MonsieurD Posted May 4, 2017 ID:1122072 Share Posted May 4, 2017 Alexfr j'ai aussi un mtt ideal, et aussi cette saleté de triada.EU et ses petits depuis 1 semaine, qui reviennent toujours malgré Malwares très, Kaspersky, Avast etc... J'ai aussi prévenu le sav de mtt/adar et j'attends...idem concernant le renvoi de l'appareil: Si le système est pourri à la base, pas la peine de perdre du temps...Aromino au cas où je te contacterai peut-être... Je laisse un peu de temps à Adar/Mtt/Nomu, mais sans réponse ou solution je serai bien déçu... choper des saletés en prenant des risques, c'est la vie; mais là dans ce cas ça voudrait vraiment dire que malgré leurs qualités apparentes les premières semaines, ces appareils sont à éviter (surtout dans un cadre professionnel!). À suivre... Link to post Share on other sites More sharing options...
HansSunn Posted May 4, 2017 ID:1122122 Share Posted May 4, 2017 Dear all, Sorry but my French writing is not that great so I reply in English. I did by a Evolveo StrongPhone G4 a while ago and have the same problem. I have Fsecure Safe and this AV does not or did not detect the malware. Setting is Safe he said. Malware byte detect it and ask to remove these file. Once they are reinstalled. I had contact with the support, but for a new firmware I have to send my phone to there support center in the Czech Republic. They say that this was not installed on the firmeware coming out of the factory not sure if this is true … I also cannot find anything to root this device. For now Malwarebytes does the trick but I am not sure if my cell is 100% safe now. Factory reset did not help. If somebody has a def. solution please share. Kind regards, Hans Link to post Share on other sites More sharing options...
bouby Posted May 4, 2017 ID:1122212 Share Posted May 4, 2017 Hi, I also solved my problem on the S10 by flashing it with an Archos stock rom; Aromino gave me the tip. If the MTT Ideal is a rebrand, you would be able to find a stock rom for your S20 am I right ? Link to post Share on other sites More sharing options...
HansSunn Posted May 4, 2017 ID:1122215 Share Posted May 4, 2017 Bouby, The phone I have is a Evolveo StrongPhone G4 it is rebranded but I don't know what the exact model of phone with the same firmware that should work. I created a ticket at Evolveo and thay say they will provide a new firmware but don't know when. Just great ... Link to post Share on other sites More sharing options...
NomuS20-victim Posted May 4, 2017 ID:1122251 Share Posted May 4, 2017 From what i know so far, the malware first creates a folder ".SDAndroid" , Malwarebytes Scanner does not recognize that. In that folder, there seem to be different Spy files, like contacts, facebookstuff etc ... If you delete it, it will come back after ~12 hrs. If you do not delete it. a 2nd folder is created ".jm", once that happened malwarebytes recognizes the trojan as displayed in the initial post. disguised as "Settings" App for me. I hope i can find a Stock Rom for the S20, and then i have to get into flashing my phone. I hope i can get this working, i dont feel like fighting Nomu or the reseller gearbest for a working phone without spy ware. Link to post Share on other sites More sharing options...
bouby Posted May 4, 2017 ID:1122272 Share Posted May 4, 2017 Here is a thread about the s20 stock rom : https://forum.xda-developers.com/general/device-reviews-and-information/rom-nomu-s20-t3576702 But I can't find any non-Nomu rom for the phone. You can try to flash the S20 1.0.2 rom to get the 1.0.4 OTA like Aromino did on his S10. I don't know if the 1.0.4 rom is suitable or infected to. Link to post Share on other sites More sharing options...
NomuS20-victim Posted May 4, 2017 ID:1122282 Share Posted May 4, 2017 i got the v1.0.3_2016_10_21 ... changing it to another Nomu rom would still feel weird., but thanks for the link! Link to post Share on other sites More sharing options...
Aromino Posted May 5, 2017 ID:1122349 Share Posted May 5, 2017 After 3 days of normal use, no problem with the Archos firmware (50 Saphir v1.06 update) on my Nomu S10. The thread on the Nomu Facebook community page was now deleted ans they don't communicate on this problem. Well donne Nomu ! Link to post Share on other sites More sharing options...
nohara Posted May 7, 2017 ID:1122757 Share Posted May 7, 2017 Hi I'm having exactly the same issue. Contacted reseller but unsure if they are willing to do anything. Having some trouble flashing the ROM of my phone, as I'm on a mac and don't have SP-flash available to me. Is there anyone willing to point me in the direction of a good ROM flashing tutorial for an entry-level android user? (Noob) Or perhaps someone would make a walkthrough themselves? Many thanks; -Ned Link to post Share on other sites More sharing options...
MonsieurD Posted May 8, 2017 ID:1122909 Share Posted May 8, 2017 Still waiting/hoping for an answer from ADAR/MTT in France Answer received from a "jones" from nomu.hk : "so sorry, friend, it is in the system and cannot remove, my colleague tells me. thanks" seems they don't care ... Link to post Share on other sites More sharing options...
HansSunn Posted May 8, 2017 ID:1122947 Share Posted May 8, 2017 The same at evolveo. The support person say's it wil be solved at the next update. But these are rebranded smartphones : Evolveo, MTT, ADAR ,... they are coming form the same Chinese factory. So they have to ask the Chinese friendly : Please send us a new firmware with no malware. If the chineese are willing to do that, then they will remove the triada Malware and put a new one in, that is what I think. Not sure how we can do this but we should try to united us and put some pressure on these rebranded companies. This is a major security issue and they are doing nothing Link to post Share on other sites More sharing options...
nohara Posted May 8, 2017 ID:1123112 Share Posted May 8, 2017 What can we realistically do at this point? Can flashing guarantee that the phone is cleared of the malware? I'm a mac user (shun me) and cannot find a mac alternative for SP fastboot. Tried downloading Android SDK, but tutorials are outdated and nothing is working. Also whilst trying with fastboot and android adb, my device was not found. Really unsure what's going on in this space. Will see if I can borrow a PC to try getting through this flashing process. Helllllpppppp!!! Link to post Share on other sites More sharing options...
Aromino Posted May 11, 2017 ID:1123732 Share Posted May 11, 2017 On 08/05/2017 at 1:38 PM, HansSunn said: If the chineese are willing to do that, then they will remove the triada Malware and put a new one in, that is what I think. Not sure how we can do this but we should try to united us and put some pressure on these rebranded companies. This is a major security issue and they are doing nothing Sure ! That's why i use a firmware from a french phone. Nomu don't care about us. Maybe journalist or consumer organism will be interested about that global problem. Link to post Share on other sites More sharing options...
Andronik Posted May 11, 2017 ID:1123798 Share Posted May 11, 2017 I had the mentioned malware on rebranded Chinese Gotron/Ulefone smartphone, don't know exactly what model if any. What I did this Monday was to delete the .SDAndroid and .jm hidden folders altogether after the malware was deinstalled from settings and set the update settings to disallow automatic download over WI-FI network (of course the updates via WI-FI only is on). Two days passed with no malware detection and regular app updates. Hope it lasts, or that the problem was addressed by the manufacturer. Link to post Share on other sites More sharing options...
NomuS20-victim Posted May 12, 2017 ID:1124055 Share Posted May 12, 2017 (edited) the malware changed for me now. .jm folder is no longer created and malwarebytes wont find the trojan anymore. ads still pop up. i installed "addon detector", which displays the "settings" app installed as an addon. from there you can uninstall or deactivate it. as it reinstalls, i just stopped the app for now. no more ads for 3 days. no final solution, but at least a temporary one. Edited May 12, 2017 by NomuS20-victim Link to post Share on other sites More sharing options...
riko13 Posted May 12, 2017 ID:1124064 Share Posted May 12, 2017 Hi NomuS20-victim, that was the same for me after some app update. I will try addon detector ad you say, thanks 1 hour ago, NomuS20-victim said: the malware changed for me now. .jm folder is no longer created and malwarebytes wont find the trojan anymore. ads still pop up. i installed "addon detector", which displays the "settings" app installed as an addon. from there you can uninstall or deactivate it. as it reinstalls, i just stopped the app for now. no more ads for 3 days. no final solution, but at least a temporary one. Link to post Share on other sites More sharing options...
nohara Posted May 15, 2017 ID:1125042 Share Posted May 15, 2017 On 12.5.2017 at 8:17 AM, NomuS20-victim said: the malware changed for me now. .jm folder is no longer created and malwarebytes wont find the trojan anymore. ads still pop up. i installed "addon detector", which displays the "settings" app installed as an addon. from there you can uninstall or deactivate it. as it reinstalls, i just stopped the app for now. no more ads for 3 days. no final solution, but at least a temporary one. This usually works until a reboot, but we really need a more permanent fix. Could someone create a small walkthrough on how to flash the Saphire ROM? My bootloader menu is in Chinese and I have no way of reading it! Link to post Share on other sites More sharing options...
bouby Posted May 15, 2017 ID:1125072 Share Posted May 15, 2017 Hi, It's quite easy. Follow those steps : (only for s10) http://www.needrom.com/download/archos-50-saphir/ Link to post Share on other sites More sharing options...
bouby Posted May 15, 2017 ID:1125085 Share Posted May 15, 2017 this "how to" is way simpler : https://www.getdroidtips.com/stock-rom-archos-50-saphir/ Link to post Share on other sites More sharing options...
nohara Posted May 16, 2017 ID:1125509 Share Posted May 16, 2017 On 15.5.2017 at 2:53 PM, bouby said: this "how to" is way simpler : https://www.getdroidtips.com/stock-rom-archos-50-saphir/ Is there a method you could use via mac? SP flash tools seems to be windows-based and I cannot install bootcamp for the life of me. Thannnnnk youuuuuu Link to post Share on other sites More sharing options...
bouby Posted May 16, 2017 ID:1125512 Share Posted May 16, 2017 Just by creating à Windows based virtual machine on your osx system mauve? Link to post Share on other sites More sharing options...
AlexFr Posted May 25, 2017 Author ID:1129922 Share Posted May 25, 2017 pour info, sur mon MTT IDEAL (NOMU S20 rebranding) l'infection à changé de nom, ce n'est plus com.petsfamily-1 mais maintenant via com.chunmei.calculator-1 que le trojan tente de passer, toujours en executant l'appli base.apk se faisant passer pour l'appli settings du systeme ! L'outils Malwarebyte l'intercepte (voir captures) bien mais toujours impossible de le supprimer definitivement ! Link to post Share on other sites More sharing options...
HansSunn Posted May 30, 2017 ID:1131413 Share Posted May 30, 2017 Evolveo still have no new firmware. I have the feeling they are doing nothing about this. Link to post Share on other sites More sharing options...
Totorico Posted June 2, 2017 ID:1132463 Share Posted June 2, 2017 Des nouvelles de mon cas (MTT ideal) : je l'ai renvoyé au SAV (très rapide). Une fois le téléphone récupéré en build 1.08, après avoir mis la SIM et laissé reposer, les pubs sont de retour ! Et l'application settings et les dossiers cachés etc. Par contre Malwarebyte ne le détecte plus, donc j'ai eu droit à un update du firmware ET du troyen, la classe Bref, j'attends des explications de MTT. Je posterai si j'ai des news. Link to post Share on other sites More sharing options...
AlexFr Posted June 3, 2017 Author ID:1132744 Share Posted June 3, 2017 (edited) Merci pour cette info Totorico! de mon coté, je n'ai toujours pas envoyé mon MTT IDEAL (NOMU S20) au SAV car vu leur réponses à nos demandes je doutais de leur compétence à remédier à ce pb par eux même...ils semblent être complètement dépendants de NOMU car sinon ils auraient déjà réagit techniquement en proposant une mise à jour OTA solutionnant ces problèmes de malwares et Trojan in situ dans le systeme, d'autant plus que le signalement de la faille de sécurité et compromis des données personnelles est maintenant largement diffusé sur les forums quand quelqu'un cherche à se procurer un modèle du constructeur (NOMU S10 ou NOMU S20) ou n'importe quel modèle "rebrandé" via distributeur (MTT IDEAL, EVOLVEO STRONGPHONE etc..). Leur comportement de rester muets et faire la politique de l'autruche confirme qu'ils sont pris au piège et seront incapables d'assumer leur responsabilité quand il sera question de répondre aux plaintes qui commencent à s’initier... A suivre.... Edited June 3, 2017 by AlexFr Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now