Suspicious app activity + AdGuard cannot create a VPN connection

[rgiotxy]

Hi there,

I'd heard great things about AdGuard AdBlocker, so I decided to give it a try; pending on how the free trial on two devices went, I might purchase a lifetime licence for nine devices. But my experience so far has been:

(1) On one device, Avast Mobile Security refuses to install AdGuard AdBlocker and recommends deleting the installer .apk file because it's detected "suspicious app activity" (BTW, how do you respond to this? is AdGuard malicious? or is that a fake app with the same package name?). (2) On the other device, installation via Avast Mobile Security went smoothly and without a hitch, but after configuring AdGuard with filters, app rules and userscripts, I could not activate it — clicking the "on" switch merely produces an error message "AdGuard cannot create a VPN connection. It is possible that VPN is not supported by your firmware." (BTW my free 7-day trial licence is running and will expire on the 12th of April, even though I haven't been able to test the app; if this problem isn't fixed in time, would you please provide me with a new trial licence? I want to know whether AdGuard actually works — a lot of people in the forums are reporting that it doesn't — before paying money for it).

Both devices are Samsung Galaxy A51 with Android 10 and no root, running on Avast Mobile Security 6.47.0 (the latest version available on the Google Play Store) with all virus definitions up to date; on both devices adguard.apk ("AdGuard for Android 3.6.7", package name com.adguard.android) was downloaded from https://adguard.com/en/welcome.html; and on both devices Blokada 5.20.2 is able to create a local VPN connection without problem, so it can't be a VPN is not supported by the firmware issue.

Screenshots of attempt to install AdGuard for Android 3.6.7 on device #­1 (dark mode off):

Screenshots of attempt to install AdGuard for Android 3.6.7 on device #­2 (dark mode on):

Screenshot of attempting to enable AdGuard for Android 3.6.7 on device #­2 (dark mode on):

What I've tried to fix issue #­1 (suspicious app activity detected by Avast Mobile Security) on device #­1:

1. Delete .apk files from mobile phone's storage and download them again from the same page (over and over)
2. Post thread on AdGuard Forum

EDIT: as I was writing this, it suddenly occurred to me that I should try sending over the adguard.apk file from device #­2 to device #­1 via Bluetooth, and what do you know? It worked! Which only raises further questions, as I had tried downloading it directly from the https://adguard.com/en/welcome.html page on device #­1 at least five times over and it didn't solve the problem. Is it possible that the page was hacked? Or that device #­1's attempt to connect to it was somehow intercepted by a man-in-the-middle attack? I exported the settings from device #­2's AdGuard to device #­1's AdGuard and tried enabling the protection to see if it would work; now device #­1 is experiencing the same problem #­2 as device #­2 (can't establish a VPN connection, even though Blokada does it just fine).

What I've tried to fix issue #­2 (AdGuard cannot create a VPN connection) on device #­2:

1. Disable Blokada protection before attempting to enable AdGuard protection
2. Grant AdGuard special battery privileges so it can't be "optimised" or "put to sleep" by the Device Manager
3. Switch over to the "Nightly" release channel and update to AdGuard for Android 4.0.74 (nightly 33)*
4. Restart the device
5. Uninstall AdGuard for Android 4.0.74 (nightly 33) and reinstall AdGuard for Android 3.6.7 (default)*
6. Reinstall certificate (at least three times over)
7. Contact customer support service via app (ticket number 592383)**
8. Post thread on AdGuard Forum

­* action required installing AdGuard .apk file via Avast Mobile Security; installation proceeded successfully without issue, and device was subsequently scanned numerous times over without any suspicious app activity detected, just as no suspicious app activity was detected the first time around ­** customer service claims that "At this moment we've got a lot of incoming requests, so there is a delay in our answers. We'll do our best to get to your ticket as soon as possible, but, due to technical reasons, we are strictly limited in our resources and have to treat mostly payment-related tickets postponing technical ones. We apologize for the inconvenience 🙁" and suggested posting on Android Forum, who in turn suggested reporting issues here

---

Assuming these issues can be resolved in time before the trial licence expires (or that these issues can be resolved and I'm issued a replacement trial licence), I also have a few follow up questions concerning AdGuard for Android in general:

1. I see an alert about having too many active DNS filters enabled on AdGuard (that it supposedly makes the filtering slow) every time I add a new one, but I see the same alert on Blokada, and at the Blokada Forum I was told not to worry about it as long as I have relatively few DNS filters and a sufficiently large (in my case 4GB) RAM memory. I was also told that, in Blokada, all active DNS filters are consolidated before being applied, so I shouldn't worry about the percentage of intersections between my active DNS filters (CPBL, OISD, hBlock and TBLP) either. Should I assume that the same goes for AdGuard (which purports to be better than Blokada), so if Blokada can handle my current volume of DNS filters and still work flawlessly smoothly, AdGuard will be able handle the same amount of DNS filters just as smoothly?
2. Do I still need the AdGuard Browser Extension if I have AdGuard for Android? I know I need it if I have Blokada, because Blokada only blocks domains while AdGuard BX can block anything (specific pages, JavaScript requisitions, CSS, even cookies and HTTP(S) requisitions), but the AdGuard for Android settings has a space for adding content-blocking filters identical to the corresponding space on the AdGuard Browser Extension settings + a separate space dedicated to Blokada-like DNS filters, so it sounds like AdGuard for Android can replace both Blokada and the AdGuard BX simultaneously.
3. Do I need to install the AdGuard Browser Assistant?
4. I'm told AdGuard for Android doubles as a userscript injector. Is it compatible with both GM3 and GM4? Will it inject userscripts only on web browsers, or will it work on other apps that can display webpages too? Would the settings from the AdGuard Pop-up Blocker script be applied to all apps where the script is injected or would each app require the script to be configured independently? (Incidentally, why does AdGuard need a userscript to block pop-ups? In my computer I had AdBlock Plus and the ABP Pop-ups Add-on was simply a user-friendly GUI for creating regular ABP filter rules for blocking pop-ups and pop-unders, couldn't AdGuard [which is supposedly fully compatible with ABP syntax] do that [all on its own = without a userscript] too?)
5. Blokada displays all domains passing through it and whether or not they have been blocked by it, so the user can manually identify domains that are passing through but shouldn't be or vice-versa. Does AdGuard for Android do that? (Incidentally, ABP also has a Blockable Elements Console that shows every element in the page and whether it's being blocked or not so you can manually identify elements that should be blocked but aren't being or vice versa, any chance AdGuard can ever implement that?)
6. Where do I post a suggestion that AdGuard should have a native option to select which parts of the AdGuard Annoyances list you want enabled and that it should include a clickbait filters sub-list? (Although, now that I think about it… when I was configuring AdGuard, I was explicitly asked if I wanted to keep social media widgets and cookie policy notifications and I said yes, as those are my main reasons for not subscribing to the AdGuard Annoyances list as a whole and instead subscribing to sub-lists one by one — does the fact that I opted out of blocking those elements when AdGuard asked me to mean that they wouldn't be blocked if I opted into AdGuard Annoyances as a whole list instead?)
7. Is there a way to make AdGuard displays dates in the standard UN format (DD MM YYYY) rather than the USA-only format (MM DD YYYY)?

[Chinaski1]

Hi there!

1) Could you please specify the source which adguard.apk was downloaded from? It looks like it was downloaded not from the official site, but from an unknown source

2) It seems that the problem with creating a VPN connection on Samsung is related to Restricted mode or Secure Folder.

Try to use this instruction to fix the issue with the VPN.

[rgiotxy]

1. As I've clearly stated above, "on both devices adguard.apk was downloaded from https://adguard.com/en/welcome.html" Is that not supposed to be the official website?
2. I'm afraid I cannot use these instructions because my free trial licence has expired, so I've uninstalled the app. Would you mind providing me with a new free trial licence, so that I can try the app again?

[anonymous-user]

Do I still need the AdGuard Browser Extension if I have AdGuard for Android?

No.

Where do I post a suggestion that AdGuard should have a native option to select which parts of the AdGuard Annoyances list you want enabled and that it should include a clickbait filters sub-list?

The AdGuard Annoyances is one whole list. It would be better to find a smaller list that only blocks what you want. Or the AdGuard team themselves would have to split the Annoyances list into a bunch of smaller lists.

I'm afraid I cannot use these instructions because my free trial licence has expired, so I've uninstalled the app. Would you mind providing me with a new free trial licence, so that I can try the app again?

It should still be possible to use AdGuard in free mode. You will lose the premium features but the app itself should still work for troubleshooting.

[rgiotxy]

It should still be possible to use AdGuard in free mode. You will lose the premium features but the app itself should still work for troubleshooting.

The point of the free trial is to try out the premium features so I can see for myself whether they are worth paying money for. I could get a new free trial licence by using a different e-mail account, but I'm afraid that would be seen as a violation of the terms of service — even though I would be buying a licence for my whole family and I just want a new trial licence because my old one expired without being used — it didn't block a single anything or save even a single bit of data because AdGuard failed to instruct me on how to install their software correctly in less than the seven days of trial I was supposedly entitled to. So really, it is on AdGuard's better interest to give me a new trial, to convince me that they're worth paying my money for. All I want is what I'm supposedly already entitled to, but which they failed to deliver — a seven-day free trial. I would probably be satisfied with a single-day free trial, as long as I got to actually use the features I'm supposed to be trying. In my trial, I wasn't given access to any features, premium or otherwise, because you waited until after the trial licence was expired to deign to offer instructions on how to finish installing the product (instructions which I'm not even sure would have worked, mind you, because they came too late to use).

Or the AdGuard team themselves would have to split the Annoyances list into a bunch of smaller lists.

They already have. If you go to the list's Github page you'll see that the one AdGuard Annoyances list you subscribe to via the AdGuard GUI is actually the combination of several independently maintained (or, at least, independently updated) AdGuard Annoyances sub-lists, each targeting a specific type of annoyance: circumvention, remains, push notifications, cookie notifications, social media widgets, etc. If you consider some of these things annoyances, but not others, you can subscribe to the specific sublists you want and not the ones you don't want to via Github. One of my suggestions is that they should give this option straight at the GUI, so you can automatically configure what kind of things you consider annoyances while still subscribed to AdGuard Annoyances via the official GUI option rather than having to use Github. My other suggestion is, I didn't see an AdGuard Annoyances sub-list targeting clickbaiting, but I believe there should be one — I can't be the only person who thinks clickbaiting websites are annoyances that should be covered in the AdGuard Annoyances list, am I?

[Chinaski1]

@rgiotxy

Please email us at devteam@adguard.com and provide a link to this task, I will give you a temporary free license.

[rgiotxy]

@Chinaski1

I must have misinterpreted what you meant, as I sent an e-mail to devteam@adguard.com with a link to https://github.com/AdguardTeam/AdguardForAndroid/issues/4137 two days ago and I haven't received any answer.

What do you mean by "provide a link to this task"? Is there a specific title I should name the e-mail or a specific request I should write on the content?

[rgiotxy]

Thank you very much =D

[maxikuzmin]

@rgiotxy tell me please, is everything okay with you now?

[rgiotxy]

@maxikuzmin and whoever else may this interest

Hello,

My computer had been unavailiable up until now, which is why, despite having successfully received the new trial license 12 days ago, I only attempted to activate it today (no point in wasting it, no computer = no ADB = no way to try the solution from https://kb.adguard.com/en/android/solving-problems/restricted-profile#solutions). I have just reinstalled AdGuard on my Android device, used command adb shell pm grant com.adguard.android android.permission.INTERACT_ACROSS_USERS to supposedly solve the problem, and restored all AdGuard settings from a backup, now with the new free trial license graciously provided by @Chinaski1 and set to last until the 8th of June, 2022 (exactly one month from now).

And here is the immediate, obvious benefit of a thirty-day license: , even though the command line adb shell pm grant com.adguard.android android.permission.INTERACT_ACROSS_USERS was run successfully through ADB and even though

I don't even know if my phone supports multiple user accounts other than via Dual Messenger, as I don't have the Google Admin app (how would I even know if there are other accounts on my device?); solution #­3 requires root access, which I don't have.

PLEASE HELP. ISSUE IS NOT RESOLVED, ADGUARD DOES NOT WORK ON MY PHONE.

OBS: click on image #­1 to watch the video

[Birbber]

@rgiotxy Hi! Could you send us the debug logs of the application? Here's what we need you to do:

1. Collect the debug log as it's explained here;
2. Remember the exact time when the issue was reproduced. We will need it to find the corresponding records in the log file;
3. Send it to devteam@adguard.com. Mention the Github issue number and the exact time when the issue was reproduced.

[rgiotxy]

Hi, I received an email from one Anna Nastenko (of the AdGuard QA Department, same conversation as where @Chinaski1 sent me the free trial licence) requesting me to "share the logs as was requested in the issue". I assumed that was you (@Birbber) and sent the log file you requested along with the time (20:40 local time), the Github issue number (#4137) and the consumer support ticket (592383); was I correct, or should I send a new, separate e-mail to devteam@adguard.com?

PS: I just took a new screenshot that might be significant.

When I press the option "VPN connection is not configured", it changes to "preparing to start protection, please wait" and keeps saying that until I turn off my phone, even if days later. Attempting to reproduce the error while this "preparing to start protection, please wait" message is displayed causes an error, the protection still won't turn on but the error I recorded a video of here does not occur either — rather, AdGuard becomes sort of stuck/frozen and has to be quit/closed and relaunched again.

[maxikuzmin]

@rgiotxy I understood from the video that your Kill switch is not configured correctly. If you want to use both apps in Kill Switch mode, first of all, you need to configure Kill Switch in the system settings of the AdGuard app, not in the Adguard VPN. You can also enable only "Always-on VPN". The "Block connections without VPN" function is not technically possible at the moment.

Here's what needs to be done: Open AdGuard VPN -> Click on the gear (settings) -> App settings -> Kill Switch -> Open settings (opened VPN system settings) -> select AdGuard, click on the gear opposite (you can first disable this setting in AdGuard VPN, but it is not crucial) -> select "Always-on VPN" here (just do not click on "Block connections without VPN", this feature is not compatible yet) Now the error should disappear. Let me know the result, please.

[rgiotxy]

Do I need to install AdGuard VPN to do that? Also, what do you mean by "both apps"? AdGuard and Blokada? I figured I wouldn't need Blokada anymore if I could get AdGuard to work, which is becoming more and more a distant, impossible dream.

PS: pardon the closing and reopening of this thread, my touchscreen is glitching because of the cold weather. I was in the middle of typing this reply and it must have interpreted I hit the "close with comment" button when I was, in fact, hitting the keyboard.

[rgiotxy]

It's been over a month, can someone please assign the proper labels (mainly BUG REPORT; part of this was a question, but I now intend to branch that part off into a separate issue, so just "BUG" and the appropriate version numbers will suffice) to this thread?

[maxikuzmin]

@rgiotxy I thought you were using both of our apps (AdGuard and AdGuard VPN) What app are you using AdGuard with now? Do you have any kind of VPN? Or are you only using AdGuard? Anyway, the error shown in the video usually occurs when you set up Kill Switch on your phone system. Tell me please, in the system settings did you change the Kill Switch?

[rgiotxy]

I'm not using AdGuard at all right now, because it won't activate and is therefore useless. But I believe you have found the root of my problem: Blokada Libre is a free, open source DNS filter that works by creating a "local VPN" proxy, which is the same exploit AdGuard uses to provide its various services (content blocking, DNS filtering, firewalling, userscript injection). I had Blokada first, because it's free; it starts on boot (unless you program it not to) and has a "keep alive" feature that makes it be interpreted as an "always on VPN" by the Android system. Over a month ago, I installed AdGuard for Android for a free trial because I ran a cost-benefit analysis and decided that, if it worked as advertised, it would be worth buying a premium license for my family. Unfortunately, that was 42 days ago and I haven't been able to run the trial yet, because AdGuard's protection cannot be enabled — supposedly, AdGuard cannot create a VPN profile on my device (even though I know it is possible because Blokada had already created a VPN profile on my device successfully years before I "had" AdGuard), and, without a VPN profile, AdGuard can't do anything. But if what you call "Kill Switch" is what Blokada calls "keep alive" (function as an "always on VPN"), then the reason I cannot activate AdGuard is because I have Blokada — even though I normally turn off (disconnect from) Blokada before trying to activate AdGuard.

Is there a way to fix that without having to uninstall Blokada? Blokada's settings cannot be exported unless you have a premium account, and if AdGuard doesn't work for me, I would like to be able to go back to Blokada Libre. There's years worth of custom filters in my profile that I would lose if I uninstall it.

[maxikuzmin]

@rgiotxy the fact is that your system can only accept one local VPN. This is exactly how android works. Only one local VPN is attached. You can't use two at the same time. This is why the error appears. You have to choose one. If you leave only one application, there should be no problem.

[rgiotxy]

😭😭😭 Thank you =(

[rgiotxy]

SOLUTION FOUND

Go to Settings > Connections > More connection settings > VPN and make sure the "always on" option on all existing VPN profiles is turned off. This resolved the problem.

OBS: Your information is wrong. It is perfectly possible to have multiple Local VPN profiles in one device simultaneously, as long as only one of them has "always on" privileges. There's no need to uninstall anything or delete VPN profiles.