0

This morning I got a notification on my HTC Desire 820 running Android 4.4.4, about update of 1.22 version for network. I thought it was normal and I updated it.

From then my device is turning on both Wi-Fi and Data automatically. Many times I tried to switch it off but it again turns on.

  • What did the notification look like? I'm afraid you've just installed a Trojan (malware). With some luck (if that malware didn't manage to obtain elevated privileges and install itself as system app), a factory-reset might cure that. Its permanent switching on of network functionality suggests it's "phoning home", very likely transmitting personal data. – Izzy Aug 28 '15 at 9:10
  • The notif seems official and it gone in good way however I reset my phone now and it solved the issue I thought of doing this without reset but fear of malware made me to do so, anyway thanks for the input @Izzy – dh47 Aug 28 '15 at 9:35
  • They all "look official", that's special styling setup on malware-ridden sites. As the reset solved it for you, I will make this an answer with some more details – please "accept" it then (ticking the check-mark next to it) to signal others this is a working solution. – Izzy Aug 28 '15 at 13:23
2

Even if such notifications look "official", they rarely are. They are specifically styled in a way to make them appear such, to betray people thinking that and tempt them to install the "stuff" behind. But one is more likely to install some malware that way, often a Trojan – like in your case: Its permanent switching on of network functionality suggests it's "phoning home", very likely transmitting personal data. A Google image search on "android malware installation popup" gives you some examples:

popup popup
browser popups wanting you to install an "update" (click images for larger variants

These candidates are easy to tell: you will never be informed on a system upgrade via browser popup, and there is no such thing like an update for your battery module coming this way (apart from which: the second screenshot proves its "fake-ness" by being a bad translation with grammar mistakes – another indicator to check for). A little protection can be gained from disabling "unknown sources" in your Android settings: that should keep installations from other than "official sources" (Playstore, your vendor) out. So if something claims to be an official update, but on installation you get told to enable "unknown sources" – be sure to cancel, as that's a fake and will almost for sure install malware.

But not all candidates are as easy to tell. Some even manage to place themselves as notifications in your notification area. A few rules on those:

  • official updates never come as "browser popups" on visiting some site. They are usually shipped as ota-update, or are to be installed via your device manufacturer's special tool (e.g. Samsung Kies)
  • if something tells you it has detected a "virus" – forget it, there is no virus for Android.
  • if unsure on its genuity: long-press the notification and check which app caused it. If it's an app that didn't come pre-installed: get rid of that app ASAP, it might do other evil things.
  • if you still cannot tell: ask in a forum where your device is dealt with, ask the manufacturer: is there an update deployed currently?

If you're already sitting in the mess (having that fake installed), the safest way out is a . You never can be sure where on your device the malware has spread. Hopefully it didn't manage to exploit some security hole and install itself as system app; if it did, the only thing to cure your device is a fresh firmware install.

  • Actually it is not an browser popup. – dh47 Aug 28 '15 at 16:46
  • I just tried to cover the whole thing, @dh47 – see the notification part, which might be what you've experienced. – Izzy Aug 28 '15 at 16:48
  • Ok anyway I have a backup and I restored from my backup now the issue was solved from now on I will be extra careful :) thanks for detailed answer – dh47 Aug 28 '15 at 17:39
  • Glad I was able to help! And be careful as well with what you restore from your backup :) – Izzy Aug 28 '15 at 20:00
  • No problem with that there was no backup for yesterday :) – dh47 Aug 29 '15 at 5:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.