topic com.adups.fota. How to remove it? in Mobile

com.adups.fota. How to remove it?

Rui_Meleiro — Tue, 30 Jan 2018 15:20:16 GMT

As I can't find any support option for Sandblast Mobile, I'm now trying the forum to find out possible answers for this.

One of the mobile phones on our Sandblast Mobile suite shows now the dreadful "fota" Chinese backdoor/malware. Checkpoint Mobile is unable to remove it as it part of the Android kernel. Short of rooting the thing, is there any other (less inutrusive) method of removing it from the phone?

Regards

Re: com.adups.fota. How to remove it?

PhoneBoy — Tue, 30 Jan 2018 21:59:31 GMT

If it's installed in the kernel, there's not much you can do to remove it.

A quick Google search suggests it's possible to disable the relevant components, however: How to Test for Adups' Spyware on Your Phone—& Disable It « Android :: Gadget Hacks

Re: com.adups.fota. How to remove it?

Rui_Meleiro — Tue, 30 Jan 2018 23:24:10 GMT

Thanks, Dameon, although I was kinda looking for a Checkpoint support formal response to this. After all, whats' the use of pointing out the problem if you don't (Checkpoint, I mean) have a straghtforward answer to solve it? Adups is rather pervasive now, I was only hoping that Checkpoint would have a simple answer. After all, there are now reportedly over 700.000 devices infected (not only ZTE).

Re: com.adups.fota. How to remove it?

PhoneBoy — Tue, 30 Jan 2018 23:53:05 GMT

If you want a formal statement from support, you should contact them (and yes, they support Capsule Protect): Contact Support | Check Point Software

There are some risks that can easily be identified but cannot be mitigated due to technical limitations imposed by mobile operating systems.

For example, on iOS, no app can initiate an action to delete another application--this must be done manually by the user.

If the operating system itself has the risk baked in, as seems to be the case with adups on some devices, removal is a non-trivial exercise.

Why alert on these risks? So you are aware of it and can take appropriate action.

When used with an MDM and/or Capsule Workspace, for instance, you can restrict a potentially unsafe device from accessing protected resources.

Re: com.adups.fota. How to remove it?

Rui_Meleiro — Wed, 31 Jan 2018 00:04:11 GMT

My dear Dameon, as always I deeeeply appreciate your feedback. Thank you.

Re: com.adups.fota. How to remove it?

Daniel_Dor — Sun, 04 Feb 2018 13:43:12 GMT

Dameon is 100% correct. Due to Android and iOS OS limitations, SandBlast Mobile can't remove some of the threats (while others can be removed by SandBlast Mobile). I would say that in this specific case, SandBlast Mobile will indicate about Adups, and this will be followed by automatic disconnection of the device from organizational assets (MDM or Container).