Database Info

Pre-installed Uupay.A/Uupay.D spyware on some Chinese phones

Heise (German publisher of various computer related magazines) has just put up an article about the Chinese Star N9500 Android smartphone coming pre-loaded with a trojan called Uupay.D, that will try to harvest your personal information on the phone and may even try to send costly SMS to premium numbers.
link to the article translated into English
link to article in German
I just checked my shiny new iNew/Alps i7000 with ESET Mobile Security and sure enough, it has the Uupay.A trojan apparently macerating as Google Play service.

Root your device
Root your device and from /system/app remove the extra play apks. The offending apk is not part of system image but of the custom ROM that is on these phones.
Run the the ESET anti-virus to check for the trojan

SUMM0NER said:
Heise (German publisher of various computer related magazines) has just put up an article about the Chinese Star N9500 Android smartphone coming pre-loaded with a trojan called Uupay.D, that will try to harvest your personal information on the phone and may even try to send costly SMS to premium numbers.
I just checked my shiny new iNew/Alps i7000 with ESET Mobile Security and sure enough, it has the Uupay.A trojan apparently macerating as Google Play service.
Click to expand...
Click to collapse
This program ist known here since 2013/08.
Kaspersky lab wrote in march about this problem - but it was not interesting enought.
Now, the german crew from GData saw this app (it is only a PUP - not a trojan or virus) and they make money with there own anti virus app.
Go to settings --> Apps --> scroll to all apps --> deactivate (or remmove all apps if your phone is rooted.)
You are able to scann all apps on your phone if you pull all apps to your PC (adb pull /system/app and if you run KitKat adb pull /system/priv-app)
Remember: In the eyes of anti virus crews are all rooting apps also malicous apps!

Also see http://forum.xda-developers.com/showthread.php?t=2395007

Thanks everyone!
Rooted my phone with this and then removed the fake Google Play app with Root App Delete. :good:

Good antivirus for rooted phones?

Hey does anyone know of a good antivirus app for a rooted zenfone 2e? I want one that is free but has as many features as possible as well. Thanks.

I used to use Avast but the best anti virus is you, the user. Know your system, know the internet. If youre rooting, you will/should eventually get very familiar with android, how it behaves, the file system, permissions, built-in apps, etc. Avoid indiscriminate app downloads, especially from places other than the play store, and never follow links that youre unsure of. My opinion is that Windows is the only OS that AV is pretty much necessary.

I second avast. An interesting feature is that it will survive a factory reset if stolen.

zshep99 said:
Hey does anyone know of a good antivirus app for a rooted zenfone 2e? I want one that is free but has as many features as possible as well. Thanks.
Click to expand...
Click to collapse
Unlike the PC, it is extremely unlikely you will "get" a virus on your android. It is you who has to install the malware to make it happen. And it is extremely easy to remove the malware. A factory reset would do it and as root user you could simply restore your nandroid backup.
tetakpatalked from Nexus 7 flo

Most antivirus apps come with a huge amount of crap no one needs. They often drain your battery and slow your smartphone down. I have also seen antivirus apps which behave more like spyware by replacing advertisements in other apps or direct you to untrustworthy websites when opening the webbrowser.
My opinion: You do not need an antivirus app on your smartphone. Make sure you install most apps via appstore. Take care with apps from 3rd party websites. (Especially if the website says you have an virus on your smartphone => scareware!)

I would never install Antivir-Apps, since they will drop your phone-performance. And what do you get for this? Nothing. Just be carefully of what you are downloading.

i thinks for android no needs one antivirus..

Kenfary72 said:
i thinks for android no needs one antivirus..
Click to expand...
Click to collapse
+ one
Envoyé de mon E5333 en utilisant Tapatalk

Kenfary72 said:
i thinks for android no needs one antivirus..
Click to expand...
Click to collapse
+ two

My opinion is that android doesn't need antivirus software when the user is careful about what he downloads.

no disregard to anyone, but are you sure you are in developers forum ?!?! this is not a google store !
do you still live in Symbian world ? even the google play itself has malwares ! or you just want to ignore it ? beside those, hangroid can be easily hacked. the only system that dose not a antivirus is winphone, and it has not need it yet ! but they will come for it very soon.
personally i will never trust ios o even open my email, and in android i have an original payed antivirus that really can respond to a virus. i have original nod32 (i do NOT like it, but i didn't get a better one in hangroid.)
visited by lenovo tab2 a8.
best regards, josef.

josef2600 said:
no disregard to anyone, but are you sure you are in developers forum ?!?! this is not a google store !
do you still live in Symbian world ? even the google play itself has malwares ! or you just want to ignore it ? beside those, hangroid can be easily hacked. the only system that dose not a antivirus is winphone, and it has not need it yet ! but they will come for it very soon.
personally i will never trust ios o even open my email, and in android i have an original payed antivirus that really can respond to a virus. i have original nod32 (i do NOT like it, but i didn't get a better one in hangroid.)
visited by lenovo tab2 a8.
best regards, josef.
Click to expand...
Click to collapse
Best antivirus is still brain.apk
Just do not instal every bulls* and you are good to go.
Most antivirus apps are snakeoil/bloatware which will not protect you from anything!

It is good to think about an anti-virus. Android malwares exist, so everyone who's telling here that AVs for Android are a no-go are jumping the gun. However, the Android system already has some security measures into place. So is it still worth it? Yes. The Play Store can't guarantee a 100% clean virus free app collection. History has shown that. "use your brain" is also not a really constructive argument, it is easy to install a sample or virus infected application. Is it that dumb to use an AV on Android? No.
My suggestion, *buy* an AV. For example I have a yearly subscription to Freedome from F-Secure (VPN service). Primarly for my laptop but you can install it on three devices (I have it on 2 laptops and my smartphone). For the smartphone, besides a VPN the app will also scan the device for malicious apps so I got all my important security features in one app. I know that Avast has something similar. I paid 50 euros for one year, which is next to nothing considering the features and piece of mind. And for all those that go on ranting on my post here, I am a security professional in Android and see malware samples from the inside (reverse engineer) all the time
I encourage you to look in those options: VPN and App scan.

tetakpatak said:
Unlike the PC, it is extremely unlikely you will "get" a virus on your android. It is you who has to install the malware to make it happen. And it is extremely easy to remove the malware. A factory reset would do it and as root user you could simply restore your nandroid backup.
tetakpatalked from Nexus 7 flo
Click to expand...
Click to collapse
Remember stagefight thingy ? One could have abused it to gain root privileges and install a binary that run at start, a raw binary, not a package.
Tell me how it is easy to uninstall it, you would first have to track it, if it's purpose wasn't to patch other binaries, and then, you're good to reflash system partition.
No system is invulnerable
Of course, it's tough to get a virus on android, but there's still common malware, adware, scareware, and raw security flaws. There is still need for security solutions, mostly for the raw flaws.

Best choice for you from my point of view
CM Security & Malwarebytes Anti-Malware

I agree with Magissia if you think over that what you are going to do.

Virustotal AND vulnerability patches

Antivirus Software, is it needed

You see all these Anti-Virus apps on the market:
Are they needed
Do you use one?
Have you ever had a virus?
I'm not sure, if I stick to getting apps just off the google play store surely i'll be fine? I've never had a virus on android, on my previous HTC M7, M8 and M9 I used Kaspersky just because I got it free with my banking, but I removed it from the M9 after a few months.

Mcyates said:
You see all these Anti-Virus apps on the market:
Are they needed
Do you use one?
Have you ever had a virus?
I'm not sure, if I stick to getting apps just off the google play store surely i'll be fine? I've never had a virus on android, on my previous HTC M7, M8 and M9 I used Kaspersky just because I got it free with my banking, but I removed it from the M9 after a few months.
Click to expand...
Click to collapse
From what I've gathered, if you're a relatively aware user and install apps either from the play store or other trusted sources then those antivirus and cleaner apps, at best, mitigate an already very low risk or, at worst, drain your system resources, steal personal info, and/or con you into spending money with no benefit whatsoever.

1. Not in my opinion
2. No
2. No
Edit: In the spirit of this post, if you're on the web and you get a pop up stating your phone has a virus... It's a scam.

1. no
2. no
3. no
Never used an antivirus program on a computer or a phone and never had one single issue with it ever in the entire history I have used a computer.

No, they're not needed
No, I don't
No, I've never had one
Sent from my SM-G935T using XDA-Developers mobile app

1. No, unless you're fond of downloading dodgy apps from weird Russian hacker sites (and even then I'm not convinced an AV app would save you)
2. No
3. No

Mcyates said:
You see all these Anti-Virus apps on the market:
Are they needed
Do you use one?
Have you ever had a virus?
I'm not sure, if I stick to getting apps just off the google play store surely i'll be fine? I've never had a virus on android, on my previous HTC M7, M8 and M9 I used Kaspersky just because I got it free with my banking, but I removed it from the M9 after a few months.
Click to expand...
Click to collapse
Answer to all questions: NO.
More detailed answer to the general idea of an antivirus on Android: Simply put, if an antivirus program is *able* to scan your Android device, then it IS A VIRUS. Android prevents all applications running in the "untrusted_app" security context (which means EVERYTHING that you install from ANYWHERE, except those which are an upgrade to a system application with matching signature) from any kind of access to anything which would be required in order to write an antivirus program that actually does ANYTHING.
So to answer your question properly; ANY antivirus on Android is DEFINITELY one of two things;
1) A virus.
2) A placebo that tries to take your money.

1. No
2. Not for several years(used to use AVG)
3. Never had a single issue
To put it bluntly, antivirus is almost useless on smartphones. They pretty much only check installs of apps(not other downloads), and they don't know what viruses look like, in my experience. After years of use, my antivirus never found a virus, but did try to prevent me installing a bunch of root apps because it often thought they were malicious. So it only got in my way. Several years later I didn't even remembered they existed till this post reminded me.

My last 2 phones both came with lookout , S6 & s7 from TMO...it seems like this application does nothing but drain my phone of resources. Once i disable lookout in app manager the phone becomes much smoother and faster.
So yes I think these kinds of apps are useless.

repository with pak virus

Hi,
I seek good site with virus for Android. I must test my antyvirus on my mobile phone. Thank you

Android anti-virus are useless.. They just tell you if the app is infected and then to unninstall it..(Some times with fake alert)
If you talk seriously about android device "security", you should put some firewall app and filter the apps internet access and deny some connections. Smartphones are targeted for bot networks very often and if you allow root access to some of these apps they dig in to system and its very hard to remove them, you have to flash new kernel and rom. And the other threat is mostly the annoying adware apk's, but you can upload and scan them in the Nviso web page or with Virustotal. You can made some changes to the host file that is in the root directory of your android phone, there you can block sites that deliver ads with some apps, or use LP which is automated. This is important because some apps are not malicious themselfs, but the sites they connect to are malicious and some times they run bad JS codes in the backround on your phone and you see only some flashing ads on the screen.

Zionx9 said:
Hi,
I seek good site with virus for Android. I must test my antyvirus on my mobile phone. Thank you
Click to expand...
Click to collapse
Download test virus app from play store and run antivirus scan. These app is harmless. It is for test purpose.
If it helped. Please thank me.

Fotaupdate,malware ?

Hi,I have an android box and just done a scan with Malwarebytes.
It brought up this threat
Android/PUP.Riskware.Autoins.Fota
/system/app/FotaUpdateReboot
FotaUpdateReboot.apk
Is it genuine malware or a false positive ?
Cheers.

ascender13 said:
Hi,I have an android box and just done a scan with Malwarebytes.
It brought up this threat
Android/PUP.Riskware.Autoins.Fota
/system/app/FotaUpdateReboot
FotaUpdateReboot.apk
Is it genuine malware or a false positive ?
Cheers.
Click to expand...
Click to collapse
Looks like several firms are flagging it as malware on virus total, at least according to the following thread
https://forums.malwarebytes.com/topic/216168-pre-installed-malware/

Thanks for that.
Looks like the system app FotaProvider allows adverts to pop up in the browser,which is exactly the issue I've been having.
I've uninstalled it now.Have to see how I get on
Cheers

update
ascender13 said:
Thanks for that.
Looks like the system app FotaProvider allows adverts to pop up in the browser,which is exactly the issue I've been having.
I've uninstalled it now.Have to see how I get on
Cheers
Click to expand...
Click to collapse
HI.
Is everything fine after you deleted the fota provider?

Yes,that fixed it.

remove problem apps
How do you delete these unwanted system apps?
The main sources of malware are google play store, and wireless update (the system app)
both are pre-installed malware when you buy the device

mprox said:
How do you delete these unwanted system apps?
The main sources of malware are google play store, and wireless update (the system app)
both are pre-installed malware when you buy the device
Click to expand...
Click to collapse
If I remember correctly I just used a file manager with root access