My grandma has a cheap, 5.1-based Android phone, manufactured by a company named Manta (don't think it's available anywhere outside of Poland, just think your generic cheapest phone company) and has been having problems with ads appearing on the phone and apps installing on their own.
It first happened around a month and a half ago. When you browsed the phone, ads of various apps started appearing - sometimes small banners on the bottom of the screen, sometimes full-screen sized popups overlaying everything. They appeared regardless of the place - on the home screen, on Google Now, over the app drawer, over Chrome, what have you. Also, the phone would sometimes just randomly buzz out of thin air. I tried to clean the phone, used all the highest rated malware killers on the play store, pinpointed that an app disguised as "System upgrade" was an offender - however, all of this to no avail. Despite the malware finders finding some things and allegedly removing them, despite me removing the "System upgrade" (which, as it turns out, was not the only offender), after not longer than an hour, ads started appearing again, various apps started installing on their own without permission and so on. What's worst, the phone started also sending premium SMS'es which upped the bill quite a bit (thankfully we managed to get a refund from the carrier).
So I wiped the phone. Set everything back up again. Everything was cool for a few weeks when suddenly, yesterday grandma told me the same thing started happening. I took the phone home, checked and yep, it did - ads appear throughout the system again, one app installed on its own, I constantly get alerts from the system reading "Installation blocked: This app is fake. It can damage your device and steal your data" that regard my good ole' friend "System upgrade" (well at least this time the system blocked the installation). The phone randomly buzzes again. And on top of that, I randomly get the "Do you want to install X" screen with permissions listed as if I just downloaded something from the play store, though about apps that I (or grandma, for that matter) never downloaded, like PayPal or some supermarket's apps.
How can I fix this? Why does it even keep happening, despite me having wiped the system? I don't really feel like wiping it again without understanding the reasoning would be of much sense right now since it failed me once already. Grandma isn't a heavy user with tons of apps, she only has the ones that came preinstalled on the phone and uses maybe 3 of them (SMS, dialer, Chrome). She's not the type to click anything that pops up mindlessly either, always reads everything carefully and doesn't fall for all the "Your phone has a virus, clean now"/"You won an iPhone" advert crap. I also checked the browsing history to see if she didn't accidentally go to a shady website but not at all - only the news, wikipedia and google searches are there. She doesn't install any apps on her own. The only app we ever installed from outside of what came pre-packaged was the Digital Clock Xperia Widget, which has tens of millions of downloads and an above 4 average so it doesn't seem like it would be a malware gateway.
How can I try to tackle this?
