, or it is somehow modified due to that "The threat is neutralized". I am pretty sure it is the trigger for the HEUR. I will report later if I am able to get this apk.

I uplodaded to virustotal: https://www.virustotal.com/gui/file/bd0164c2ac0ca55f3bf7fe947508e3285ca546c95eb995d04f0996dfff46231b

Tried to upload it to opentip, but it's 285MB over the limite.

I am having same issue.  Tried troubleshooting with Samsung and they were not able to resolve. 

Please advise: is this a valid concern or a glitch within Kaspersky as when I  run AVG and Samsung device security scan, nothing is detected. 

On 10/30/2025 at 3:44 AM, K0908 said:

The alert come back again.

13 hours ago, Just me said:

I am having same issue. 

Hello @K0908 & @Just me, 

Welcome back & welcome!

Please zip the file causing the alert, protect the zip-archive with a password, use either MALWARE or INFECTED,  log a case directly with Kaspersky Customer Service: https://support.kaspersky.com/b2c#contacts-> select Email - request they send the case to: Kaspersky Virus Lab to analyse the issue, always provide a *detailed-history* = full device OS & build, software version, problem start date, new problem, ongoing problem, actions taken to remediate, etc, fill in the template as shown below & *read*: False detections by Kaspersky applications. What to do?

Please share the outcome with the Community, when it's available? 

Thank you🙏
Flood🐳+🐋

Edited October 31, 2025Oct 31 by Flood and Flood's wife
pn

The upload limit was 10MB each and 3 max. So there is no way I can upload the apk. I will provide the scenario info and screenshot. They should be able to get the apk from play store themselves. 

Just to sum up my case:

App: Samsung Internet

Base version: 27.0.9.86 https://www.virustotal.com/gui/file/bd0164c2ac0ca55f3bf7fe947508e3285ca546c95eb995d04f0996dfff46231b

Update Version: 29.0.0.59 https://www.virustotal.com/gui/file/c50af847dc88344cfc47a0724c021dbd0b54fc6bb5872b82b25ca4dd259d76c3/details

Both of them passed VirusTotal including Kaspersky. Can't upload to opentip due to size limit.

Symptom: Kaspersky Triggers HEUR: Trojan-Spy.AndroidOS.SmForw.bs when I try to update the app or full scan on already updated app. 

Current Solution: Uninstall update and disable auto update for this app.

I don't believe it is a real virus. It is hundreds of millions current users we are talking about.

41 minutes ago, K0908 said:

The upload limit was 10MB each and 3 max. So there is no way I can upload the apk.

 I will provide the scenario info and screenshot. They should be able to get the apk from play store themselves. 

Hello @K0908, 

Thank you for posting back!

• Hypothetically, using your approach - IF Kaspersky were to 'get the apk from play store themselves' - IF they couldn't replicate the issue (as we can't) who would they report that feedback too OR IF they could replicate the issue - who would they report that feedback too? The Virus Lab *expert-team* do not monitor requests in the Kaspersky Community Forum. 

*Above* we've provided an alternative method of logging the case - please *read* our instructions *carefully* -> repeated here: 

Please zip the file causing the alert, protect the zip-archive with a password, use either MALWARE or INFECTED,  log a case directly with Kaspersky Customer Service: https://support.kaspersky.com/b2c#contacts-> select Email - request they send the case to: Kaspersky Virus Lab to analyse the issue, always provide a *detailed-history* = full device OS & build, software version, problem start date, new problem, ongoing problem, actions taken to remediate, etc, fill in the template as shown below & *read*: False detections by Kaspersky applications. What to do?

Thank you🙏
Flood🐳+🐋

Edited October 31, 2025Oct 31 by Flood and Flood's wife
added Hypothetically etc

On 10/31/2025 at 1:55 AM, Flood and Flood's wife said:

Hello @K0908, 

Thank you for posting back!

• Hypothetically, using your approach - IF Kaspersky were to 'get the apk from play store themselves' - IF they couldn't replicate the issue (as we can't) who would they report that feedback too OR IF they could replicate the issue - who would they report that feedback too? The Virus Lab *expert-team* do not monitor requests in the Kaspersky Community Forum. 

*Above* we've provided an alternative method of logging the case - please *read* our instructions *carefully* -> repeated here: 

Please zip the file causing the alert, protect the zip-archive with a password, use either MALWARE or INFECTED,  log a case directly with Kaspersky Customer Service: https://support.kaspersky.com/b2c#contacts-> select Email - request they send the case to: Kaspersky Virus Lab to analyse the issue, always provide a *detailed-history* = full device OS & build, software version, problem start date, new problem, ongoing problem, actions taken to remediate, etc, fill in the template as shown below & *read*: False detections by Kaspersky applications. What to do?

Thank you🙏
Flood🐳+🐋

I did sumbit a false positive ticket. Just saying I can't upload the apk.

A very similar thing is happening to me, too, except when I open the Kaspersky app, the scan is frozen at 1% after showing me a "no threats found!" screen. I'm really not sure what to think.

9 hours ago, RedRatchet said:

A very similar thing is happening to me, too, except when I open the Kaspersky app, the scan is frozen at 1% after showing me a "no threats found!" screen. I'm really not sure what to think.

Hello @RedRatchet,

Welcome!

IF this issue OR a similar issue was happening (to us) & it's not, we've run multiple tests on multiple phones trying to replicate, we'd reach out to Kaspersky Customer Service for their expert assistance. The guide we've provided twice now, earlier in this topic will assist if (you) wish to do that. 

Thank you🙏
Flood🐳+🐋

Edited November 2, 2025Nov 2 by Flood and Flood's wife
pn

2 hours ago, RedRatchet said:

A very similar thing is happening to me, too, except when I open the Kaspersky app, the scan is frozen at 1% after showing me a "no threats found!" screen. I'm really not sure what to think.

What happened to me at first was I noticed long time of large memory occupation. When I opened Kaspersky the alert jumps out immediately. And the scan usually only takes about 15 mins, it was stuck for more than 5 hours. Something was definitely going on. After more than a decade of total confidence with Kaspersky, I am not so confidence after recent false positives. 😅 

6 hours ago, Flood and Flood's wife said:

Hello @RedRatchet,

Welcome!

IF this issue OR a similar issue was happening (to us) & it's not, we've run multiple tests on multiple phones trying to replicate, we'd reach out to Kaspersky Customer Service for their expert assistance. The guide we've provide twice now, earlier in this topic will assist if (you) wish to do that. 

Thank you🙏
Flood🐳+🐋

Yes, thank you, I am a literate person and saw the guide. I was merely commiserating with OP 🙂

Just a follow up. The latest Yahoo Finance app just publish was triggered a HEUR:Trojan-SMS.AndroidOS.Chyapo.c. Because it's less than 256MB. I am able to upload this time. Here is the report: https://opentip.kaspersky.com/F53D3FBB101084F69E1D0994756DA9C8B423CDB3C756BCA6E69E668FBED7E3BF/results?tab=upload

Submitted for reanalyze and waiting for result. 

Here is the virusTotal link: https://www.virustotal.com/gui/file/8be6b1238c9b2cb2315cecf87a0aceec95fe2a934785c6dd367259745d37d75d

I was also having this issue, uninstalled Yahoo Finance App and discontinued Samsung Internet. Not sure exactly what discontinued means. Language from my phone.

Can't figure out which file it is to attach it. Kaspersky does not quarantine it, only alerts me and I block it.

I was also having this issue, uninstalled Yahoo Finance App and discontinued Samsung Internet. Not sure exactly what discontinued means. Language from my phone.

Can't figure out which file it is to attach it. Kaspersky does not quarantine it, only alerts me and I block it.

The Samsung Internet is still there. Cannot remove it.

 

20 hours ago, helpwithtrojan said:

I was also having this issue, uninstalled Yahoo Finance App and discontinued Samsung Internet. Not sure exactly what discontinued means. Language from my phone.

Can't figure out which file it is to attach it. Kaspersky does not quarantine it, only alerts me and I block it.

The Samsung Internet is still there. Cannot remove it.

 

I got msg from Kaspersky team, yahoo finance is a false positive, they said they will fix it. To date, the latest database still does not handle the FP. I guess just uninstall yahoo finance for now. lol

Same issue here!  I tried scanning with AVG, it finds nothing. Kaspersky will catch it as you state but wont quarantine it, can only select block, and then disable samsung internet.  However the same warning comes back every few days. I am wondering why Kaspersky wont quarantine the file.   Mine is not related to yahoo finance, as I don't have that. Just get  this warning >>>>>theheur:trojan-spy.androidOS.smforw.bs

Got the exact same problem. Kaspersky scan can froze for hours and shows warning on the trojan in Samsung Internet app when clicked. I'm surprised it's not been resolved yet. It's really billions of customers affected so it's most likely a false alert and is not corrected in data base. I did re-install the app when got the warning right from Google play store but got the same warning when Kaspersky scanned.

I also had the same warning about Trojan in Samsung Wallet few months ago but I don't really use this app so just deleted it.

Now I think it also was a false flag. I wonder if somebody at Kaspersky lab doesn't like Samsung 🤔