3

I have root access in my device, but there is a malware in /system/app/ that I can't delete. This malware installs TimeService, MonkeyTest, and also some other apps like DR battery and privacy guard, and also shows ads.

I'm using ADB shell & I have tried Root Explorer in Android. Dr.Web also can't delete it. When I tried to delete without root access, it gives the following error message:

rm failed for <filename>, Permission denied

With root access, I got the following error:

rm failed for <filename>, Operation not permitted

Is there a Linux command to delete this kind of files? Should I install BusyBox first?

operation note permited

Improve this question
3
  • An alternative is to boot into custom Recovery and then delete it. It would work. Though how did you find out that OEM shipped app is a malware causing all the other malware installation?
    – Firelord ♦
    Commented Aug 28, 2015 at 9:22
  • it's package name is android.backdoor183 oO
    – sajad
    Commented Aug 28, 2015 at 9:50
  • i can remove all system files except this file
    – sajad
    Commented Aug 28, 2015 at 10:04

1 Answer 1

Reset to default
3

Most likely this files attribute is set to "immutable". Which means nobody will be able to edit, rename, move or delete it. (Not even root)

You can check this in linux with the command: lsattr file

If this output shows an "i" my assumption is right.

The immutable attribute can be removed by chattr -i file. After doing this you should be able to delete this file as root again.

As far as I know the android toolbox does not include these binaries. You need to cross compile(your device is ARM based?) busybox for your device and take care that both binaries are included or take a prebuilt busybox binary from a trusted source which includes them.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .