0

I had this message pop up and unfortunately

I installed and executed this app which is a virus or amalware now what to do ? Please see the photo here

Screenshot

Of course I mean the app that came when I pressed the button in the captured photo?

  • 2
    I think the questioner's problem is that he clicked the link in the captured page and installed the malware and needs to know how to remove it. – Zeiss Ikon May 5 '16 at 18:03
  • Yes exactly I don't understand how can some one understand what I wrote in a different way !!! – XYZ May 5 '16 at 18:07
  • 3
    If you want to be helped, please refrain from offense. I've removed that part from your post. – Izzy May 5 '16 at 18:12
  • I already in installed it , should I worry about hidded app that install with it ? – XYZ May 5 '16 at 18:17
  • 1
    PS: That the screen shown is telling you "no good things" is easy to see by multiple facts: 1) "act immediately" (with a count-down), 2) telling you your SIM would be affected (or, in some other cases the battery), 3) asking you to download, install and execute something directly (instead of giving general advice to install it from Google Play). I never understood how people fall for such a thing. Follow Firelords advice, hope for the best, and be more careful next time ;) – Izzy May 5 '16 at 18:20
1

You became a victim of a typical phishing scam. The problem at this point may or may not be severe, depending upon the state of SELinux enforcement in your device and un-patched known vulnerabilities in platform software. I would suggest begin by hunting down any app which has been recently installed.

I tried App Detective1, Elixir 2 and Solid Explorer Classic and all of them were able to sort the apps by time of installation and/or update.

Note: If the app offers sorting then have it sort in descending order. Whichever app entry you would touch, you would be shown certain information. One such information is package name of the app. Note it down and so as the label/name of the app.

Now, in order to remove the app, go into application manager of your device. That would mostly be Settings app → Apps → All apps. Search for your app and uninstall it. Repeat the whole exercise if you installed more than one malware.

Note: some malware apps tries to be smart (funnily). Through phishing they have the user set them as device administrator, which makes them temporarily immune from force stop as well as removal. Under application manager of your device, if you find your malware with having Force stop and Uninstall button grayed out, then you may be dealing with a device administrator. In that case go to Settings app → Security → Device administrators → deselect the entry for your app.

If you cannot find the app by its label/name in application manager, then setup in PC and execute this command:

adb uninstall PKG  # PKG refers to package name of the app you intend to uninstall

Tip: all the three apps I tried, they also offered removal of a user selected app; at certain point of app removal, you might need the assistance of .

If the app exploited a vulnerability then it may have become a system app. In that case, you shouldn't bother about removing the malware because you may not be skilled enough to ascertain where else the infection may have occurred. The cleanest approach is to have the stock ROM flashed on the device. For that, you may seek technical help from the vendor or on this site or forums out in the wild. Anyhow, the details about flashing a ROM are beyond the scope of this answer.

(Click an image to enlarge it; order of images: App Detective, Elixir 2, Solid Explorer)

IMG: IMG: IMG:


Lessons for future:

  • When browsing in any browser, ignore any warning -- no matter how convincing or scary it is -- that asks you to install an app or to share any piece of personally identifiable information. That's just spam and will always be.
  • Keep Unknown sources setting disabled. It's not a coincidence that it is a security setting.

1 Courtesy of HasH_BrowN for the answer here.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.