[Zopo Speed 7 Plus] si1:
Some weeks ago, a virus appeared a second time on my Speed 7, which is not removable and at the end requires a full re-flash of the device.

Symptoms: every couple of hours two apps with the name "Settings" are getting installed. The virus scanner (I used "Sophos") detect the viruses which belong to the "Triada" class; I can remove them, but after a while they reappear again.

To find out if the malware comes from "outside" (for example by installing a malicious app) or is already pre-installed in the ROM I performed the following investigation:

1) Downloaded the latest ROM for Speed 7 (from 2016-09-21, MD5 sum 8dfa789e1e795f285b4c6a9a65433943) to a Linux PC

2) Unzipped the file, converted "system.img" to a raw image file (with simg2img)

3) mounted the raw image file

4) uploaded the file system/priv-app/System-UI/SystemUI.apk (MD5 sum 55169441bfb82af77f2187614e5d2c1c) to virustotal.com

13 of 59 virus scanners detect a problem:

AegisLab: Android.Troj.Ztorg!c

Arcabit: Android.Trojan.Ztorg.GC

BitDefender: Android.Trojan.Ztorg.GC

ClamAV: Java.Malware.Agent-6331114-0

Emsisoft: Android.Trojan.Ztorg.GC (B)

GData: Android.Trojan.Ztorg.GC

K7GW: Trojan ( 0001140e1 )

MAX: malware (ai score=81)

McAfee: Artemis!55169441BFB8

Qihoo-360: Trojan.Android.Gen

Sophos AV: Andr/Dropr-FY

TrendMicro-HouseCall: Suspicious_GEN.F47V1015

WhiteArmor: Malware.HighConfidence

Conclusion: the latest ROM image for the Speed 7 is infected by a virus / trojan that can not be removed from the system. The purpose of this virus is not obvious to me, but it installs other trojans of the "Triada" class (using the camouflage name "Settings"). In my opinion it is a very serious problem affecting the integrity of private user data and credentials. I also checked the latest ROM images of the Speed 7 plus and Speed 7C models, they are also infected.

Second investigation:

I rooted the phone and installed afwall+, hoping that the firewall will block downloading of additional virus components (beside the already installed system app SystemUI). The log file entries of afwall+ show that SystemUI tries to connect to two different servers, usually several times per minute:

First: 54.169.134.231:80 (name "ec2-54-169-134-231.ap-southeast-1.compute.amazonaws.com")

Since port 80 is HTTP protocol I opened the web page in a browser. It simply shows a page with one single word: "prabat". Maybe a password to access other malware???

Second: 221.130.182.169:80 (no nameserver entry)

Opening this address shows a page with chinese letters only and several links, which are always the same and point to an Android app named NanoLauncher.apk"

Downloading the APK and uploading it to virustotal.com shows that 10 of 62 scanners detect

a virus. Here is the list (only positives):

AegisLab: SUSPICIOUS

AVware: Trojan.AndroidOS.Generic.A

CAT-QuickHeal: Android.Cooee.Ee670 (PUP)

Cyren: AndroidOS/GenPua.185A3C66!Olympus

ESET-NOD32: a variant of Android/Cooee.E potentially unsafe

Fortinet: Riskware/Cooee_E!Android

Ikarus: AdWare.AndroidOS.Cooee

McAfee: Artemis!185A3C66DFD3

McAfee-GW-Edition: Artemis

Symantec Mobile Insight: AppRisk:Generisk

This confirms that the system app SystemUI of the latest official ROM is infected by a severe virus.

I posted my finding also on the ZOPO forum, but after several posts they do not accept messages any more claiming that they will be checked by the moderator.

I also recevied an email by ZOPO with the following answer:

Dear User

As we have told you before, if you flashed the software from our website, then it is ok.

Before we published, we would do full test, and it is no problem.

Thank you.

If you also can not accept this situation, please contact "zopo@zopomobile.com" and request a virus-free image.