2 threats/virus infections that cannot be removed Artemis!sd32432445cb6 JavaTcmdHelper

[ZChlo]

I posted this in another area of the forum, but perhaps ii should have put it here, I don't know...

Hi,

My mum is receiving notifications on her Moto G 5 phone of 2 medium threats. Which we are unable to solve. One which suggests to "ignore" after listing very bad things that this virus can do.

1. File /system/vendor/app/com.motorola.android.jvtcmd/com.motorola.android.jvtcmd.apk

Infected by Artemis!sd32432445cb6 (suspicious)

Type: non-removable file

Created 1 Jan 2009

About this threat: "your file contains Artemis!sd32432445cb6, which is suspicious. It can: incur premium charges, damage or encrypt files for ransom, monitor your device and observe your activities, take advantage of vulnerabilities to access and use your data, send junk messages or emails from your device , direct you to a fake website to get your account information, result in excessive battery/bandwidth drainage."

" we don't have permission to remove this read-only malicious file. You can ignore it and not open it so that it no longer appears as a threat".

2. JavaTcmdHelper "this pre-installed app contains a virus"

Version 8.1.0

Type: non-removable system app

Package name: com.motorola.android.jvtcmd

Detection name: Artemis!sd32432445cb6

About this threat: - same risks as listed in threat 1.

"Android doesn't let you block certain types of risk,but you can disable the app to avoid any security issues"

Pressed "disable" at bottom of page, takes to app info page where " disable " button is greyed out and not able to be pressed, "force stop" option available, so did that, but not able to disable the app.

So the phone has viruses? But nothing Can be done? Can anyone tell us what we should do and how worried we should be? Because we are very worried, and not tech experts at all. Does mum need to change passwords for everything used from her phone - email, facebook etc.? Does she have to do that on another device, or could another device used to log in to email etc. be infected if this virus has entered email etc? How to solve issue to remove threats from phone?

[John46]

Yes, exactly the same on a Moto G5 running android 8.1

Artemis!sd32432445cb6

pathname 

:/system/vendor/app/com.motorola.android.jvtcmd/com.motorola.android.jvtcmd.apk

Seems the same, although no option to disable given either. 

[Keith1100]

I have the same issue it just says ignore it and I've now picked up another threat though could force stop . Looks like Moto g5 issue since last Android update.  Mcaffee just seem to be saying it's powerless ... May have to factory reset but pain in the bum if we do . 

[Keith1100]

I have the same issue it just says ignore it and I've now picked up another threat though could force stop . Looks like Moto g5 issue since last Android update.  Mcaffee just seem to be saying it's powerless ... May have to factory reset but pain in the bum if we do . 

[Keith1100]

I've contacted Motorola and they advise is just part of the operating system and that if mcaffeeupdate virus definitions on McAfee so it is up to date it'll be okay

[Keith1100]

Having said that everytime I try to contact mcaffee it locks me out .....aggghh

[John46]

Keith1100,

Thanks for contacting Moto, I have reported the problem to McAfee, copied a link to this thread and they will look into it.  I have also copied some screen prints from my phone to them as well, so hopefully they can confirm witht he folks at Moto and get it resolved.

[ZChlo]

Thank you Keith1100 and John46 for doing that, and for bringing back the information.

So Moto say it's a false alert and McAfee has to update their virus definitions database to remove this, not us on the app? Ahh now I understand - I read something in another thread and wrongly tried to update definitions myself on the app to try to solve it, with no luck. Understandable now. Well, no-one from McAfee seems to be around these forums at the moment, nor to have come back to update other threads with very similar issues. Thanks John46 for contacting them, was that via live webchat or do you know an email address to correspond with? I tried to contact them via the live webchat but it wouldn't work for me, so I came here.

Another one in our club:

https://community.mcafee.com/t5/Mobile-Products/Javatcmdhelper-alert-on-Moto-g5-false-or-not/td-p/61...

And others in the other language forums.

Thank you both again! Hopefully all will be resolved soon.

[John46]

Yes, I logged the issue via their live chat service which worked okay for me, and sent them the screen shots as well at their request.

They will investigate and verify, then hopefully will post here to confirm.  I provided the link to this thread so they could take a look and / or post it.  As long as they can verify it isnt a threat I assume they will just update their parameters and next time they scan after the update, the alert will just disappear, fingers crossed anyway.

If I hear anything back before they post,  I will update here. 

[Keith1100]

Glad to hear the webchat worked for you and they're looking at. I've also called mcaffee and they're aiming to call me tomorrow evening.  Hopefully we'll all get an answer soon.  I'm not surprised other forums have also the issue .