[General Questions and Answers] woprr:
OK, lets do a remote virus scan of the marvel wildfire S over WLAN (needs e.g. sshdroid app with sftp support running as ROOT ):

xxxxxxx@xxxxxxx:~/htc$ sshfs htc:/ /home/xxxxxxx/htc/sshfs -p xx -o ro,reconnect
xxxxxxx@htc's password:
xxxxxxx@xxxxxxx:~/htc$
xxxxxxx@xxxxxxx:~/htc$ #clamscan -r --bell --no-summary --infected --detect-pua=yes --heuristic-scan-precedence=yes sshfs/app-cache
xxxxxxx@xxxxxxx:~/htc$ ls -l sshfs
insgesamt 208
drwxr-xr-x 1 root root 0 1. Aug 04:03 acct
drwxr-xr-x 1 root xxxxxxx 60 1. Aug 04:03 app-cache
-rw-r--r-- 1 root root 460 1. Jan 1970 bootcomplete.rc
drwxrwx--- 1 xxxxxxx 2001 4096 1. Aug 21:11 cache
dr-x------ 1 root root 0 1. Aug 04:03 config
-rw-r--r-- 1 root root 1398 1. Jan 1970 cwkeys
drwxrwx--x 1 xxxxxxx xxxxxxx 4096 1. Aug 01:10 data
-rw-r--r-- 1 root root 118 1. Jan 1970 default.prop
drwxr-xr-x 1 root root 1600 1. Aug 18:47 dev
drwx------ 1 root root 4096 1. Aug 15:25 devlog
lrwxrwxrwx 1 root root 11 1. Aug 04:03 etc -> /system/etc
-rwxr-x--- 1 root root 107244 1. Jan 1970 init
-rwxr-x--- 1 root root 1677 1. Jan 1970 init.goldfish.rc
-rwxr-x--- 1 root root 5396 1. Jan 1970 init.marvel.rc
-rwxr-x--- 1 root root 20294 1. Jan 1970 init.rc
-rw-r--r-- 1 root root 11336 1. Jan 1970 logo.rle
drwxrwxr-x 1 root xxxxxxx 0 1. Aug 04:03 mnt
dr-xr-xr-x 1 root root 0 1. Jan 1970 proc
drwx------ 1 root root 0 16. Apr 19:08 root
drwxr-x--- 1 root root 0 1. Jan 1970 sbin
lrwxrwxrwx 1 root root 11 1. Aug 04:03 sdcard -> /mnt/sdcard
drwxr-xr-x 1 root root 0 1. Aug 04:03 sys
drwxr-xr-x 1 root root 4096 16. Apr 20:31 system
-rw-r--r-- 1 root root 0 1. Jan 1970 ueventd.goldfish.rc
-rw-r--r-- 1 root root 4311 1. Jan 1970 ueventd.rc
lrwxrwxrwx 1 root root 14 1. Aug 04:03 vendor -> /system/vendor
xxxxxxx@xxxxxxx:~/htc$
xxxxxxx@xxxxxxx:~/htc$ clamscan -r --bell --no-summary --infected --detect-pua=yes --heuristic-scan-precedence=yes sshfs/app-cache
xxxxxxx@xxxxxxx:~/htc$ clamscan -r --bell --no-summary --infected --detect-pua=yes --heuristic-scan-precedence=yes sshfs/cache
xxxxxxx@xxxxxxx:~/htc$ clamscan -r --bell --no-summary --infected --detect-pua=yes --heuristic-scan-precedence=yes sshfs/data
xxxxxxx@xxxxxxx:~/htc$ clamscan -r --bell --no-summary --infected --detect-pua=yes --heuristic-scan-precedence=yes sshfs/mnt
xxxxxxx@xxxxxxx:~/htc$ clamscan -r --bell --no-summary --infected --detect-pua=yes --heuristic-scan-precedence=yes sshfs/sdcard
xxxxxxx@xxxxxxx:~/htc$ clamscan -r --bell --no-summary --infected --detect-pua=yes --heuristic-scan-precedence=yes sshfs/system
xxxxxxx@xxxxxxx:~/htc$
xxxxxxx@xxxxxxx:~/htc$ clamscan -r --bell --no-summary --infected --detect-pua=yes sshfs/app-cache
xxxxxxx@xxxxxxx:~/htc$ clamscan -r --bell --no-summary --infected --detect-pua=yes sshfs/cache
xxxxxxx@xxxxxxx:~/htc$ clamscan -r --bell --no-summary --infected --detect-pua=yes sshfs/data
xxxxxxx@xxxxxxx:~/htc$ clamscan -r --bell --no-summary --infected --detect-pua=yes sshfs/mnt
xxxxxxx@xxxxxxx:~/htc$ clamscan -r --bell --no-summary --infected --detect-pua=yes sshfs/sdcard
xxxxxxx@xxxxxxx:~/htc$ clamscan -r --bell --no-summary --infected --detect-pua=yes sshfs/system
xxxxxxx@xxxxxxx:~/htc$ fusermount -u /home/xxxxxxx/htc/sshfs
xxxxxxx@xxxxxxx:~/htc$

Maybe many files left out due to permissions and ro mount:

~# chown xxxxxxx.xxxxxx /home/xxxxxxx/htc/sshfs

chown: Zugriff auf „/home/xxxxxxx/htc/sshfs“ nicht möglich: Keine Berechtigung

The 3 installed EICAR Testfiles cannot be missed by clamav.

Some more console apps on the market like iptraf were helpful to track down the trojan if we got x-permissions at all from ssh.

I'm out of options for now, HTC Europe support has taken over the case, will report.