MY FRIEND GOT MALWARE!

[Rare321HasFallen]

Help my friend got malware he got malwarebytes and it founs 6 malware and only showed 5

Below are details

Riskware-Fota Provider

Trojan-Pinoy App Shop,E Warranty,Cherry Play,Cherry Fun Club

 

Need help on how to remove them!!!!

He had a lot of popups and redirects at random times

 

Iam a concerned friend

[MAM]

Hello, and welcome her to our "small" community. 

Happy Christmas.

Well, I am not sure that can help you in this issue.

Please read this carefully,

You can try this, or you wait for her for the expert´s, to confirm my answer/solution.

Good Luck!

MAM

[mbam_mtbr]

Hi @Rare321HasFallen,

Android/PUP.Riskware.Autoins.Fota

Preinstalled Android/PUP.Riskware.Autoins.Fota is a known issue.  The app is from a Chinese company called Adups: Mobile Menace Monday: upping the ante on Adups. 

The only known way to disabling this is through a tool called Debloater:  Disabling Adups via Debloater (FWUpgradeProvider.apk)

Thanks @MAM for pointing the above out!

Android/Trojan.SMS.Agent.bhf

I deescalated Android/Trojan.SMS.Agent.bhf to Android/PUP.Riskware.SMSReg.bhf, a less threatening SMS registration PUP(Potentially Unwanted Program).

Android/Trojan.SMS.Agent.ih

The detection Android/Trojan.SMS.Agent.ih stands.

Preinstalled?

Are you unable to remove the following because they are preinstalled?: Pinoy App Shop,E Warranty,Cherry Play,Cherry Fun Club

Preinstalled malware is becoming more of an issue -> Mobile Menace Monday: Preinstalled adware and sometimes worse

Instructions to disable are in the blog post linked above.

Nathan

 

 

[MAM]

@mbam_mtbr

Ok, thanks for the correct explanation of this incident, apparently I was right with my assumption. Ok, let's wait for the response from the thread creator ...

MAM

 

[Rare321HasFallen]

Thanks im sending the link of this forum thread to my frend rn he can take a look at this thanks for the info also MERRY CHRISTMAS!

[MAM]

Hello, ok good luck when removing.

MAM

[MAM]

And now, NO answer, or not successful ?!

MAM

[Rare321HasFallen]

It got fixed sorrg for the late reply i had school

 

 

My friend said it got fixed not too sure but he said he couldnt removed Fota Provider

Edited January 13, 2018 by Rare321HasFallen

[Howtoblank]

Because it is a built in app of cherry mobile. And my sister have cellphone cherrymobile and scan with malware bytes butt i does not find any thing. 

[MAM]

Well, he must ask here again if he has problems with cleaning up.

Thanks for the responses this issue.

The expert´s here will help you already.

Good Luck!

MAM

[MAM]

Hello again, is this really solved now ?

MAM