I installed and executed this app which is a virus or malware now what to do?

Question

I had this message pop up and unfortunately

I installed and executed this app which is a virus or amalware now what to do ? Please see the photo here

Of course I mean the app that came when I pressed the button in the captured photo?

Answer 1

You became a victim of a typical phishing scam. The problem at this point may or may not be severe, depending upon the state of SELinux enforcement in your device and un-patched known vulnerabilities in platform software. I would suggest begin by hunting down any app which has been recently installed.

I tried App Detective¹, Elixir 2 and Solid Explorer Classic and all of them were able to sort the apps by time of installation and/or update.

Note: If the app offers sorting then have it sort in descending order. Whichever app entry you would touch, you would be shown certain information. One such information is package name of the app. Note it down and so as the label/name of the app.

Now, in order to remove the app, go into application manager of your device. That would mostly be Settings app → Apps → All apps. Search for your app and uninstall it. Repeat the whole exercise if you installed more than one malware.

Note: some malware apps tries to be smart (funnily). Through phishing they have the user set them as device administrator, which makes them temporarily immune from force stop as well as removal. Under application manager of your device, if you find your malware with having Force stop and Uninstall button grayed out, then you may be dealing with a device administrator. In that case go to Settings app → Security → Device administrators → deselect the entry for your app.

If you cannot find the app by its label/name in application manager, then setup adb in PC and execute this command:

adb uninstall PKG  # PKG refers to package name of the app you intend to uninstall

Tip: all the three apps I tried, they also offered removal of a user selected app; at certain point of app removal, you might need the assistance of safe-mode.

If the app exploited a vulnerability then it may have become a system app. In that case, you shouldn't bother about removing the malware because you may not be skilled enough to ascertain where else the infection may have occurred. The cleanest approach is to have the stock ROM flashed on the device. For that, you may seek technical help from the vendor or on this site or forums out in the wild. Anyhow, the details about flashing a ROM are beyond the scope of this answer.

_{(Click an image to enlarge it; order of images: App Detective, Elixir 2, Solid Explorer)}

---

Lessons for future:

• When browsing in any browser, ignore any warning -- no matter how convincing or scary it is -- that asks you to install an app or to share any piece of personally identifiable information. That's just spam and will always be.
• Keep Unknown sources setting disabled. It's not a coincidence that it is a security setting.

---

¹ _{Courtesy of HasH_BrowN for the answer here.}