I thought that it's not possible for any virus-like app to self-install apps on a mobile phone. But this is happening in the case of my friend. And I have no idea how to help him.

Namely, he has a Huawei G630 mobile phone. He wanted to download an MP3 song using the default Browser (not Chrome, but default one) and got a message like "you need to update the system before being able to listen this song". This was probably a trick to force him to install a virus-like app.

After that, each day at midnight, new apps start to get installed by itself. This is a screenshot of 4 apps installed on his phone.

Screenshot (click image for larger variant)

I searched for Lutu and could not find it on the Play Store.

I also tried to find this 3rd app that does this, but in vain. I uninstalled a few suspicious apps and killed some services, but this did not help.

I also thought that this is a kind of an add-on in the default Browser (like I have it in Chrome), but I could not find add-ons in this app.

Any idea how to solve this issue?

NOTE: His Huawei is rooted so could the app be installed in the root section? This could explain why I cannot delete it as it's presented as a system app.

  • 3
    The app would install itself as system app even if the phone wasn't rooted. You should flash a new ROM. – SarpSTA Mar 2 '16 at 11:23
  • You should disable third party apps, and setup the Playstore to require a passcode for each new install. That way the virus should not be able to install new apps – Pit Mar 2 '16 at 12:21
  • 2
    @Pit the fact the apps are not been found at Google Play rules out the Playstore app being part of the game. I rather support SarpSTA's opinion here: the app made itself a system app, by which it got access to the INSTALL_PACKAGES permission and is able to, well, install apps. That's the most plausible explanation. As SarpSTA's recommendation to "flash a new ROM" (or rather "a clean ROM") is the most likely cure, going along with a factory-reset to make sure nothing of the culprit remains. And definitely: "need to update the system to play the song" was a lure. – Izzy Mar 2 '16 at 13:07
  • 2
  • 2
    if it's rooted, try uninstall suspicious system app via Titanium Backup or Lucky Patcher. And install AdAway then change your launcher. – AMZMA Mar 2 '16 at 13:49

protected by Community Jun 18 '16 at 18:23

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Browse other questions tagged or ask your own question.