1

I thought that it's not possible for any virus-like app to self-install apps on a mobile phone. But this is happening in the case of my friend. And I have no idea how to help him.

Namely, he has a Huawei G630 mobile phone. He wanted to download an MP3 song using the default Browser (not Chrome, but default one) and got a message like "you need to update the system before being able to listen this song". This was probably a trick to force him to install a virus-like app.

After that, each day at midnight, new apps start to get installed by itself. This is a screenshot of 4 apps installed on his phone.

screenshot
Screenshot (click image for larger variant)

I searched for Lutu and could not find it on the Play Store.

I also tried to find this 3rd app that does this, but in vain. I uninstalled a few suspicious apps and killed some services, but this did not help.

I also thought that this is a kind of an add-on in the default Browser (like I have it in Chrome), but I could not find add-ons in this app.

Any idea how to solve this issue?

NOTE: His Huawei is rooted so could the app be installed in the root section? This could explain why I cannot delete it as it's presented as a system app.

Improve this question
11
  • 3
    The app would install itself as system app even if the phone wasn't rooted. You should flash a new ROM.
    – SarpSTA
    Mar 2, 2016 at 11:23
  • You should disable third party apps, and setup the Playstore to require a passcode for each new install. That way the virus should not be able to install new apps
    – Pit
    Mar 2, 2016 at 12:21
  • 2
    @Pit the fact the apps are not been found at Google Play rules out the Playstore app being part of the game. I rather support SarpSTA's opinion here: the app made itself a system app, by which it got access to the INSTALL_PACKAGES permission and is able to, well, install apps. That's the most plausible explanation. As SarpSTA's recommendation to "flash a new ROM" (or rather "a clean ROM") is the most likely cure, going along with a factory-reset to make sure nothing of the culprit remains. And definitely: "need to update the system to play the song" was a lure.
    – Izzy ♦
    Mar 2, 2016 at 13:07
  • 2
    @AnDroDroo This Malware Can Secretly Auto-Install any Android App to Your Phone / Hackers reveal Android malware that is IMPOSSIBLE to remove / find more articles; related: Malicious Android Apps installed remotely on my device
    – Izzy ♦
    Mar 2, 2016 at 13:11
  • 2
    if it's rooted, try uninstall suspicious system app via Titanium Backup or Lucky Patcher. And install AdAway then change your launcher.
    – AMZMA
    Mar 2, 2016 at 13:49

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .