I bought my Lenovo Tab 2 from a reputable store in unopened original packaging and have only updated from Lenovo OTA from Android 4.3.3 to 5.0. It's detected multiple times because I copied the file to the SD card. False positive? Or something to worry about? Forgot to mention that Norton Mobile Security fails to pick up either the original or the copy.
I've also started getting this Fota detected as of about 2 weeks ago. File /system/app/FWUpgradeProvider/FWUpgradeProvider.apk on a Lenovo Tab 2 A7-10F (upgraded to official Lenovo Android 5.0 months ago)