Two thirds of Android antivirus apps are pure snake oil

If you search the Google Play Store for antivirus software, you’re not short of options. The problem is that most of the choices available are either worthless or actively harmful, according to a comprehensive study from Austrian antivirus testers AV-Comparatives.

In all, 250 antivirus apps were tested and just 80 showed any kind of competence by detecting 30% or more of the 2000 malicious apps installed on the test phones. The rest either detected under 30% of threats or gave an alarming number of false positives. Some of them have even been pulled from the Play Store, they were so bad.

Related: Best free antivirus software

You can probably guess the antivirus software that did well: it’s the apps you’ve already heard of, and that come from a strong line of PC-based AV software. Think Kaspersky, McAfee, AVG, ESET and Symantec, which – along with 18 others – caught everything.

For the rest, failure wasn’t uniform. Some apps were decent at blocking threats, but introduced their own security weaknesses along the way. Others were just over the top, having a whitelist of pre-approved apps, and blocking everything else. Amusingly, some of said apps forgot to whitelist themselves, meaning they were blocked by their own over-the-top defence.

But even if you’re happy with this walled garden approach, you shouldn’t be, because they were remarkably easy to fool. As they’re just looking for package names called “com.facebook” or “com.adobe” then it’s pretty straightforward for malicious app creators just to name their packages in such a way that they’d slip through unquestioned.

Related: Best Android apps

Quite a lot of the apps tested appeared to be clones of each other: white label software with only minor cosmetic tweaks to look different, as this wall of screenshots from AV-Comaritives neatly demonstrates:

Why? The company believes that it’s either for the ad money or to “have an Android protection app in their portfolio for publicity reasons.” Which probably isn’t reassuring if you’re relying on said company for protection against app nasties.

Given some of these worthless apps do a good job of impersonating a solid antivirus experience to an untrained eye, download numbers and Play Store reviews are absolutely worthless as a way of assessing quality. “Using user ratings is clearly not effective, as the vast majority of users will give their rating based solely on the user experience, without having any idea as to whether the app offers effective protection,” AV Comparatives writes. “Most of the 250 apps we looked at had a review score of 4 or higher on the Google Play Store.

“Similarly, the number of downloads can only be a very rough guide; a successful scam app may be downloaded many times before it is found to be a scam. A recent “last updated” date also does not seem to be a good quality indicator, as many low-scoring apps had relatively recent updates.”

You can read the full study here.  

Which Android antivirus app do you use, if any? Let us know on Twitter: @TrustedReviews.

Unlike other sites, we thoroughly review everything we recommend, using industry standard tests to evaluate products. We’ll always tell you what we find. We may get a commission if you buy via our price links. Tell us what you think – email the Editor