Android Enthusiasts Stack Exchange is a question and answer site for enthusiasts and power users of the Android operating system. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Once the smartphone (android 4.4.2, kazam tornado 350) has been booted, is connected to WIFI and an unlimited number of APPs is installed causing the phone to stop, i.e. swipe is stopped, another home screen is installed.

Symptoms

  1. A number of unwanted apps is installed once the phone has been reset to factory defaults
  2. Unlimited amount of unwanted apps is installed once wifi is installed
  3. Phone battery is consumed quickly
  4. Home screen cannot be entered
  5. Popups that ask to install (fake) security updates appear

Attempts

  1. The unwanted APPs remained installed on the smartphone once the phone was reset to factory defaults
  2. The installation of the APPs persisted even after encryption and subsequently resetting to factory defaults
  3. Resetted the phone to factory defaults, disabled wifi, disabled malicious apps, rebooted and enabled wifi installed an unlimited number of APPs again
  4. Tried to install a Virusscanner, but everytime the connection to internet is established various malicious apps are installed immediately
  5. The issue persists as well once the SD card was removed
  6. The internal phone storage cannot be removed. In an attempt to remove it the screen was busted :'(

Discussion

  1. The APPs that are installed do not appear in the downloaded APPs section
  2. After resetting to factory defaults, there seems to be malicious APPs recognized as default APPs, e.g. com.andriod instead of com.android

Question

How to remove this Virus?

share|improve this question
    
Comments are not for extended discussion; this conversation has been moved to chat. – Matthew Read Jan 23 at 20:31
up vote 5 down vote accepted

As I already mentioned in the comments, here are the primary points you need to be careful about:

  1. Whenever you install an app from the Play Store, you should pay attention to things like permissions, ratings, reviews by existing users, etc. before installing it on your device. One malicious install, and your phone could become compromised. It doesn't matter then, whether you are rooted or not.

  2. When you install an app, it asks you a bunch of questions like what all things it needs access to (like SDCARD, telephony resources, system tools, etc.). Even without root access, a malicious app can do lots of damage to your phone, if you permit them these resources.

  3. As the existing answer suggests, rooting is your only option if the malware has landed itself in the system area. But if you go along that route, proceed with care and caution, as there is a risk of bricking if incorrectly done.

  4. For future reference, make a mental note to double check at least two things before installing an app: 1) The permissions it needs are sane and safe. 2) There are at least 500 million installs already with at least a 3.5+ rating. You can make rare exceptions for popular apps like WhatsApp/Skype, but this is generally what you should do. You may or may not be able to recover this phone, but life goes on and these things will go a long way to ensure that such a situation will never arise.

share|improve this answer
1  
The majority of malicious apps on the plays store is so minimal it is not even gonna make it to the 50 mark. The problem of malicious apps come in is when you install from unknown sources (You have to the setting turned on). It would be nearly impossible for the software to get into the system area. As the user would have need to manualy root the phone, then move the apk into the system folder. This would require root access and for the user to grant root access. Root is basically UAC on windows, where if the user grants permission to (or has crap security ) applications can access vital files – Matt07211 Jan 22 at 2:15
5  
Refusing to install any app with less than 500 million installs already? Isn't that going to limit your app selection quite a bit? – immibis Jan 22 at 3:50
    
@immibis better safe than sorry. If you are willing to do the research and find what the reviews and ratings actually mean, its a different matter. This is sort of a thumbrule for noobs who know nothing better than tapping the big install button! – Prahlad Yeri Jan 22 at 9:40
    
@Matt How do you know whether they are malicious or not? An android project is a complex thingy typically composed of a million lines of Java code. Do you really think Google can dedicate enough resources to quality audit every piece of code that gets into the Play Store? Its not even a major revenue stream for them (which is advertising). – Prahlad Yeri Jan 22 at 9:45
    
I realise that their are million of lines of code, but Google checks what permissions an app asks for (and the like etc.), and during the review process the apps gets tested by a HUMAN, (although the apps getting tested by humans is only a recent change for Google (happend during 2015)) – Matt07211 Jan 22 at 9:53

Try a reset, Boot your Phone into (Click on the tag to find out how) this will only boot essential apps, Then uninstall any apps you think are the culprit, then boot out of safe mode and see if the problem persists. If it does Repeat the cycle till you find the problem. Then by the end if the problem still persists it may be a system app (Due to me not finding much info about your phone, I can't say it is full of crap ware, and finding info about this phone is difficult)

But due to your broken screen, this may be difficult.

And due to the extensive conversation in the comments section above, I doubt that your phone has root privileges, but if the phones does have root privileges, and the application may be in the system folder.


But due to my limited knowledge of what you have on phone, what you have done to it etc. I can't be any more help, then just suggesting to boot into safe mode.

In my opinion I think it is just one of the default apps downloading use crap or the default apps have automatic updates enabled

share|improve this answer
1  
1) Every Android has root privilege. Question is, can any app gain that root privilege? It is this standard su which provides a way to switch to root. 2) It has been mentioned that device has been reset so there is no point in going to safe mode. If the reset was a failure at first for some unforeseen technical reason, then it should be done again. If the problem still persist, safe mode (by essential, it means no user installed apps) would be of no use since as you say the malware is located inside system partition. The safest option is a clean flash of OS, top to bottom. – Firelord Jan 22 at 8:36
    
@Firelord I belive that you are most likely correct, but due to what type of phoen the user has, getting a clean OS may be a bit of a challenge. Once the user has a clean OS they can install the ROM – Matt07211 Jan 22 at 8:40

Depending on your phone brand, flash stock firmware through Odin, fastboot, or LG Flash Tool to overwrite the virus.

Samsung phones: Hold the power button, home, and volume down to access download mode. Download Odin v3 or any other version, I recommend XDA as a source. Find the .tar file for your device, SamMobile.com has all the firmwares for every Samsung device.

LG phones: download LG Flash Tool online, and find a .kdz stock firmare for your device.

Nexus phones: find the fastboot.exe included with your adb drivers and use that.

You didn't specify model or device so my help is only so limited here.

Anyway, hope this helps

EDIT:

Researched the Kazam Tornado 350, and there are no development threads for it on XDA or other sites. Couldn't find any stock firmware for it on Google, only shows a couple hits for the Tornado 348. I hate to say this, but you'd be better off getting a new phone.

share|improve this answer
    
Could it be possible that there will be a Tornado 350 stock firmware in the near future? – 030 Jan 22 at 2:09
    
Yes, keep an eye on Needrom as they are the only ones to carry the 348 firmware. – Aaron Gillion Jan 22 at 2:13
    
You can also contact the webmaster at that site and he can probably hook you up. – Aaron Gillion Jan 22 at 6:10

As mentioned, if you can manually reflash the firmware, that will solve it. Be careful you don't brick it though!

Otherwise, I suggest you reset the phone again. When it reboots, immediately put it into airplane mode. In settings, put the phone into developer mode (search google or xda developers forums) & turn on usb debugging (for ADB). You might need to select allow apps from unknown sources under security too

If possible, you should be rooted for this. The process depends on your phone. Look up what may work. I know that if you're lucky enough to have an old kernel, you can probably use ADB to push towelroot apk to the device, navigate to it in default file manager & start it up & hopefully be rooted just like that

Now use ADB to connect the device to your computer & get a shell. You may have to install USB drivers - should be in the docs for ADB or at least on forums for it

Using adb, especially if you're able to get root, you should be able to do a lot of useful things like

  • check out the contents of /bin /sbin /sys /boot & other directories that may have executables related to your problem
  • inspect, backup & modify files from your computer
  • hunt down the code that repopulates these unwanted apps
  • backup & restore the whole phone. useful if you get to a point where unwanted apps are partially removed & system is stable

Good luck! It probably won't be that easy unless you have a background in Android or Linux hacking. But it's most likely feasible if you're motivated, & you'll know a lot more about your phone. Also, try posting whatever interesting stuff you find along the way, like a startup script or directory containing the apps in question. That will make it much more likely that somebody will be able to point you in the direction of solving your issue here

share|improve this answer

If you check the list of All applications you may find applications like Pornclub, Engriks, Settings helper, Adobe Air, Battery controller, Times, com.android.system and many more. Antiviruses like McAfee and Avast detect these apps like viruses, but cannot remove them.

The solution varies from device to another. Re-flashing the device with the stock ROM is the best solution, but not the easiest since the ROM can be hard to find.

Another solution is to root the device and manually uninstall the malware APKs from the system directory. Some devices are hard to root. Sometimes the device is successfully rooted, but doesn't allow the deletion of the APKs from the system directory.

Disabling suspicious applications is another solution, but it doesn't always work because some devices don't allow disabling applications, or the viruses have themselves disabled their Disable option.

share|improve this answer

You have not done the proper factory reset. No, you did not.

Factory reset removes all newly installed apps. If they still appear after you boot, you have not performed the factory reset. It may be that the factory reset sequence you apply does not remove everything.

You need to figure out how this reset should actually be done and do it. Maybe the phone repair shop could help. Most likely you simply have a single misbehaving app with too many permissions, but you do not know which one.

You can also try to uninstall apps manually, as many of them as possible. Even apps that appear as part of the phone initial package may be worth to uninstall as maybe malware pretends to be one of those, sharing the same icon.

And, for the future, never click "Ok" button on the dialog without reading that is written on the dialog. If you have no time to read, always click "Cancel".

I am aware about some applications that use "com.andriod" as a package name but these are not malicious. They are educational apps that do not require any permissions, do not even connect to Internet.

share|improve this answer
1  
"If they still appear after you boot, you have not performed the factory reset." -- both correct and incorrect at the same time. An app that has exploited a vulnerability (think of StageFright - millions of devices are at risk for their lifetime) would possibly have moved into system partition. It implies that even infinite number of correctly performed factory reset would not be able to get rid of the issue. – Firelord Jan 22 at 8:40
    
The factory reset sequence he applies does not remove everything. Most likely, only the user partition is reflashed but not the system partition. In this case only the workshop may be able to do the full factory reset, or fix after rooting the phone. – h22 Jan 22 at 10:13

From what I can gather, these are installed as system apps, therefore they cannot be removed easily. I would suggest flashing your rom onto your phone for a full reset.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.