64

I think my device got a malware. A lock screen with ads sometimes appear, and I must swipe an area at the bottom of the screen to open the phone. I am in Eastern Europe, some ads are in Slavic languages, and they are seemingly related to travel.

http://i.imgur.com/Ym4uvwb.png

Image resized. Click to view the full image

I have seen ads for Lot Air (Polish carrier). I recently went to their site.

Considering my recent surfing activity and the nature of the ads, I guess the malware is connected to airlines active in Eastern Europe.

The lock screen also promotes the app "DU Quick Charger" by claiming it has recharged the phone extra fast during screen off. (!?) It also shows battery level. I have never installed DU Quick Charger. I doubt DU Quick Charger is installed on the phone.

The problem started after installing Ryanair app. The problem is maybe, but not surely, related to this. Uninstalling Ryanair and restarting the phone doesn't remove the occasional appearance of this lock screen. After a while the situation has changed for the worse, now this lock screen appears after EVERY screen off.

I have always used Avast. I am not rooted and only install via Google Play.

What is this? And how do I remove it?

Improve this question
11
  • Thanks. I really appreciate your input. The problem right now is that I am travelling. I haven't seen a PC for months. As soon as I get to one I will try your suggestion. / Is there anything else to do before that?
    – cvr
    Apr 25, 2016 at 20:00
  • So does this lock screen appears out of nowhere, I mean you're using your device and then it shows up, or, you put the device to sleep, awake it and gets to see that lock screen? You've also made certain that there is no fishy device administrator under Settings -> Security -> Device administrators?
    – Firelord ♦
    Apr 25, 2016 at 20:02
  • Can you provide us a list of user installed apps which can "draw over other apps"? This may help: Determine which app is drawing on top of other apps?
    – Firelord ♦
    Apr 25, 2016 at 20:10
  • Device administrators ok. / It never appears "suddenly" when I work on the phone. It only appears after waking up the screen saver, f.ex after closing flip cover, pressing on/off button or "spontaneous black screen after 2 min inactivity". Right now every time! But not always every time. // I'll come up with a better error-description when I can.
    – cvr
    Apr 25, 2016 at 20:13
  • Thanks. It is late in my time zone. I'll come back as soon as I can with list of "draw over" apps.
    – cvr
    Apr 25, 2016 at 20:40

8 Answers 8

Reset to default
66

This lockscreen replacement is caused by an ad from DU Quick Charge

I am pretty sure that this lockscreen was added to the app "ES App Locker". Many User-Revievs are stating that this app comes with lots of unwanted ads and lockscreen-replacements.
See this review: User Review from Daniel Burkhardt

This is what they are answering to most people: Answer from ES Global to User-Reviews

So you either have the option to turn this settings off apparently or remove this application.

You can check the user-reviews here: Google Play Story

Disabling DU Quick Charge may not work on devices. In this case insure that you completely remove the application. If the quick charge screen continues to display, check to see if you have any other apps that have this "adware" and remove them.

EDIT:

Based on the information seen in another question I wanted to update this answer. It seems like quite a handful of applications have added this lockscreen replacement in their latest updates. There is one Reddit discussion which mentions a few apps.

As @Andrew T. pointed out - the main cause of this lockscreen replacement is the advertisement of DU Quick Charge - developed by DU APPS STUDIO.

If you are experiencing similar problems then check this helpful answer by @Firelord to check which app might cause this.

I'll try to update this answer from time to time.

Improve this answer
8
  • 2
    THANKS, THAT SEEMS TO HAVE REMOVED THE UNWANTED ADWARE! Opening ES App Locker not possible since it was locked with a pattern. I NEVER USE PATTERN. It thus seems like a very risky program. (But ES File Explorer Pro is the file manager I mostly use, unfortunately.) It was possible to uninstall ES App Locker though. But then stock pin-lock screen appeared in Android. Fortunately correct pin was an old one I once tried. THANKS AGAIN. I'LL COME BACK IF PROBLEM REAPPEARS. VERY VALUABLE ANSWER.
    – cvr
    Apr 26, 2016 at 7:02
  • 5
    I switched away from ES File Explorer after using it for like 3 years just because of the integration of ads and changing the user-interface. The once simple-to-handle program has changed a lot in my opinion. If you're looking for a replacement in the near future you can check out @Izzy s list of applications for filemanaging
    – benjamin
    Apr 26, 2016 at 8:19
  • @AndrewT. Added :) I'll check the reddit thread from time to time in the next few days and have a look at future questions which may address this issue and add these apps when I can. If you or anyone else finds more feel free to edit them in or (if it makes sense) make this a community-wiki :)
    – benjamin
    Apr 26, 2016 at 14:08
  • Wife just started getting this; we think it was from this app: play.google.com/store/apps/…
    – Danny Tuppeny
    May 16, 2016 at 21:02
  • 1
    Removed Loc X (play.google.com/store/apps/… and DU Quick Charge was removed along with it =]
    – Joey
    May 20, 2016 at 17:56
15

For people like me who hate ES Explorer doing this but can't move away from it right now(because of its loads of features!):

We can disable this unnecessary feature:

  • Go to Es Explorer Tools and disable charging boost.

This will remove the annoying ad screen you see when you plugin the charging cable.

Improve this answer
14

A Reddit user has started to collect together the apps that have included this 'feature'/adware. The list currently contains:

  • Xender
  • ES File explorer (by ES Global) Removed
  • ES App Locker (by ES Global)
  • KittyPlay Wallpapers Ringtones
  • GO apps (Go Weather, Keyboard, SMS, Next Browser)
  • TouchPal Suite (Anything made by them)
  • Z Camera
  • HiFont
  • TrustGo
  • Battery Doctor
  • InstaMag
  • FotoRus - Photo Editor Pro
  • UC Browser
  • App2SD
  • 360security
  • Photo Editor Pro by Zentertain
  • AppLock by Fotoable,Inc
  • Secret Video Recorder by CME Services
  • Between
  • Sharecloud (by For2ww)
  • Flashlight & LED Torch (by Zentertain)
  • Photo Collage Editor by Zentertian
  • LOCX: App Lock (CY Secure)
  • XBrowser - Super Fast and mini by XMan
  • iMuslim
  • Solo Launcher
  • Go Speed
  • Photo Grid
  • Avast Mobile Security free
  • S Photo Editor
  • AllShare
  • Multi Calculator
Improve this answer
2
  • This list was helpful for me to identify the "culprit" app. For me it was "AllShare" app - if you can, then please verify and add it to your list, bmdixon.
    – Nirav Zaveri
    Oct 2, 2017 at 10:49
  • You can add Multi Calculator to the list.
    – Cobus Kruger
    Feb 13, 2018 at 19:55
12

It seems ES File Explorer does this now - I have had it installed for years, but today I saw DU Quick Charge pop up and it seems to be tied with an update of ES File Explorer. I uninstalled it and the malware is gone.

Improve this answer
3
  • Was it the free version of ES File Explorer or was it the pay/Pro version? (I saw the lock screen once only, today. I have both these installed.)
    – cvr
    May 10, 2016 at 17:33
  • It was the free version
    – JBCP
    May 10, 2016 at 17:55
  • Thanks. If this lock screen reappears I will uninstall the free version. It is often also time consuming to uninstall, since you have to enter all passwords (cloud, ftp), set up windows etc when you reinstall.
    – cvr
    May 10, 2016 at 18:11
6

This is to provide additional evidence that ES Explorer is another culprit, from the family of ES apps

Network Monitoring: How to Get Started and Why You Should Consider it, a post which appeared on XDA portal yesterday confirms this using Fiddler- The free web debugging proxy for any browser, system or platform

The XDA post explains, set up of Fiddler, creating a proxy, connecting your phone and laptop on the same WiFi network and analysing traffic. In particular, it analysed traffic from ES Explorer and says

  • Even though the Pro version does not come with ads, several MBs worth are still being downloaded just not shown.

  • The app is built poorly with no regard for efficiency.

  • The app is communicating with Baidu constantly.

Post ends with pictorial evidence of other malware assosciated with ES Explorer

enter image description here

Improve this answer
0
2

Amber Weather was the reason DU Quick Charge was added to my lock screen. ES File Explorer and ES App Locker was not the cause.

Improve this answer
1
  • Amber Weather was not the cause foe me, either.
    – subjectivist
    Apr 26, 2016 at 22:08
2

It was ES App Locker, and they are currently sock puppet blasting the app with 5 star ratings to try and counter the deluge of 1 stars... It's pretty sad actually, and it's why I switched to Solid File manager, which I actually like more than I liked es... It does a 14 day trial before you have to buy in, But there are a bunch of alternatives that aren't pay to use, such as Amaze File manager which is open source, so it should never be pay to use.

Improve this answer
1
  • 1
    I hope people give comments in Play Store about it, if there is suddenly a high influx of 5-star ratings.
    – cvr
    Apr 28, 2016 at 5:37
2

In my phone the reason for the lockscreen was the Xender File Sharing App. When I clicked the little gear(settings) icon on the top right corner it gave me an option to switch off the Xender Quikcharge feature and so I did. I don't get this screen anymore. I went to the Xender app page on the Google Play Store and a lot of other users had also complained about the same problem. Hope this helps.

Improve this answer
1
  • Please link app from Play Store
    – beeshyams
    May 4, 2016 at 11:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .