Being not so tech savvy he asked me to set it up for him, in doing so I realised there are some suspicious apps installed; an updater with bad spelling etc.
I scanned the device with Malware bytes and found it was rooted maybe and had some malware on it android/Trojan.FakeUpdater.V
I think the trojan downloads ad supported programs from google play and modifies legitimate programs so the advertising revenue goes to the hackers.
I did a "Factory data reset" and the system came back up without any warning of being rooted after scan but still with the malware installed in "WifiUpdater"
I think I may need to flash the firmware and set it up from scratch but it's hard to find the right source? Many links to foreign websites, personal cloud storage accounts etc? Is there somewhere with legitimate firmware repositories for these devices?
The Device is "H96 PRO+ (q9377)"
Android Version: 6.0.1
API Level: 23
Security Patch Level: 2016-08-01
Bootloader: unknown
Build ID: MHC19J.20170308 test keys
Kernel Version: 3.14.29 (20170308)
UPDATE: It is still rooted

Comment