Trojan removal

[syconik]

Hi all, I am wondering if there is any possibility to remove Android/Trojan.Spy.Agent.rdr as it has infected my entire system applications which malwarebytes seems to be the only mobile malware program that can detect it. I'm currently running aosp extended on s9, and wiped full internal storage and system numerous times. 

[rootsmessenger]

I just found 42 infections with Trojan.Spy.Agent.rdr on my Sony Z1 with CM 12.1 Android 5.1.1 and I'm hesitating to remove all those as it looks like it will erase 

from Gallery to Configuration all kind of system apps... I will post further info from my phone including screenshots.

 

[rootsmessenger]

11 minutes ago, rootsmessenger said:

I just found 42 infections with Trojan.Spy.Agent.rdr on my Sony Z1 with CM 12.1 Android 5.1.1 and I'm hesitating to remove all those as it looks like it will erase 

from Gallery to Configuration all kind of system apps... I will post further info from my phone including screenshots.

 

Here are some screenshots.

[Miltonvo]

Me too, 82 infections, already Format data but they come back

[tsgeek]

9 minutes ago, Miltonvo said:

Me too, 82 infections, already Format data but they come back

Same here. 193 infections in system apps. Formatted data factory reset. Same thing.

Looks like it will require a system wipe, but I hope there is a less invasive option.

[mooshparp]

Hi

I am having the same issue:

 

I've tried a full system wipe, including just reinstalling the OS with just Malwarebytes. I performed a scan and it still said it was infected with Trojan.Spy.Agent.rdr

[chris667]

Same here! I am on a Leeco LeMax 2 with AOKP Custom Rom and got 65 infections at my system applications... i made a full system wipe/format new twrp unroot new root reinstall three different backups and customroms after the reboot malwarebyte still said it is infected. i think it is a problem with malwarebytes database update.

[cavenilvino]

Are we sure these aren't some sort of false positive? I too have 82 detections of Android/Trojan.Spy.Agent.rdr in deeply fundamental system apps/services.

However, I did a complete system wipe with TWRP and installed a more up-to-date version of the firmware I use. Still the exact same number of infections. How is that possible?

[tsgeek]

19 minutes ago, cavenilvino said:

Are we sure these aren't some sort of false positive? I too have 82 detections of Android/Trojan.Spy.Agent.rdr in deeply fundamental system apps/services.

However, I did a complete system wipe with TWRP and installed a more up-to-date version of the firmware I use. Still the exact same number of infections. How is that possible?

I think there's a very good chance these are false positives. The trick is how to verify.

[cavenilvino]

It's also worth noting that I tried 7 other malware/antivirus programs and none were able to detect anything on my clean system.

[TempLost]

I just started a topic in the Malwarebytes for Android section. I've got a Leaggo M8 Pro phone and suddenly had 67 similar supposed trojan found following the latest signature updates. Nothing identified until this latest update and I'm pretty sure they are false positives - they all seem to be original system files and there's been no updates to this phone for ages, so I don't expect anything's made its way onto the phone recently. I've whitelisted the files as I don't expect they are a real threat - unless someone knows differently? 

[M_i_k_e]

The worst thing you can do is blindly trust a malware scanner and wipe your entire phone just because the scanner claims every single system file as infected. That's impossible. I also have 98 "infections" after last update. I simply ignored it 'cause after more than 20 years of internet you know if it can be or not.

[Woodies]

Same here. On my 2 devices I have 64 infections on the system apps (both Galaxy S7, LineageOS 16.0, Android 9) .

[MAM]

Where are the experts, in this case?

You leave these avoidable customers in the "rain"

Why is not governed to that effect ??? !!!

An unsatisfied customer of Malwarebytes Anti-Malwarebytes for mobile.

MAM

 

[Miltonvo]

Same here, poor support 

[M_i_k_e]

It's also bad that this forum blocks every post over VPN connections without communicating it the right way. Absolutely annoying.

Still no changes in database, still 98 "infections" on my phone. Remembers me of the problem where an update of Malwarebytes for Windows slowed the PC down 'til  it was more or less useless by producing 100 % CPU usage. Took also rather long before some "officials" talked to us customers.

And even if the infections were real... wouldn't that mean that Malwarebytes has let them through without noticing??

[M_i_k_e]

Just scanned my device with some other antivirus tools.

Kaspersky finds nothing

Sophos finds nothing

Avira finds nothing

Malwarebytes still finds 98 "infections" on all system files. So I can just recommend everyone to IGNORE these "infections" until the signature files are fixed by Malwarebytes.

[David H. Lipman]

People:

Please be patient.  It is a Holiday Weekend in the USA and there are less staff in the Mobile division than the Windows division.

 

[GMB]

Hi all,

 

As per discussion in this topic: https://forums.malwarebytes.com/topic/247755-last-update-20190524-identifies-system-files-as-trojans/?ct=1558877494, issue is fixed and will not appear with the next DB update, which is in progress and will be pushed asap. 

Thanks for Your patience. 

[M_i_k_e]

Thanks, after the update no infections detected.

[mooshparp]

2 hours ago, GMB said:

Hi all,

 

As per discussion in this topic: https://forums.malwarebytes.com/topic/247755-last-update-20190524-identifies-system-files-as-trojans/?ct=1558877494, issue is fixed and will not appear with the next DB update, which is in progress and will be pushed asap. 

Thanks for Your patience. 

Thanks for the fix!