Suspected malware on stock apps in a Mediatek mtk65* based phone I have an old(2016) Mediatek mtk6580 chipset phone(non rooted/stock). Couple days back, I downloaded an app called &quot;Apk extractor&quot; from play store, and extracted the system apps to the sdcard. Then from there I uploaded them to https://virustotal.com and found out that, Android system framework, com.mediatek, Android system webview, eSETterminal and Android browser provider had malwares in them. A couple days back, a serious vulnerability(mtk-su) for mediatek mt65** was found which gives a user temporary root privilege. I was able to obtain root permission and did mount -o rw,remount /system and went straight to /system/app/ and deleted Android system webview and Android browser provider. However, I wasn't able to find com.mediatek on /system/app and instead found it on /data/data. I deleted that from there. But then I did a system reset. com.mediatek was still there. Also, I couldn't delete Android service framework, because I tried doing adb shell pm uninstall -k --user 0 android and couldn't access anything from the notification menu. For now I disabled the apps with adb shell pm uninstall -k --user 0 com.app.name. Are there any ways to permanently delete com.mediatek.
If it would help ya'll in any way I could attach a adb dumpsys and adb logcat logs. I noticed a few suspicious behaviors like, when I exit an app, the data/wifi completely bolts down, and vpn logs says network change detected. None of the other phones has this issue. I think I might be dealing with something big here.
Edit:
Okay, I don't happen to have all the links, but two of those apps were with me, and am providing the scan links here for eSet terminal and webview.

Eset terminal https://www.virustotal.com/gui/file/b319236ee02778c88198e1b88e730b871f2709705728d766825a479652a7cec9/detection
webview  https://www.virustotal.com/gui/file/c1d4821e87519453ad5fc4e31fa4790cdc3a98dd45fd6015899a8f7093f6b784/detection
I am sorry but you totally misinterpret the scanner results.
In both cases one of 61 scanners has detected something - that looks more like a false-positive. Additionally the scanners that detected something are uncommon. Not one of the major virus scanners detects anything on the samples. Rescan it some days later and if nothing has changed the chance is very very high that the result is not correct.
Additionally one item is detected as &quot;PUA&quot; - not as virus. PUA is the abbreviation for  - Potentially Unwanted Application - usually software like advertising trackers falls into this category.
The other is a PUP - hence a &quot;Potentially Unwanted Program&quot; which effectively means the same as PUA.
Conclusion: You totally panicked because you don't understand how to interpret the VirusTotal results.