I think my device got a malware. A lock screen with ads sometimes appear, and I must swipe an area at the bottom of the screen to open the phone. I am in Eastern Europe, some ads are in Slavic languages, and they are seemingly related to travel.

http://i.imgur.com/Ym4uvwb.png

Image resized. Click to view the full image

I have seen ads for Lot Air (Polish carrier). I recently went to their site.

Considering my recent surfing activity and the nature of the ads, I guess the malware is connected to airlines active in Eastern Europe.

The lock screen also promotes the app "DU Quick Charger" by claiming it has recharged the phone extra fast during screen off. (!?) It also shows battery level. I have never installed DU Quick Charger. I doubt DU Quick Charger is installed on the phone.

The problem started after installing Ryanair app. The problem is maybe, but not surely, related to this. Uninstalling Ryanair and restarting the phone doesn't remove the occasional appearance of this lock screen. After a while the situation has changed for the worse, now this lock screen appears after EVERY screen off.

I have always used Avast. I am not rooted and only install via Google Play.

What is this? And how do I remove it?

  • Thanks. I really appreciate your input. The problem right now is that I am travelling. I haven't seen a PC for months. As soon as I get to one I will try your suggestion. / Is there anything else to do before that? – ycc_swe Apr 25 '16 at 20:00
  • So does this lock screen appears out of nowhere, I mean you're using your device and then it shows up, or, you put the device to sleep, awake it and gets to see that lock screen? You've also made certain that there is no fishy device administrator under Settings -> Security -> Device administrators? – Firelord Apr 25 '16 at 20:02
  • Can you provide us a list of user installed apps which can "draw over other apps"? This may help: Determine which app is drawing on top of other apps? – Firelord Apr 25 '16 at 20:10
  • Device administrators ok. / It never appears "suddenly" when I work on the phone. It only appears after waking up the screen saver, f.ex after closing flip cover, pressing on/off button or "spontaneous black screen after 2 min inactivity". Right now every time! But not always every time. // I'll come up with a better error-description when I can. – ycc_swe Apr 25 '16 at 20:13
  • Thanks. It is late in my time zone. I'll come back as soon as I can with list of "draw over" apps. – ycc_swe Apr 25 '16 at 20:40
up vote 66 down vote accepted

This lockscreen replacement is caused by an ad from DU Quick Charge

I am pretty sure that this lockscreen was added to the app "ES App Locker". Many User-Revievs are stating that this app comes with lots of unwanted ads and lockscreen-replacements.
See this review: User Review from Daniel Burkhardt

This is what they are answering to most people: Answer from ES Global to User-Reviews

So you either have the option to turn this settings off apparently or remove this application.

You can check the user-reviews here: Google Play Story

Disabling DU Quick Charge may not work on devices. In this case insure that you completely remove the application. If the quick charge screen continues to display, check to see if you have any other apps that have this "adware" and remove them.


EDIT:

Based on the information seen in another question I wanted to update this answer. It seems like quite a handful of applications have added this lockscreen replacement in their latest updates. There is one Reddit discussion which mentions a few apps.

As @Andrew T. pointed out - the main cause of this lockscreen replacement is the advertisement of DU Quick Charge - developed by DU APPS STUDIO.

If you are experiencing similar problems then check this helpful answer by @Firelord to check which app might cause this.

I'll try to update this answer from time to time.

  • 2
    THANKS, THAT SEEMS TO HAVE REMOVED THE UNWANTED ADWARE! Opening ES App Locker not possible since it was locked with a pattern. I NEVER USE PATTERN. It thus seems like a very risky program. (But ES File Explorer Pro is the file manager I mostly use, unfortunately.) It was possible to uninstall ES App Locker though. But then stock pin-lock screen appeared in Android. Fortunately correct pin was an old one I once tried. THANKS AGAIN. I'LL COME BACK IF PROBLEM REAPPEARS. VERY VALUABLE ANSWER. – ycc_swe Apr 26 '16 at 7:02
  • 5
    I switched away from ES File Explorer after using it for like 3 years just because of the integration of ads and changing the user-interface. The once simple-to-handle program has changed a lot in my opinion. If you're looking for a replacement in the near future you can check out @Izzy s list of applications for filemanaging – benjamin Apr 26 '16 at 8:19
  • @AndrewT. Added :) I'll check the reddit thread from time to time in the next few days and have a look at future questions which may address this issue and add these apps when I can. If you or anyone else finds more feel free to edit them in or (if it makes sense) make this a community-wiki :) – benjamin Apr 26 '16 at 14:08
  • Wife just started getting this; we think it was from this app: play.google.com/store/apps/… – Danny Tuppeny May 16 '16 at 21:02
  • 1
    Removed Loc X (play.google.com/store/apps/… and DU Quick Charge was removed along with it =] – Joeymetro May 20 '16 at 17:56

For people like me who hate ES Explorer doing this but can't move away from it right now(because of its loads of features!):

We can disable this unnecessary feature:

  • Go to Es Explorer Tools and disable charging boost.

This will remove the annoying ad screen you see when you plugin the charging cable.

A Reddit user has started to collect together the apps that have included this 'feature'/adware. The list currently contains:

  • Xender
  • ES File explorer (by ES Global) Removed
  • ES App Locker (by ES Global)
  • KittyPlay Wallpapers Ringtones
  • GO apps (Go Weather, Keyboard, SMS, Next Browser)
  • TouchPal Suite (Anything made by them)
  • Z Camera
  • HiFont
  • TrustGo
  • Battery Doctor
  • InstaMag
  • FotoRus - Photo Editor Pro
  • UC Browser
  • App2SD
  • 360security
  • Photo Editor Pro by Zentertain
  • AppLock by Fotoable,Inc
  • Secret Video Recorder by CME Services
  • Between
  • Sharecloud (by For2ww)
  • Flashlight & LED Torch (by Zentertain)
  • Photo Collage Editor by Zentertian
  • LOCX: App Lock (CY Secure)
  • XBrowser - Super Fast and mini by XMan
  • iMuslim
  • Solo Launcher
  • Go Speed
  • Photo Grid
  • Avast Mobile Security free
  • S Photo Editor
  • AllShare
  • Multi Calculator
  • This list was helpful for me to identify the "culprit" app. For me it was "AllShare" app - if you can, then please verify and add it to your list, bmdixon. – Nirav Zaveri Oct 2 '17 at 10:49
  • You can add Multi Calculator to the list. – Cobus Kruger Feb 13 at 19:55
  • Hi @bmdixon! Would you please consider reading this meta Q&A page. While we have not reached any consensus so far, your answer may stand affected in future. It might become easy for us to decide a solution if you could add your opinion there, even if it in comments. :-) – Firelord Nov 30 at 19:00

It seems ES File Explorer does this now - I have had it installed for years, but today I saw DU Quick Charge pop up and it seems to be tied with an update of ES File Explorer. I uninstalled it and the malware is gone.

  • Was it the free version of ES File Explorer or was it the pay/Pro version? (I saw the lock screen once only, today. I have both these installed.) – ycc_swe May 10 '16 at 17:33
  • It was the free version – JBCP May 10 '16 at 17:55
  • Thanks. If this lock screen reappears I will uninstall the free version. It is often also time consuming to uninstall, since you have to enter all passwords (cloud, ftp), set up windows etc when you reinstall. – ycc_swe May 10 '16 at 18:11

This is to provide additional evidence that ES Explorer is another culprit, from the family of ES apps

Network Monitoring: How to Get Started and Why You Should Consider it, a post which appeared on XDA portal yesterday confirms this using Fiddler- The free web debugging proxy for any browser, system or platform

The XDA post explains, set up of Fiddler, creating a proxy, connecting your phone and laptop on the same WiFi network and analysing traffic. In particular, it analysed traffic from ES Explorer and says

  • Even though the Pro version does not come with ads, several MBs worth are still being downloaded just not shown.

  • The app is built poorly with no regard for efficiency.

  • The app is communicating with Baidu constantly.

Post ends with pictorial evidence of other malware assosciated with ES Explorer

enter image description here

Amber Weather was the reason DU Quick Charge was added to my lock screen. ES File Explorer and ES App Locker was not the cause.

  • Amber Weather was not the cause foe me, either. – subjectivist Apr 26 '16 at 22:08

It was ES App Locker, and they are currently sock puppet blasting the app with 5 star ratings to try and counter the deluge of 1 stars... It's pretty sad actually, and it's why I switched to Solid File manager, which I actually like more than I liked es... It does a 14 day trial before you have to buy in, But there are a bunch of alternatives that aren't pay to use, such as Amaze File manager which is open source, so it should never be pay to use.

  • 1
    I hope people give comments in Play Store about it, if there is suddenly a high influx of 5-star ratings. – ycc_swe Apr 28 '16 at 5:37

In my phone the reason for the lockscreen was the Xender File Sharing App. When I clicked the little gear(settings) icon on the top right corner it gave me an option to switch off the Xender Quikcharge feature and so I did. I don't get this screen anymore. I went to the Xender app page on the Google Play Store and a lot of other users had also complained about the same problem. Hope this helps.

  • Please link app from Play Store – beeshyams May 4 '16 at 11:11

protected by Dan Hulme May 9 '16 at 14:27

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.