[BBC] eBay pulls sales of 'spyware phones'

[DirKNirK]

It's unlikely G Data has root permission functions to remove system apk.

The way the article is written, it sounds like its a system apk. In which case it should be able to be removed via any proper root uninstall app.

[aus9]

Possible solution if keep phone
#############

a) you need to root your device
b) flash it with a clean ROM


Extra
#####

c) Don't forget to the download and install gapps if new ROM has no playstore

good luck

Mumbles to oneself.....next phone I buy make sure there is a ROM or two at needrom etc
----mobileuncle to flash the recovery

Otherwise
########
Send phone back through the refund process, if you trust you will get one.
The reseller may be innocent of the issue?

[Sniper47]

Yes, a custom ROM may fix the issue. It could have been a custom ROM it was detected on in the first place. Then there's the question of whether it was truly Star N9500 or just a junk clone claiming to be.

First line is to root and remove the offending apk as @aus9 mentioned.

[aus9]

Then there's the question of whether it was truly Star N9500 or just a junk clone claiming to be.

Thanks Sniper47 and I won't post a link to external links but I used google search
rampant cheating antutu

So the question is for users who have just bought this phone, IMHO,
how do they know they have it or a clone etc?

any clues

[Sniper47]

In this case it was removed because the link simply wasn't required to suggest replacing the ROM.

We will get a guideline up soon, but links aren't necessarily banned. A rough guideline would be 'is it a competing site?' 'Can I bring this knowledge to CPA without plagiarizing?'

It would be difficult to tell for sure whether a person had a true Star N9500. Someone who has bought from a reputable site and can pass on the ROM and build.prop info would be one way, though not sure. Or flashing a ROM you were quite sure was Star N9500 and see if it bricks

Again, it could be G data just got a hold of some clone or some real Star N9500 with some custom ROM. Imagine you want to get a bunch of info from people. Buy 100 Star N9500 and inject the spyware, then sell them to several retailers and wait for the data to come in. One good hit would pay for the entire endeavor

I'm just throwing ideas/examples out there.

[aus9]

sniper47 and any interested party

HI on the basis I don't show competing sites.....

Eset updated their defs March 21
http://www.virusradar.com/en/Android_UUPAY/detail

Unable to see when Kaspersky def updated but they knew about it March 31
and discuss how it was being used in this instance
https://www.securelist.com/en/blog/20821..._installed

There is a negative comment against a certain G app in playstore claiming that this app did not even detect something
they claimed exists. It exists in post 7 link and is currently the first comment.

[Sniper47]

I was just posting a general guideline. I wasn't necessarily applying it to your previously posted link.

Sometimes so difficult to understand you aus9, but I'm trying. If I'm understanding you correctly, you're saying that someone made a comment at Play Store that GData didn't detect some virus on their phone. Well that's normal. Not every virus detector will detect every virus. And every single app in existence has someone that has rated it badly or had some complaint. What is your point here? If I'm understanding you correctly that is.

Again, regarding GData being first. They were the first to detect it in the Star N9500 ROM (according to BBC). Yes, not the first to find out that the virus existed. I can't get any clearer than that.

[aus9]

Sometimes so difficult to understand you aus9,

I am sorry let me try to be blunter? Not some virus but the trojan for OP

PREAMBLE
###########
What I am trying to do, is give some indication to buyers of phones including phones not in this OP
a chance to know what security app claims to detect it.

https://play.google.com/store/apps/detai...lesecurity
Negative feedback is from michael mcgreevy and I will quote his main complaint

scanned my phone. Funnily enough, there was no mention of the "Android.Trojan.Uupay.D

MY RESEARCH and OPINION
############
In researching what he did find....one was this
https://www.virustotal.com/en/file/61ac5.../analysis/

In other words.....if you install G Data.....on the basis.....it will detect the trojan we are talking about
IMHO it will NOT!
----instead at worst it will detect the family of which the trojan is derived from.

In other words ......G Data may have a news item but are misleading people who install and run their app.
I claim based on the negative comment.....that affected users will not see a HIT for the trojan they fear most.

Obviously they can change their definations at any time......but my extra point is, the respondant knew about the trojan and installed the app.

Not the other way around.........yes I get angry when I think I might be mislead.......I am talking about app makers.

ASSUMED DETECTION
#################

On the basis that G Data is misleading its users by not mentioning by name the uupay trojan discussed at news sites there is a claim one app will tell you

Eset

[Sniper47]

Aus, GData will find the OP virus if it exists. Its extremely unlikely they'd announce the virus found and make a big deal about it, then not add it to the definitions.

The image you posted is not searching for the virus that this thread is about. Its a notification push virus. Regardless, GData did detect the malware. Yes, every virus detector has a different name and way of presenting 'titles' of viruses. Kaspersky missed the malware in this particular apk as a side note.

No one has accused you of plagiarism. I was just stating a couple of the loose guidelines. Putting the guideline had nothing to do with the content of your post, so no worries.

For the record, it seems you are recommending Kaspersky or ESet and not to use GData. Got it.

My favorite has always been Malwarebytes. I'm not claiming the malware in the OP is in its definitions (though likely it is).
https://play.google.com/store/apps/detai...ntimalware