1

I Just rooted my phone (Motorola RAZr D1) in order to allow aditional space for instalations. I could not find a proper way to root this device on XDA fórum so I went to internet. I got root acces by instaling Kingsroot app but since then the phone is showing strange behavior like consuming more batery, auto enablig data of the SIM, and not allowing some aplications to be installed (espacially those related to security like SuperSU and some AV), etc. I suspect the phone was hacked so I perform factory resset via the system management tools. But the malware is still there... And if I try the reset via initialization tool (power+volUP) the options are all in chinês which I am not able to understand.... what can I do to recover control of my device?

UPDATE:

I have android 4.4.2 (KitKat) installed in which Framaroot does not work.

I want to get superSU installed on /system and set it as the default root manager but kinguser (that is the malware, I am almost sure) doesn't prompt for authorization with other superuser applications of android market (like superSU in https://www.youtube.com/watch?v=uNrny2A6g1g or superuser).

Some apllications got autorization now (like root explorer and Avast) but not the terminal which could also de helpful. How to make it?

  • Please post back when your issue has been resolved. – HasH_BrowN Mar 5 '15 at 19:52
  • 1
    If you're certain that malware is still there even after Factory Reset, it means it is now in /system or a location outside the ambit of Factory Reset. In such case, you need to format the various partitions, or to be precise, you need to install ROM from scratch to completely get rid of Malware. Look for fastboot type ROM for your device on WEB. And from now on, use APK's that are well trusted in the Android Communities. Rooting can be done easily from Custom Recovery. So never try Rooting using APK's unless no option works. – Firelord Mar 5 '15 at 23:28
  • Thank you for the suggestions... Actually I searched a lot tutorial on how to root my device without any APK but nothing... And even on fóruns I trust a little bit I found ways to root the system (e.g. Framaroot does not work after android 4.4.2 KITKAT) – Claudia Mar 6 '15 at 13:33
2

Are you sure that you have malware, not just wrong settings in kinguser? (Ones that revoke and run in background using battery)

Please take look at this http://www.youtube.com/watch?v=Vl8z37PhEe0, each screen is viewed

Pause the video on each screen and match the screen up to yours (since in Chinese), taking note of settings - placement of options should be the same between languages.

Once understood and set right, follow this guide for properly rooting your device (start 8/27/2013). This guide is from the XDA developer chrono_s3rge and in English.

How to Root Motorola Razr D1 XT914:

  1. Download the latest version of Framaroot, from XDA developer alephzain
  2. Install and open Framaroot (you will have to enable unknown sources)
  3. Select "BOROMIR"
  4. Reboot device
  5. Enjoy

Check application list for SU to confirm that root worked. Update the binary, then once up and working, uninstall kingroot.

Always perform a backup, in case of issues and for data replacement.

Rooting your device is potentially dangerous, security issues arise, and other problems that could brick your device - making it unusable. Please know that you and you alone assume responsibility from rooting your device. That being said enjoy responsibly

  • The asker already (unintentionally) made a terrible mistake of using Apk inside Android to root Android which led to malware infection. Even though Framaroot works well, it is not very trustworthy from the standpoint of ROOTING (Supreme access) and I suppose it shouldn't be suggested without a warning. The issue the asker mentioned is to recover now, where Factory Reset isn't helping. Framaroot definitely can root the device here but it certainly cannot get rid of malware which is the pivotal issue. – Firelord Mar 5 '15 at 23:23
  • @Firelord When another superuser app is installed, which can be accomplished in askers present staste, older superuser apps are overwritten. Thus their data is flushed. Corruptible malware should stop running. Should be able to manually locate malware and delete. I didn't suggest a warning, asker should already be aware of potential security problems from website they downloaded kinguser from. But your right, I will edit that in – HasH_BrowN Mar 5 '15 at 23:35
  • It is true about the fact of overwritten, nothing stops the malware from downloading other Root binaries which should work alongside with the Current or future Root binaries installed by ROOT apps (This is hypothetical, I'll search more to back it up). That said, if the malware is able to access ROOT in asker's present scenario, it can easily block 'Framaroot' ((which is actually nothing but exploiting vulnerability and pushing binaries to exploit)) from Rooting the device. Besides, a presumption that User should be aware of something more or less beats the purpose of Q/A here. – Firelord Mar 5 '15 at 23:44
  • 1
    @Firelord This all comes back to using incompatible firmware and not fully searching information out. Not warning them about something that they should have realized before initially attempting to root their device, doesn't beat the purpose of Q/A. User didn't ask about potential threats of rooting, but rooting with wrong software and undesirable results. We are past the point of warnings, its already too late. But I digress, I am thinking this just might be the settings in the kinguser app restricting everything. I will research. – HasH_BrowN Mar 5 '15 at 23:55
  • I have ICS 4.4.2 and Framaroot doesn't work anymore. And about the kinguser it is working the same way that shown in the video. I suspect Kingsroot is the malware because it insists on enabling data even during night. SuperSU is now installed but kinguser doesn't prompt the window to allow it to run. And it is not updating the binaries :( I think maybe I workaround can be useful. I want to get superSU installed on /system but have no idea on how. – Claudia Mar 6 '15 at 13:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.