I have an old(2016) Mediatek mtk6580 chipset phone(non rooted/stock). Couple days back, I downloaded an app called "Apk extractor" from play store, and extracted the system apps to the sdcard. Then from there I uploaded them to https://virustotal.com and found out that, Android system framework, com.mediatek, Android system webview, eSETterminal and Android browser provider had malwares in them. A couple days back, a serious vulnerability(mtk-su) for mediatek mt65** was found which gives a user temporary root privilege. I was able to obtain root permission and did
mount -o rw,remount /system and went straight to
/system/app/ and deleted Android system webview and Android browser provider. However, I wasn't able to find com.mediatek on
/system/app and instead found it on
/data/data. I deleted that from there. But then I did a system reset. com.mediatek was still there. Also, I couldn't delete Android service framework, because I tried doing
adb shell pm uninstall -k --user 0 android and couldn't access anything from the notification menu. For now I disabled the apps with
adb shell pm uninstall -k --user 0 com.app.name. Are there any ways to permanently delete com.mediatek.
If it would help ya'll in any way I could attach a adb dumpsys and adb logcat logs. I noticed a few suspicious behaviors like, when I exit an app, the data/wifi completely bolts down, and vpn logs says network change detected. None of the other phones has this issue. I think I might be dealing with something big here.
Okay, I don't happen to have all the links, but two of those apps were with me, and am providing the scan links here for eSet terminal and webview.