Malwarebytes can't remove PUP.Rooter.kingroot.YY

[Iortiz]

Hello,

I just got a new Samsung Galaxy J7 (2016).

From the beginning my Android phone introduced some advertising (pop-ups) in home. I thought it was because of any application that I downloaded and erased almost everything and left only the minimum required (the ones that were preloaded, facebook, gmail and whatsapp). But advertising did not disappear. All the applications I downloaded came directly from Google Play.
I decided to reset to factory conditions, but advertising still appears.
I downloaded several antivirus before and found nothing strange. Malwarebytes only found Android / PUP.Rooter.Kingroot.YY after returning to reset to factory conditions (the second time). But when I ask you delete, Malwarebytes can not do.
My questions are:
1- Is Android/PUP.Rooter.Kingroot.YY secure?
2- You should get rid of it? And if so, how do I do it?

3 - Is Android / PUP.Rooter.Kingroot.YY responsible for those popups?

Please help, I am not an expert in Android

[ho79]

I have a XiaoMi Redmi 3 Pro, and Malwarebytes picked up the same threat today and it could not delete it. Can someone please help?

[a_Mbam]

Hi Loritz, Ho79,

This particular app has the Kingroot SDK as an add-on which gives the host app the capability to root (escalate privileges) and install apps without the users knowledge or permission. The app looks to have come preinstalled with the device and is listed as a system app that is why it cannot be removed by MBAMM.

The apps I've looked at do appear to have hidden adware compenents as well, likely why they need to escalate privileges to get around user interaction. This has become a big problem with cheaper priced device, they come preinstalled with malicious apps and the apps cannot be removed using Android's uninstaller.

These apps on your device should not be trusted, there are a few things you can do.

- Disable the app – Can be done via Android Settings -> Apps -> bad app -> Force stop/disable

        This will prevent the app and any associated services from running.

- Root your device and uninstall the malicious apps. Usually reserved for advanced users, please do at your own risk.

- Install different, trusted, ROM to replace infected one. Usually reserved for advanced users, please do at your won risk.

- Return device where purchased.

I wish there were more options but where Android's openness and built in security collide; openness, anyone can flash a device with a custom ROM, security, you can't uninatll system apps.

Regards,

-Armando

[Iortiz]

Hello

Thank you very muchas for your response. 

I got a little scare about this so I contacted Samsung support center and they deleted it form me. I don't know how they did it but it worked.

I was so happy!!!

Thanks again