I am running Android 7.0 in a Samsung Galaxy J7 prime phone. Today, while using the phone, I suddenly found a folder named obj in Internal storage/Android, that had never been there before. It had the timestamp of only a few minutes ago. The folder had more files inside, the path is this - Internal storage/Android/obj/.um/sysid.dat
There was a similar duplicate with the same timestamp in the following directory - Internal storage/Android/data/.um/sysid.dat
I did a google search, and a Dr. Web page as well as a Hybrid analysis page came up, both flagging a similar directory as a SMS spy app. The files were same, but the directory was a little different, as they were located on the sd card in the pages, while in my phone they are located in Internal storage and no such files on sd card. Here is the link - https://vms.drweb.com/virus/?i=15272609&lng=en
I don't know how these files got in, as I haven't installed any new apps in like forever, and also I'm very cautious while browsing, and when these files got created, I was browsing perfectly safe websites. Anyway, since the Dr. Web page had the spyware sample and said it was able to flag the file, I figured the antivirus could at least detect the malware, if not remove it (in case it was rooted in the system), and hence downloaded the Dr. Web Light app from playstore and ran both full and quick scans with it, twice. Did not detect a thing, despite having these file directories explicitly listed on their website analysis of the spyware. I would understand if it did not remove it, but since it has already analysed this malware sample, I would expect it to at least flag the file.
Also ran full scans with Norton, Kaspersky, Sophos, Zelmana and F-secure (all free versions except Norton and Zelamana which gave Premium trial versions), none of them even detected anything.
Apart from the Dr. Web and Hybrid Analysis pages, there is no more information about this on the Internet, except a lonely reddit thread which point back to the same aforementioned pages.
Can anyone guide me in the right direction here? Anyone happen to know about this particular incident? What should I do? Factory reset? Firmware flashing? It will probably take me a couple days to do either because I have to back up personal documents, till then, should I refrain from using the phone? Turn off data connection? Or shut the phone off altogether? Not make any calls or send any sms? I only have this one phone, I'm signed into every which thing from this, and I receive and make calls and messages daily.
I was blindsided by this, so I have to back up my personal files and chats to a USB first, which again, I'm worried, might get infected from being plugged into the phone and later while I restore the backups to the clean phone, causes reinfection.
Any suggestions as to how I can back up safely and what I should actually do at this point to limit any further damage till I wipe the phone?
Please help me out, really worried and still using the phone as I don't have access to anything else. Some detailed information will be very appreciated.