Play protect found a harmful app (RfTest) on initial setup of a brand new (Oppo) phone

[Android Central Question]

I have a brand new Android 9 phone ( Oppo ). Whilst setting it up and after connecting to the internet, Play Protect pop'd up a notification warning to the effect of - "Harmful App Disabled - RfTest, This app tries to bypass Android's security protections" and it said it has disabled it. Also, in 'My Apps & games' it shows - "1 harmful App removed". Both reports appear to be at the same time.

So I assume 'RfTest' is a possibly dodgy app that Play Protect has blocked or removed. How do I tell if the app has been totally removed? I looked in the settings Apps section and cannot see an app by that name, so I'm not sure if its been disabled as one report says, or removed as the other says. How do you tell?

I've briefly searched for details of this RfTest but haven't found any either by itself or linked to directly to Oppo.

What would you recommend as the next step? Return the phone for a replacement/refund? Or is there anything I can check to definitely prove its gone?

Has anyone come across this warning regards RfTest either on an Oppo or another phone? Its V unlucky if I'm the only one with it on a new phone. Is this normal?

I'm a little surprised and disappointed that a brand new Android phone has a dodgy app on it in the first place.

I'm new to Android so any help would be appreciated.
Thanks.

 

[B. Diddy]

Welcome to Android Central! Here's some more information about what Play Protect does: https://support.google.com/accounts/answer/2812853?hl=en. If the app was preinstalled, it might not be removable, so Play Protect might just Disable it. Go to Settings>Apps, tap Menu>Show System, and see if RfTest shows up there as Disabled.

It's hard to say exactly why RfTest was flagged by Play Protect. It's likely that it's not malicious per se, but rather violates Google's Unwanted Software Policy: https://www.google.com/about/unwanted-software-policy.html. You may want to reach out to Oppo's customer service and see if they have any input on this.

Please register on this forum, which will allow you to engage in discussion more easily, as well as post images. https://forums.androidcentral.com/ask-question/409154-join-android-central-community.html

 

[anon(10614692)]

Oppo amongst certain other Chinese manufacturers are renowned for embedding malware in their devices so I don't find it surprising. I personally wouldn't purchase any Chinese device, as a result

 

[CF555]

Thankyou for your quick responses., I've joined the forum to reply etc.
B Diddy - I don't appear to have 'Settings>Apps' but it does have 'Settings>App Management' which also has a 'show system processes' option. Additionally it has 'Settings>System Apps'. But I cannot see RfTest in either. Its running Android 9 with ColorOS6, it claims.
I have emailed Oppo support yesterday, but as of yet I have not had a reply.

Galactic Zoo - Really? I wasn't aware of that sadly. I seen glowing reviews on the phone but none I read mentioned possible included malware. I certainly would not have purchased it if I was aware of that.

Again thank you both for your responses.

 

[CF555]

I should have added, is there any thing further I can do or check?
Thanks

 

[B. Diddy]

You could install a trusted antivirus app like Malwarebytes and run a scan. But in general, I don't think there's much else to do right now. Wait to see what Oppo has to say, although I'd take their explanation with a grain of salt.

 

[CF555]

Thanks.

I installed individually from the Play store, first free AVAST and then free Malwarebytes, updated and scan'd with both. Neither found anything malware related. Also a further Play protect scan also reports all clean now.

Oppo have come back and said RfTest is not one of their apps and not a pre-installed app on their phones.

Which still leaves the problem as to how/why it got onto a brand new phone in the first palce?

 

[B. Diddy]

Where did you buy it from? Direct from Oppo, or through a 3rd party seller? If the latter, then they might be responsible.

BTW, I'd also avoid Avast, based on their past data-handling practices: https://www.cnet.com/news/antivirus-firm-avast-is-reportedly-selling-users-web-browsing-data/

 

[CF555]

Thanks again.

I purchased it from a UK based shop and have been in touch with them. They seem concerned and helpful so far and seem to be considering a refund if I want one.

I was aware of that about Avast and ticked all the opt-out policies whilst it was on the phone. But it was only on for the scan and them removed, and there is nothing important on the phone at the moment anyway. It's brand new and I was just setting it up when this RfTest thing occurred.

By the way Rftest it seems is an Oppo app, as in one of the Malwarebytes lists in its menu, it is displayed as a grey'd out system app ( I assume grey'd out as Play protect has stopped it ) listed as being from 'com.oppo.wifirt'.

So I'm not sure now, is it just a badly written app, is it harmful as Play Protect says, is it a Play Protect false positive? Who knows?
Its a shame, because I have to say I like the phone, good screen, good camera, speedy, loads of storage, reasonable price.