Could there be a WhatsApp Trojan?

[alexeix]

'Whats App' Trojan - help needed

Hi,

My wife uses an Android phone and received an email from a friend, which appeared to be a WhatsApp video.
However, when she clicked on the link, it took her to a weight loss web site (or some similar crap).
She subsequently received notification that somebody had tried to change her Hotmail security details.
We also realised that everyone on her contact list had received the same email, but now from her.

We've changed her Hotmail password and security details, using a different device and we also installed the Android Avast app, and ran a scan - which found nothing negative.

However, I'm concerned that we don't really know for sure what has been compromised and if there's some malware/a virus on her phone.

I haven't found any good advice on the web about what actions to take in this scenario.
Should we wipe her phone and restore it to factory settings?
If so, how do we back up her photos, videos, text messages, etc., without compromising whatever device or cloud storage that we back up to?

Otherwise, how can we check thoroughly, that there is no remaining infection on the handset?

Thanks in advance for any advice!

 

[Rukbat]

Re: 'Whats App' Trojan - help needed

Should we wipe her phone and restore it to factory settings?

If the malware was installed as a system app, it won't be removed.

If so, how do we back up her photos, videos, text messages, etc., without compromising whatever device or cloud storage that we back up to?

An OTG cable and a thumb drive. If the thumb drive gets infected you can always reformat it.

Otherwise, how can we check thoroughly, that there is no remaining infection on the handset?

I'd run Malwarebytes Anti-Malware, then I'd run AdWare.

Backing up is the last resort. Then you flash the stock ROM, install Malwarebytes and AdWare and put back the pictures, etc. But try just installing and running them (one at a time, preferably overnight, with the charger plugged in - they take a while to run) and see if that doesn't clean it up.

Next time she gets a "video" like that, she's going to get a warning from one of the apps and she'll know to delete it, not run it.

 

[Golfdriver97]

Re: 'Whats App' Trojan - help needed

I would consider changing your Hotmail password as well, and inform them that this is happening.