0

I recently installed Trend Micro Mobile Security in order to to check my apps if all are safe and secure since I have a rooted Xperia Phone which may be more prone to attacks.

I had clean results then I've got it uninstalled. The problem starts when I installed an App called "WiFi FTP (WiFi File Transfer)" from 1 Mobile Market which I found out isn't a genuine Google Play app and has a suspicious 1MB file size. As a rooted user I've got a popular app called Xprivacy which warns me when any app is seeking permissions and gives me the choice to allow it or not.

When I opened WiFi FTP and gave it full permissions it needed I had a surprising Xprivacy popup for another app called "Security Certificate" asking for permissions to use (among others) the Internet. I've blocked all of them. After removing WiFi FTP I had another popup for a suspicious app with the name "Settings Helper" asking for the same permissions as its predecessor. I blocked all permissions it was asking for, and opened Settings > Apps to check what they are. I found both of them having an identical weird android logo and when I got into the app info it had a "Disable" option not an "Uninstall" one. Which means that it is installed as a system app. Though I disabled both of them, and when I was outdoors I turned on Mobile Network for internet access just for 5 seconds and found a surprising big charge,and after checking traffic data usage I found an app (or better call them a system service for the three of them) with the same weird logo called "ceryos" that was the reason for that unusual charge and the previous two apps with some minimal net usage too!

I disabled the three apps but after some hours I checked them back and found them enabled Again except for "ceryos" (luckily)! And resetting the permissions limits I set them to from xprivacy. Though after doing more checks I found another one called "Live Wallpaper" with the same icon and disabled it.

What is the safest way to disable or remove these malicious applications?

  • Check the list of "Device Administrators" in the Security menu. – feral_fenrir Sep 29 '15 at 13:25
  • And if you want a decent way to transfer files over WiFi, try AirDroid. – feral_fenrir Sep 29 '15 at 13:26
  • 4
    I don't think this is the right website to help you. Perhaps Android Central forums? Oh. You may find it helpful to reset to factory settings and install apps more carefully. – Neil Smithline Sep 29 '15 at 13:33
  • Thanks for the replies! feral I checked "Device administrators" before and found nothing enabled and AirDroid is surely a good choice but curiosity was the reason that let me install such an app. – avadoo Sep 29 '15 at 13:39
  • Neil this is my first question over here and I think you're right but I hope any one over here could give some help, and factory reset is the last option I'm thinking of right now. – avadoo Sep 29 '15 at 13:41
1

I did some further search and found a similar post talking about the same issue, he didn't have the full answer yet i did it my own way and I guess it's working.

1.Since I'm a root user and my issue is related to apps installed in system directory I used "Root Explorer" went to the root directory then system->apps

2.I sorted the apps by date (to see the newly installed malicious apps)

3.I found the following app list: ("obs.apk", "abc.apk", "SettingProvider.apk", "LiveWallpaper.apk", "BatteryControl.apk") which all were installed the same date I installed that malicious app.

4.Finally I did remove them and I think it's over now.

  • I just want to mention that, be careful with what you try out in the wild. You were close to become a victim of a ransomware. – Firelord Sep 29 '15 at 16:51
  • Totally true.. I made it once and won't do it again, the thing is just i trusted 1 Mobile Market as a safe store to download apps from and it totally wasn't. – avadoo Sep 30 '15 at 8:37
  • PS. I have made a backup for the malicious files, if anyone is interested in reverse engineering these apps I could give him a copy. – avadoo Sep 30 '15 at 8:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.