Need help with infection: Android/Trojan.Spy.Spynote.jl377

[Annew]

Hi, I have just updated my Malwarebytes app and done a new scan and found heaps of infections relating to Android/Trojan.Spy.Spynote.jl377

I am getting pop ups saying "Malware detected. 1 infected file. org.malwarebytes.antimalware"  with an option to Ignore or Remove. 

Does this mean the Malwarebytes app itself is infected??  I'm getting the same pop up for multiple different files.  

Inside the app there is a list of detected malware files to be removed.  I removed one as a test and it uninstalled the entire app.

So I'm a bit nervous about just removing all the threats, some appear to be system files etc.  Would appreciate any advice about how to handle this.

I have logged a support ticket but thought someone may be able to offer advice in the meantime.

thank you  

[Annew]

Hmmm... just found I commented on a thread back in 2020 when I was getting messages and pop ups saying that every app was infected.  It turned out to be a false positive.  Fingers crossed that is what's happening now!  (could I be so lucky?)

 

[mbam_mtbr]

Hi @Annew,

Thanks for letting us know!  I think I resolved, but could you send us info?

Depending on what version of Malwarebytes for Android you are running, here’s how to send us the info to resolve.

Client 3.x.x — Send Apps Report

To send an Apps Report with Malwarebytes for Android use the following instructions.

1. Open the Malwarebytes for Android app.
2. Tap the Menu icon.
3. Tap Your apps.
4. Tap three lines icon in upper right corner.
5. Tap Send to support

Client 5.x.x — Export diagnostic data

1. Open Mobile Security on your mobile device.
2. Tap Settings > General.
3. Toggle on Enable diagnostic mode.
4. Repeat the steps that led to the issue. Once the issue occurs, diagnostic mode records the incident.
5. Return to the Malwarebytes app, tap Settings > General, then tap Export diagnostic Data.
6. Send the diagnostic log to Malwarebytes.

Choose an email app to send Apps Report or Export diagnostic data.  If you used Export diagnostic data, you can now toggle off Enable diagnostic mode.

Your email app will open with the Apps Report or Export diagnostic data included.

At this point, it would be very helpful to mention you are submitting via recommendation from the Malwarebytes forum.  This allows our support staff to know where to direct it.

By sending, you will create a ticket in our support system.

Private Message (PM) me the email used and/or the ticket number assigned.

[mbam_mtbr]

If I'm right, this will resolved in Malware DB 2023.09.15.03.  Give it an hour to replicate over all servers, then you can force update.

V3

How to force update Malwarebytes for Android version 3: Manually update database in Malwarebytes for Android

V5

1. Open Mobile Security on your mobile device.
2. Tap Settings  > Security > Database updates.
3. Tap Force update.

[Annew]

@mbam_mtbr Thanks Nathan, I have done the forced updated and am currently scanning again, I'm only part way through but this time the red threats are not coming up (thank goodness!)

However it appears the same files (which appears to be every app!) are being marked as Android/PUP.Riskware.Generisk.iqiyi

[mbam_mtbr]

Hi @Annew,

So sorry about this.  Round four will resolve: 2023.09.15.04.

[Annew]

@mbam_mtbr thanks Nathan, will try again.  

I am not sure what you mean by updating the Malwarebytes client (as suggested via DM)  Do you mean updating from 3 to 5?   Is that just a matter of installing a different app? Is that something you recommend even if this issue is resolved?  I assume 5 has more features?  Does my premium subscription carry over to 5?   (I had forgotten I had premium but must have decided it was worth it! 😄)

Thank you

 

Anne

[mbam_mtbr]

Hi @Annew,

It's as easy as going to Google PLAY store and updating: https://play.google.com/store/apps/details?id=org.malwarebytes.antimalware

Yes, you're premium will carry over.

 

[Annew]

@mbam_mtbr Success!  Have just run another scan and have no malware warnings!  Thanks again for the support, Nathan.  (FYI I still have version 3 at this stage but will upgrade to 5)