Is this red star icon malware? How to get rid of it?

Question

Every now and then a red star icon appears on my brother's notification bar, as shown below. The message related to this notification is some advert like "Turbo Boost Your Battery". He has been installing software from doubtful places, so my guess it is some sort of malware he accidentally installed.

I'm not very familiar with Android, but my guess was to identify the process responsible for the notification. So I checked the process list, but nothing out of the ordinary was shown. I tried force-closing all processes (some returned although all of them originated from HTC or his carrier), but nothing made the star disappear. How can the malware be detected and removed?

Notification icon:

Notification message:

Answer 1

Definitely looks like a case of AirPush. This is a particularly invasive form of in-app advertising that uses the notification bar, even if the app utilizing it is not actively running. Technicaly it's not malware but adware, although the way it manifests itself certainly blurs the line between the two. The only way to stop these ads from appearing in your notification bar is to uninstall the application that came bundled with AirPush.

There are several apps on the Market that can help you detect which app uses the AirPush, so that you can uninstall them.

[Edit]
Apparently AirPush gave in to the public outcry and are now providing ways to opt out of their invasive ads: http://www.airpush.com/optout You can either download their "opt-out" app, or manually enter your device's unique IMEI/ESN/MEID on their site. Personally, I'd still uninstall the bundled app, since both opt-out methods would most likely use bandwidth for connecting to AirPush servers to authenticate against their databases.

Answer 2

Find the "evil app"

There are several Detectors available:

• Airpush Detector
• Airblocker - Airpush blok
• Addons Detector
• TrustGo Ad-Detektor
• Lookout Ad Network Detector

So what to do when the evil app is identified?

1. Leave a comment on the Playstore: rate very low, and point out: "ATTENTION! Invasive ads (Airpush)!!!"
2. Report to Google: As the playstore guidelines changed, these apps should be banned
3. Speaking about banned: Even if a pay-version exists, this app should be dead to you
4. Same applies for the dev of the app (maybe add this to your comment in 1.) -- I wouldn't use any of the dev's apps anymore, and say so loudly, giving them bad rep for bad deed. Hopefully, they learn from that
5. Uninstall the app, of course

How to protect you for future "attacks"?

You can scan apps in advance (before installing them), using e.g. AppBrain Ad Detector. This app can be combined with AppBrain App Market -- a slim and fast replacement for the over-loaded playstore, especially on small devices (do not fear: It is simply another front-end for the Playstore). You can search the market oops, playstore with this app, and have the other scan your findings before you install any other app. So you know what to avoid before you get annoyed...

Answer 3

Try to run Addons Detector (by denper, on the market). It detects agents included in apps.

Answer 4

Haven't checked to see if it worked long term but i uninstalled the last few live wallpapers and they went away without me even clearing them..

Answer 5

The best app to find what is giving these ads is Airpush Detector. It's free and tells you what apps have Airpush.

Answer 6

Maybe you have Android Battery Doctor Free? I'm not going to install and test it, but it seems they have this "Turbo Boost your battery" feature, whatever this means.

Of course, it all depends on what your definition of "malware" is -- it might be just a feature of another application that uses the bar for advertisements, even if you and I don't agree such behaviour is acceptable. Here are some generic instructions on how to go about removing an undesired application:

---

First, check what apps are installed -- go to Settings->Applications->Manage applications->All and see what kind of stuff is installed there. No guarantee that the offending app will be there, but you might be able to pinpoint some suspicious apps that might have brought this onboard. Kill them with impunity and check whether the notification goes away (careful with system apps!). The offending app will most likely restart soon, but at least you have found the culprit. Try to uninstall it, and if it works, you are done.

If you can't find the problem in this way, then you need to bring out the heavy guns: root¹ your device, install Titanium Backup (even the free version should work), go through the list of apps and freeze the ones that you do not recognize. Freezing the app will terminate it and not allow it to start again, which is pretty much as removing it completely -- it still does take space on the device, though.

See the Titanium Backup wiki for more information how to use the application.

While you are at it, you can also freeze/remove some vendor applications, if they get in your way.

¹ Standard disclaimer about voiding your warranty.

Answer 7

With Google Play's new Developer Program Policies any app must not display ads through system level notifications:

System Interference:

• Apps and their ads must not modify or add browser settings or bookmarks, add homescreen shortcuts, or icons on the user’s device as a service to third parties or for advertising purposes.

• Apps and their ads must not display advertisements through system level notifications on the user’s device, unless the notifications derive from an integral feature provided by the installed app (e.g., an airline app that notifies users of special deals, or a game that notifies users of in-game promotions).

If you find any app doing so you can report them from play store. You can see which app sent the notification by holding on the notification and selecting App info. You can even disable particular app's notifications by unchecking Show notification in App info.