title: android InstantRun - Norton Security finds Trojan
body: <p>A week ago Norton Security started to find Trojan horse (Trojan.Gen.NPE.2) in file R.class located:</p>
  
  <p><strong>app\build\intermediates\transforms\instantrun\debug\folders\1\5\main\android\support\v4\ r.class</strong></p>
  
  <p>and</p>
  
  <p><strong>app\build\intermediates\transforms\instantrunslicer\debug\folders\1\5\slice_2\android\support\v4\ r.class</strong></p>
  
  <p>Link to virustotal.com scan: <a href="https://www.virustotal.com/pl/file/282f4e09c102cd93c2f849c9fe9ed570188f5a03395ab84d2457a7c64d7acb1c/analysis/1499458308/" rel="nofollow noreferrer">https://www.virustotal.com/pl/file/282f4e09c102cd93c2f849c9fe9ed570188f5a03395ab84d2457a7c64d7acb1c/analysis/1499458308/</a></p>
  
  <p>And the code:</p>
  
  <pre><code>package android.support.v4;
  
  import com.android.tools.fd.runtime.IncrementalChange;
  import com.android.tools.fd.runtime.InstantReloadException;
  
  public final class R {
      public static final long serialVersionUID = 830508538663712626L;
  
      public R() {
          IncrementalChange var1 = $change;
          if(var1 != null) {
              Object[] var10001 = (Object[])var1.access$dispatch("init$args.([Landroid/support/v4/R;[Ljava/lang/Object;)Ljava/lang/Object;", new Object[]{null, new Object[0]});
              Object[] var2 = (Object[])var10001[0];
              this(var10001, (InstantReloadException)null);
              var2[0] = this;
              var1.access$dispatch("init$body.(Landroid/support/v4/R;[Ljava/lang/Object;)V", var2);
          } else {
              super();
          }
      }
  
      R(Object[] var1, InstantReloadException var2) {
          String var3 = (String)var1[1];
          switch(var3.hashCode()) {
          case -1968665286:
              super();
              return;
          case -71951640:
              this();
              return;
          default:
              throw new InstantReloadException(String.format("String switch could not find \'%s\' with hashcode %s in %s", new Object[]{var3, Integer.valueOf(var3.hashCode()), "android/support/v4/R"}));
          }
      }
  }
  </code></pre>
  
  <p><strong>Is it false alarm?</strong></p>