WP7 AVG "antivirus" app is possibly spyware

Since the release of AVG’s antivirus security suite for Windows Phone 7, a lot of controversy has come about over the software and its functions. Former Microsoft employee Justin Angel took apart the WP7 application and reported back through his Twitter account that the AVG app is in fact spyware. He found that the application tracks users through the geo location API (GeoCoordinateWatcher) and sends back unique information, such as phone model, users’ email addresses and location, to the AVG servers.

This use of the GeoCoordinateWatcher is specifically not allowed by the certificate guidelines, according to Angel. To make matters worse, well-known Windows hacker Rafael Rivera revealed that the application only scans for EICAR test strings and a specific Hebrew word through its supposed malware scanner. Meanwhile the application displays loads of advertisements.

WPCentral and Centurion’s Blog theorized that the suspicious use of location data could be used for several things: quality assurance, sending info to the more useful Android application, location based searches and marketing purposes – the last of which would be the most malicious. Microsoft’s Brandon Watson is investigating the issue following this controversy, while the app still remains available in the Marketplace.

The locked-down and sandboxed nature of Windows Phone 7 makes it difficult for malicious code to be executed and gain unwanted access to data, and as a result any anti-virus software can only perform limited tasks to search for and remove said code. At this stage the AVG Windows Phone antivirus suite looks extremely suspicious, provides little-to-no protection for the user, has a main purpose of serving ads and potentially uses location data for unwanted purposes