9

I have an old(2016) Mediatek mtk6580 chipset phone(non rooted/stock). Couple days back, I downloaded an app called "Apk extractor" from play store, and extracted the system apps to the sdcard. Then from there I uploaded them to https://virustotal.com and found out that, Android system framework, com.mediatek, Android system webview, eSETterminal and Android browser provider had malwares in them. A couple days back, a serious vulnerability(mtk-su) for mediatek mt65** was found which gives a user temporary root privilege. I was able to obtain root permission and did mount -o rw,remount /system and went straight to /system/app/ and deleted Android system webview and Android browser provider. However, I wasn't able to find com.mediatek on /system/app and instead found it on /data/data. I deleted that from there. But then I did a system reset. com.mediatek was still there. Also, I couldn't delete Android service framework, because I tried doing adb shell pm uninstall -k --user 0 android and couldn't access anything from the notification menu. For now I disabled the apps with adb shell pm uninstall -k --user 0 com.app.name. Are there any ways to permanently delete com.mediatek.

If it would help ya'll in any way I could attach a adb dumpsys and adb logcat logs. I noticed a few suspicious behaviors like, when I exit an app, the data/wifi completely bolts down, and vpn logs says network change detected. None of the other phones has this issue. I think I might be dealing with something big here.

Edit:

Okay, I don't happen to have all the links, but two of those apps were with me, and am providing the scan links here for eSet terminal and webview.

Improve this question
10
  • 11
    Gaining temporary root permissions and deleting system applications is the easiest way to brick your device. If a phone is infected by malware on system level you should re-install the whole firmware. BTW: I am not sure if yours really is, virustotal has various ways to misinterpret the result, you should post the virus total links to scan results.
    – Robert
    Commented Sep 7, 2020 at 16:34
  • 2
    what does root integrity check say?
    – alecxs
    Commented Sep 7, 2020 at 23:05
  • 11
    ~60 AVs are saying the file is safe, and 1 is saying it isn't. Why are you assuming that the 1 is correct? xkcd.com/882
    – Sellyme
    Commented Sep 8, 2020 at 1:03
  • 2
    that's core component you can find /system/vendor/framework/mediatek-res/mediatek-res.apk it runs with android.uid.system
    – alecxs
    Commented Sep 8, 2020 at 8:04
  • 3
    Because it's not an app. It's a resource container that has strings, images, colors, styles, etc, that the system depends on.
    – TheWanderer
    Commented Sep 9, 2020 at 12:53

1 Answer 1

Reset to default
30

I am sorry but you totally misinterpret the scanner results.

In both cases one of 61 scanners has detected something - that looks more like a false-positive. Additionally the scanners that detected something are uncommon. Not one of the major virus scanners detects anything on the samples. Rescan it some days later and if nothing has changed the chance is very very high that the result is not correct.

Additionally one item is detected as "PUA" - not as virus. PUA is the abbreviation for - Potentially Unwanted Application - usually software like advertising trackers falls into this category.

The other is a PUP - hence a "Potentially Unwanted Program" which effectively means the same as PUA.

Conclusion: You totally panicked because you don't understand how to interpret the VirusTotal results.

Improve this answer
4
  • Here's the scan link virustotal.com/gui/file/…
    – atheros
    Commented Sep 7, 2020 at 19:14
  • 11
    Again, as Robert correctly pointed out: If only 1 out of all the VT scanners reports something, and it's a completely uncommon engine (like in this last case "Antiy-AVL" which I've never heard from), the most likely answer is "false positive" (that's one of the reasons they have multiple engines). Give it a couple of days, then hit the "Rescan" (upper-right corner, the "circular arrow"). If it's still the only one, and none of the major engines kicks in, simply forget it.
    – Izzy
    Commented Sep 7, 2020 at 20:19
  • 7
    @johndoe I checked the Jackpal's Android Terminal link you mentioned and it says "undetected". The app is also open-sourced, so anyone can check it directly, and there's no update since 2015.
    – Andrew T. ♦
    Commented Sep 8, 2020 at 2:00
  • 1
    Okay, the virus total scan now shows undetetcted on the jackpals android terminal. I swear, these scan results could potentially drive any noobs to go nuts. Really puts too much mental pressure on my head! A bit relieved from all of your replies. Thanks guys (: But still, if you have some time to spare, would you mind looking at the logs? I swear whenever I try going to a box that says user name and password, the wifi/data acts really weird.
    – atheros
    Commented Sep 8, 2020 at 5:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .