2

I'd like to reformat / reset my verizon Samsung S4 (SCH-I545, baseband **OF1, Android 5.0.1). After doing a number of tests and experimentation, I believe that there is a malicious binary sitting in /system which is causing me to follow a random Russian porn Instagram account. I'd like to get rid of whatever is causing the auto-follow (it's not even good porn), so I thought a hard reset / reformat would be ideal... HOWEVER, I believe that a factory reset does not touch /system. Is there a recommended approach with a non-rooted phone to essentially start with a blank slate?

The phone itself was never rooted, but it did come refurbished a year or so ago from Verizon. Since it's running a OF1 baseband, I believe rooting it is out of the question? If it's possible to root, that might solve a lot of problems.

  • In theory, nothing can write to /system (and that is not even needed for the kind of issue you described). First try a factory reset, it fixes most malware issues. If this fails try to get your hand on a firmware image for your phone and flash it using Odin (or ask the service center to do it for you as ionree pointed out). – GiantTree Jan 9 '16 at 21:06
  • @GiantTree when some malware manages to convert itself to a system app (which is what OP describes, and what's currently in the wild – Google just removed several such apps from playstore this week), it is indeed needed to write to /system (as that's where the malware sits then). Only solution in those cases is flashing a clean ROM (stock or custom doesn't matter), which overwrites /system and thus the malware along. – Izzy Jan 9 '16 at 21:31
0

The easiest way to fix it (without even voiding warranty because we will be flashing an official firmware image) consists of a few small and easy steps:

(Assuming you have already installed Samsung's USB drivers) I take no responsibility for damaging, bricking or otherwise damaging you or your phone, but that's how I flashed since a few years now and it never failed me, even when I was at the glimpse of a hard-brick.

  1. Get your firmware image: SamMobile has you covered on nearly all the Samsung firmware images. Get the latest image from Sammobile for your device by creating an account and downloading the .tar.md5 file. (Don't change the extension, even though you can open the .tar like usual, it prevents Odin from verifying the checksums)
  2. Get Odin from Sammobile.
  3. Boot your phone to download mode by shutting it down and then holding HOME + Volume-Down + Power until you are greeted by the bootloader. Then press Volume-Up to confirm that you want to install a firmware.
  4. Open Odin and select the .tar.md5 as PDA or AP, leave everything else untouched (uncheck Re-Partition just in case! It can mess with your storage layout and is usually not needed)
  5. Connect your phone to your PC (if you haven't already) and make sure it's recognized by Odin.
  6. Hit the Start button
  7. Wait until your phone automatically reboots and you are done. No factory reset is needed, the /system partition will be checksum-exact with the one in the firmware image.

(All images with a solid, non-grayed out KIES logo are exact with the one available form Samsung's KIES software)

  • This should be correct. I had not realized that Odin does not require root. – ionree Jan 10 '16 at 8:57
-1

I'm not sure why you are certain that malware has written to /system. As pointed out by @GiantTree, no 3rd party should have been able to write to it. This partition is protected at all costs by your system, which is also what makes rooting so difficult on your device. In practice however, there is a rather high chance an exploit was found and not made public (regarding recent news kindly pointed out in the comments by @Izzy).

A google search lead me to believe that there is in fact a way to root your phone (please regard the edit below). This would probably be the easiest method to solve your problem. Once rooted, either re-flash your stock ROM or any custom one, as you wish. This gives you a completely fresh and new /system partition, removing any malware that was mysteriously able to write to it.

Another option might be to go to a service center and ask if they could possibly reinstall the firmware without rooting the device.

EDIT: I was able to dig up an xda thread that deals with rooting a previously unrooted S4 from Verizon with your firmware version. There is a youtube video about it here. HOWEVER, some reports indicate that this does not actually work and will brick your device. What to do is up to you, but be careful and don't blame me if anything goes south.

  • I'm considering the service center approach, although that just seems like admitting defeat :). That link you sent deals with only current and previously rooted phones - it doesn't apply in my case :( – Clicquot the Dog Jan 9 '16 at 21:09
  • I just realized that, sorry for wasting your time – ionree Jan 9 '16 at 21:19
  • 1
    This should've been a comment. This is unnecessarily extended into an answer. However, should you decide to keep this as an answer, please make sure to give clear and detailed instructions on how to get rid of the malware OP is having in their device. Should the answer require rooting and flashing a ROM, make sure to detail that here. Links die a lot, and so as the content behind them, thereby making the link-only answer pretty much unhelpful. – Firelord Jan 9 '16 at 21:20
  • 1
    @ionree honoring your sureness – but read the news. It was just this week that a group of such malware apps was removed from playstore. Those apps did exactly that: using an exploit to convert themselves to system apps. Factory-reset is of no use then, as it doesn't touch /system (where the malware then sits). – Izzy Jan 9 '16 at 21:32
  • 1
    @ionree well, not the link I had in mind. My article was from yesterday, but is in German. Brain Test re-emerges: 13 apps found in Google Play would be the appropriate English post. Quote: "Some variants attempt to gain root privilege, and persist factory resets and other efforts to remove it, especially on rooted devices." – Izzy Jan 9 '16 at 22:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.