topic Re: Multiple Antivirus warnings in XPERIA archive

Multiple Antivirus warnings

arth1 — Mon, 28 Jan 2013 17:04:44 GMT

Scanning the Experia P with ESET Mobile Security gives the following result:

# of infections: 6

Threat:

A variant of @ApplicUnwnt.Android/Flexion.A

Infected Files

/system/etc/product/applications/magicbox.apk/DeadSpace.apk/classes.dex

/mnt/asec/com.trust5.odp-1/pkg.apk/DeadSpace.apk/classes.dex

/mnt/sdcard/Android/data/com.trust5.odp/files/apks/TigerWoods12.apk/classes.dex

/mnt/sdcard/Android/data/com.trust5.odp/files/apks/PvZ.apk/classes.dex

/mnt/sdcard/Android/data/com.trust5.odp/files/apks/NFSS.apk/classes.dex

/mnt/sdcard/Android/data/com.trust5.odp/files/apks/DeadSpace.apk/classes.dex

Checking, Flexion is a pre-authorized marketing/monetization package used by EA, which is indeed very unwanted.

I have uninstalled the EA package, which takes care of the bottom five, but the magicbox.apk does not appear to be deletable.

Is there any way to get rid of this malware without rooting and breaking the warranty?

Perhaps even worse, if connecting the phone to a PC, it first installs MediaGo, which in turn tries to install PlaystationStoreInstaller.exe, which ESET Nod32 identifies as being infected by Win32/Kryptik Trojan/Rootkit.

Given Sony's history with rootkits, well, I'm a bit worried here.

Is there any other way to sync with a PC without using the MediaGo app?

Re: Multiple Antivirus warnings

Johan — Wed, 06 Feb 2013 13:43:07 GMT

Thank you for informing us

The security and privacy of our users are important to Sony Mobile.

We are looking into the matter with the relevant partners why the apps above are now reported as unwanted software by the AV supplier.

Regarding MediaGo we can share that we have investigated, but we were unable to simulate the infection process using the same AV you are using.

We will continue looking into the issue but it might good if you run also a full AV scan on your PC.

Please share any outcome with us – we would appreciate it

Re: Multiple Antivirus warnings

starlifter — Fri, 22 Mar 2013 17:48:03 GMT

Same happened to me. McAfee Mobile security, which was preinstalled on my device, reported after a scan that the ea games app is a threat and I've deleted it, and /system/etc/product/applications/magicbox.afk is infected by Android/G.317a2 but can't be removed.

Re: Multiple Antivirus warnings

Uliwooly — Fri, 22 Mar 2013 19:09:32 GMT

this is quite interesting

@Johan do you think Sony could post the list of Xperias affected by this?

Re: Multiple Antivirus warnings

Jnathan — Sat, 23 Mar 2013 05:35:14 GMT

Same here with my Xperia P..Please Sony do something!! Before McAfree didn't detect it why now?Is it really a malware i choose to not remove EA Games till Sony solve it.

Re: Multiple Antivirus warnings

zuhair198 — Sat, 23 Mar 2013 16:18:16 GMT

Same problem with my xperia P... It keeps on notifying that virus detected. I have uninstalled the EA games app but can't delete the .apk which is also reported as infected.

Re: Multiple Antivirus warnings

elfigo89 — Sat, 23 Mar 2013 20:16:39 GMT

i have the same problem and i don't now how can i solve it?...i have to reset my xperia p

Messaggio modificato da elfigo89

Re: Multiple Antivirus warnings

_alexdon_ — Sat, 23 Mar 2013 21:11:10 GMT

I have seen an article online where it says some new viruses have been released for Android,so be careful at what you download.I do not think they can infiltrate in the system on their own,they need to be on an apk file which will be installed.

Re: Multiple Antivirus warnings

bernard06 — Sun, 24 Mar 2013 06:57:28 GMT

Same as with me. Starts appearing yesterday. I manage to 3remove 3 out of 4 detected virus by McAfee but I can't remove the last one which is magicbox.apk.

Please help us. Thanks

Re: Multiple Antivirus warnings

_alexdon_ — Sun, 24 Mar 2013 10:29:30 GMT

what is the magicbox.apk?How does it appear on the phone?

Re: Multiple Antivirus warnings

bernard06 — Sun, 24 Mar 2013 10:33:32 GMT

I dont know also what is magicbox.apk. I think it is together with EA Sports that McAfee detected as possible malware also. I'm not sure about this but I started only to here about this magicbox yesterday when McAfee is reporting it as a virus.

Re: Multiple Antivirus warnings

_alexdon_ — Sun, 24 Mar 2013 10:37:54 GMT

You say it is for ea sports?I had only ea games but i could remove the application.I will give a search with my computer antivirus to see if it finds anything.Could you do that also?

Re: Multiple Antivirus warnings

_alexdon_ — Sun, 24 Mar 2013 12:09:41 GMT

ok,i found these applications where mcaffee says.system/etc/product/applications/ with an android file explorer(androzip).There i can find magicbox and other apps from the installation of the firmware,but nothing can be deleted there,they are system files and i do not think we can delete without rooting.

Re: Multiple Antivirus warnings

leonardo20000 — Sun, 24 Mar 2013 12:50:18 GMT

I have the same problem...

Re: Multiple Antivirus warnings

_alexdon_ — Sun, 24 Mar 2013 13:03:56 GMT

these files are preinstalled with the software,that is stranger,it means the virus was already in our phone.or how could it get directly to magicbox.apk?

Re: Multiple Antivirus warnings

Jnathan — Sun, 24 Mar 2013 13:45:48 GMT

Maybe the problem is our antivirus don't think its a malware. But Mcafree notification is annoying hope Sony do something..

Re: Multiple Antivirus warnings

Uliwooly — Sun, 24 Mar 2013 17:56:30 GMT

I agree with Jnathan it is not a virus and as far of malware I don't think it is but it seems as it might be collecting info and sending it somewhere, do this

settings > apps > all > do you see that app? also settings > data usage > do you see that app?

Re: Multiple Antivirus warnings

Jnathan — Sun, 24 Mar 2013 18:34:48 GMT

Its not running don't think its collecting and sending info somewhere.

Re: Multiple Antivirus warnings

Uliwooly — Sun, 24 Mar 2013 18:38:43 GMT

I don't know if rooting it's an option for you but here is how to root your phone

http://talk.sonymobile.com/message/220509#220509

after rooting you need root explorer or even a file manager to find this apk

Re: Multiple Antivirus warnings

EvilSpatula — Sun, 24 Mar 2013 20:40:39 GMT

Exact same things happening on my Xperia P with McAfee Sccurity.