Android/Trojan.Spy.Agent.ADI

[JeanB]

I have been running Malwarebytes Mobile for a while (months) with no problems or issues. However, my routine scan ("Scan after update") came up with a problem on June 13. It identified the malware as Android/Trojan.Spy.Agent.ADI in the file /system/priv-app/Email_master/Email_master.APK, which is a program that can't be deleted.

My Malwarebytes log showed a scan the previous evening that completed with no problems. Three app updates were installed automatically through GooglePlay the day I got the malware alert: Calendar, YouTube, and Snapchat.

Steps taken:

• I suspected maybe a false positive but I found nothing online to support that.
• I rebooted the phone, then wiped the cache and rebooted the phone.
• I uninstalled and reinstalled Malwarebytes and reran a scan.
• I installed McAfee (looking for their previous hidden administrator tool) but didn't find it in the current software and uninstalled it without running any scans.
• I installed Sophos Mobile Security and ran a scan, which didn't find anything but some low reputation apps (that appear to be part of the original phone setup)

Phone carrier: T-Mobile

Phone brand & model: ZTE Axon 7 Mini (ZTE B2017G_2434)

Android operating system: 6.0.1

Rooted? No

Other security software? Sophos Mobile Security (temporarily right now)

I'm not sure what to do next. Thanks in advance for your advice.

Jean

Edited June 15, 2017 by JeanB

[JeanB]

RESOLVED

A day or so after I wrote the original email, I reset the phone to the factory defaults, but Malwarebytes was still alerting me to the same malware. Then after a Malwarebytes update on June 19, the scan was clear and has remained clear.

I was not able to confirm this malware with Sophos (see first message) and did not install/try others.

ADVICE

I got no replies to my posting, which surprised me. BUT many of those posts that do get replies have used tags. So add tags - the more, the merrier. Good luck!