help please trojan in the house&he aint leaving!

[Lhezz]

hi guys,i have a serious issue on my mobile(DoogeeT5)on MMallow mbam finds this ( Android/Trojan.rootnik.cd/mnt/sdcard/abz/  B201808201850.apk) so i get mbam to remove it&it then says your device is safe,then usually within 48hours mbam finds exactly the same Trojan with the same path even though iv unmounted&removed the sd card?any help or advice greatly appreciated but it just feels like iv wasted money buying mbam if it doesnt do what it says on the tin ie.removal of malicious software!i only have as least apps as possible on my phone,1game from google play store,whatsapp,messenger&the other apps came with the device+on top of this im also getting a screen with white background&a pic of the android bot upside down in top left corner&a X in top right(which wont delete the page&this page draws over everything&just pops up usually when i go to make a call which is strange as the title would suggest to me it has something to do with these games they are splattering all over chrome&messenger whenever they feel like it?)This is it https://adtiming.quickgame.top/25/detail?id=77&i try never click on any of them as when i want to use a browser il use my laptop if it can wait,but this seems to be launching the default browser(chrome)even if i go to make a call?but im sure the white screen happens when it cant launch a browser when mbam is doing its scans??i dunno anymore but no more chandroids for me i was that frustrated the other day i almost did the unthinkable&went for a refurbished i phone but no likey,Someone Please help its like banging my head on a wall,even if i knew what the error messages are on the white paged 1's it would help me narrow down the problem&the trojan1if it keeps coming back what do i do?as that would meen your product isnt removing the Trojan?/my head is spinning&i feel like iv been conned when the same thing keeps coming back after mbam says its removed it?thanks very much guys any help even if its a factory reset im past caring but if that all the crap already taken out was hiding in there when it left china its gonna put it all back in there Lee

[Virtualgrrl]

Exact same problem here...Anyone?

[Lhezz]

im not holding my breath Virtualgrrl as iv just glanced at some poor guys post from8months ago&its had over10,000 views&not 1 single reply????that is disgraceful for a help forum....

 

[mbam_mtbr]

Hi @Lhezz,

Just repeating what I said here: 

 

It may be that something is reinstalling Android/Trojan.rootnik.cd repeatedly.

If you send me an Apps Report I can look further in to this issue.

To send an Apps Report with Malwarebytes for Android use the following instructions.

1.Open the Malwarebytes for Android app.

2.Tap the Menu icon.

3. Tap Your apps.

4. Tap three lines icon in upper right corner.

5. Tap Send to support

Choose an email app to send Apps Report.

Your email app will open with the Apps Report included. Send the Apps Report to create a ticket.

PM me the email used and/or the ticket number assigned.

Nathan

[d3cadent]

I had the exact same problem as above.

To me it seems to be fixed now. Under Your Apps / Installed, I have found two applications using the name "Coordinator". Removed both. Do not see ads for a while now.

 

[Lhezz]

11 hours ago, d3cadent said:

I had the exact same problem as above.

To me it seems to be fixed now. Under Your Apps / Installed, I have found two applications using the name "Coordinator". Removed both. Do not see ads for a while now.

 

hi d3cadent,i saw your reply&have just found in 'all apps' a little android guy with co-ordinator next to it so have uninstalled it&touch wood iv had a good hour trying out all my other apps on the homescreen where the ads seemed to spring from&as yet my screen hasnt been taken over by the full screen white ad with a black x in top right corner&also havnt had any of the pop up games on my screen either,its still early days but even if they do come back thank you immensly as you have been more help than any other mbam mod or member...this forum needs more people like you....THANK YOU so so much Lhezz

[mbam_mtbr]

HI @Lhezz @d3cadent @Virtualgrrl,

This is a variant of Android/Trojan.HiddenApp.  A detection has been added, but if you like to uninstall manually look for "Omacp" in your devices app list.

If any of you continue to have further issues, please let me know.  You can PM me or tag me using @mbam_mtbr.

Thanks for reaching out!

Nathan

[mbam_mtbr]

HI @Lhezz @d3cadent @Virtualgrrl,

Another update.  Thanks to @Lhezz help, I was able to get a sample of the discussed "Coordinator".  It's a variant of Android/Trojan.HiddenAds, and detection has been created.  Most likely it was dropped by the aforementioned  Android/Trojan.HiddenApp.  Therefore, if you had one, you should look for the other as well.

Once again, thanks to @Lhezz in the assistance on this one!

Nathan