Malwarebytes detected system trojans

[s876p]

I have a cheap tablet with Android 6 on it . I scanned it with Malwarebytes when I got it and it was clean but this week it reported 4 problems. It removed one without any problems ( don't know the name - it was in chinese ... ) ,  flags another (  PUP.riskware.autoins.fota ( UpgradeSys )   ) but refuses to remove two trojans ( trojan.agent.amp ( reanimation ) and trojan.syringe.t ( com.aosp.crystax ) since they are both classified as system apps.   The "disable" buttons are greyed out and they restart immediately after a  "force stop"  .  Should I try removing all 3 with adb -k -user 0 ?  

peter

 

[rubberswip]

you might get some information on this post : https://forums.malwarebytes.com/topic/231895-pupriskwareautoinsfota/

the staff have replied their to the same topic.

 

[rubberswip]

also this blog from malwarebytes might provide some help : https://blog.malwarebytes.com/cybercrime/2017/12/mobile-menace-monday-upping-the-ante-on-adups-fwupgradeprovider/

[s876p]

Thanks for the reply.  For now I'm mostly worried about the trojans. I've googled to try and find out more about them but haven't found anything specific. I'd like to make sure they are not false Malwarebytes positives before I try to remove them with adb -k --user 0 ( which may or may not do the trick )

 

[mbam_mtbr]

Hi @s876p,

If you could send an Apps Report, I look into these apps.

To send an Apps Report with Malwarebytes for Android use the following instructions.

1.Open the Malwarebytes for Android app.

2.Tap the Menu icon.

3. Tap Your apps.

4. Tap three lines icon in upper right corner.

5. Tap Send to support

Choose an email app to send Apps Report.

Your email app will open with the Apps Report included. Send the Apps Report to create a ticket.

PM me the email used and/or the ticket number assigned.

Nathan

[s876p]

I tried sending the report from the tablet . It defaults to using signal rather than email and shows a ~2000 line secure message but nothing happens when I hit "send" .  Can I pull the report as a file with say adbfs and just email it directly ?  I thought the "send report" was supposed to give me options ?   

peter

 

[mbam_mtbr]

Hi @s876p,

You could just copy/paste the Apps Report and PM it to me if you like.

Nathan

[nateliv]

A Trojan cannot affect your system.

Can you delete all your quarantine logs in MBAM?

I run MBAM as well but once it finds something and I move it to quarantine as far as I am concerned it is gone.

I sense that you are uncomfortable with something on your PC notwithstanding it is in quarantine.

Suggest you open MBAM and delete the quarantine logs. Then it will be completely eliminated.