Hi,
Malwarebytes is flagging apps in /system/priv-app on my IPRO Kylin 5 phone ( running Android 6 ) . One of them is the default launcher (!) which I cannot disable. I can force stop it, remove all permissions and delete all data but every so often it tries to restart ( It asks if it should replace Nova Launcher as the default launcher ...)
Another flagged app ( Beauty center ) can be disabled and denied all permissions .
Finally the last app ( dualaid ) is a weird one - it is not listed in any App list as running or loaded or whatever. Not sure if it is possible to hide an app or it simply does nothing.
Here are the signautures :
Andrid/PUP.Riskware.Cooee.H /system/priv-app/phenixlauncher_tc28b_i950g/phenixlauncher_tc28b_i950g.apk
Android/Riskpay.Excel.lib.kxqp /system/priv-app/dualaid-chengkai.wa/dualaid-chengkai.wa.950.apk
I haven't found where "Beauty center" hides yet.
A zip file with the offending apps is attached
peter
sam.zip