I saw various unwanted pop up ads on an Android 5.x phone. Then installed the free Sophos Mobile Security on it (from the Play Store) and ran it several times over last few days. Each time it shows some files that it either says are malware, or PUA (Potentially Unwanted Apps). It allows me to delete most of them.
But for two, there are problems. One is called UC News and keeps coming back, even if deleted. Another is com.android.syshandler. For the last one, there is not delete option. It just says that it is PUA: Adware (PUA = Potentially Unwanted App). When I click on it, it says "Potentially unwanted app: Android Ewind (Adware) identified." And goes on to list many more points about it, all negative or indicating potential for harm to the phone.
E.g. the first point says:
"A type of app which may also include third party packages, whose primary purpose is to deliver advertising content in a manner or context that may be unexpected and unwanted by users."
It has a "More Details" link but when I touch that, it opens what seems to be the stock Android browser (instead of Chrome) and that goes to a URL that gives a 404 Page Not Found error. Unable to copy the link to open in it Chrome or to paste it here.
If any more details are needed in order to suggest any steps, please let me know.
Thanks in advance to all who reply.
Edited two days later to add more new info:
- More unwanted ads and also apps have been popping up - some even during scans of the phone using anti-malware software - both before and after installing the other two anti-malware software mentioned next. I also installed MalwareBytes's Anti-Malware (MBAM) as one of the commenters here suggested. It worked to remove some infected files but could not remove two - Activation Tracker (file: /system/app/ActivationTracker/ActivationTracker.apk - which MBAM reports as being infected by Android/Trojan.Spy.SmsThief.de) and Install Helper (file: /system/app/OLXHelper_v2.5_Lava/OLXHelper_v2.5_Lava.apk - which MBAM also reports as being infected by Android/Trojan.Spy.SmsThief.de). The two infected files it could not remove appear to be in a system partition on the phone. Then also installed Kaspersky anti-malware and ran a scan with it. It also could detect and remove some, but not others. I think the system software in the phone has also been corrupted, because, e.g. Kaspersky or Malwarebytes anti-malware give a security warning about the setting for allowing installation of packages from third-party sites being set to Yes/On. When I change it back to No/Off manually, after some time it goes back to Yes/On on its own - which seems to indicate that malware apps are actively changing it back to that.
Edited again: Also, now, once in a while, apps with names like CrazyRacer2 and Super File Manager (or similar name) are popping up without my installing them. I am exiting them each time. But they appear again.