4

I have a rooted Samsung Galaxy S3, running the stock ROM. I downloaded "root manager" app, and since then 3 more apps appeared - "file assistant," "mp3 free downloader," and "sexy." I factory reset my phone many times but yet these apps are still there, and I can't uninstall them. Also my phone began rebooting since this happened (i.e. since these apps downloaded yesterday). How do I get rid of these apps, and repair my phone?

  • They might have turned into system files. If you have ES File Explorer installed and grant root access to it, you might be able to remove them. 😀👍 – Hooded Android Apr 11 '16 at 18:49
  • Stock rom . I was going to flash a new ROM in hopes of deleting the virus – LostPecti Apr 11 '16 at 18:50
4

It sounds like malware has sneaked into your phone's system area (possibly via the "root manager" app you installed.) System area does not get touched during factory reset, which is why the apps are still there. The /system partition is usually write-protected by default, but root privileges allow apps to write there as well.

The best way to get rid of such malware is to restore the /system partition. This is accomplished by re-flashing of the firmware. You can usually find stock Android firmware for your phone on the manufacturer's website, or other trustworthy sources (e.g. XDA-Developers device forums, SamMobile.com, etc.) Alternatively, flashing a custom ROM (e.g. CyanogenMOD) will also erase the /system partition, getting rid of any malware that managed to get installed there.

Specifically, you will need the Odin tool, Samsung USB drivers (so that your PC recognizes the phone in Download mode,) and the image file specific to your phone's model number (Galaxy S3 has many variants, make sure you are downloading the proper firmware, or you may end up with a non-functioning device.) Shut down the phone, and start it while holding Power, Home, and Vol Down buttons together until it shows the Download screen. Install the USB drivers, and connect the phone via USB - it should get recognized by your computer. Run Odin program, make sure it sees the phone (one of the COM ports will be highlighted,) press the AP or PDA button and select the firmware image, and click Start.

If you are knowledgeable enough, you can start the phone in recovery mode, and then using adb browse the /system partition and attempt to find and delete the malware. However, this is a task for advanced users.

  • Thanks for your answer. I was going to reflash the ROM but when I go and download TWRP the phone keep rebooting so I can never successful finish the downloaded. – LostPecti Apr 11 '16 at 19:12
  • By the way I voted on your comment but its not showing saying I don't have enough Rep? – LostPecti Apr 11 '16 at 19:12
  • @LostPecti You need 15 rep to be able to vote. Comments, and posts alike – TheBro21 Apr 11 '16 at 19:13
  • 2
    @LostPecti You should put the device into Download mode and use Odin to flash the ROM. – Matthew Read Apr 11 '16 at 19:18
  • 1
    @LostPecti check our odin tag-wiki ;) – Izzy Apr 11 '16 at 20:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.