2

​Recently I received a phone through a special offer with a company. (see here) The phone doesn't have a brand name printed on it but mentions on the back the name of the company through which I received it.

I noticed after a while that a certain "System update" and "SuperB Cleaner" app kept reinstalling, without me doing anything at all! I checked the package names and installed locations and, even though com.hermes.superb.booster (SuperB Cleaner) is a 'safe' application (i.e. it's something that isn't seen as a fake app), the 'System Update' (icon: a green android thing) app got my attention: in the Link2SD app I could see that it was installed under /data/app/com.android.ma.path4-1.apk. All system applications are usually installed under /system/app so that was strange, especially if it is called "System Update" and when I tried to open it, it doesn't do anything. After a while I get some ads popping up on my screen and I've also had the situation in which it prompted me to install an app requiring a lot of permissions (just like when you install an apk from your sd-card) which I of course didn't install.

I can succesfully uninstall both the "System Update" and "SuperB Cleaner" app on my phone (and in adb) but once you connect the phone to the internet again they are installed again. Therefore I suspect a system application must be responsible for this. However, removing a system application is impossible for me as 1) I don't have a rooted phone and 2) if I were to root my phone, I have no idea what build I should choose from as I don't know what brand my phone is...

Here is a list of all apps that are installed on my phone (including system ones) (I got this by using adb):

package:/system/app/GoogleEars.apk=com.google.android.ears
package:/system/priv-app/DefaultContainerService.apk=com.android.defcontainer
package:/data/app/bbc.mobile.news.ww-1.apk=bbc.mobile.news.ww
package:/system/priv-app/Contacts.apk=com.android.contacts
package:/system/app/VoiceUnlock.apk=com.mediatek.voiceunlock
package:/system/priv-app/TeleService.apk=com.android.phone
package:/system/priv-app/JHLauncher3.apk=com.ibingo.launcher3
package:/system/app/Calculator.apk=com.android.calculator2
package:/data/app/de.hafas.android.sncbnmbs-2.apk=de.hafas.android.sncbnmbs
package:/data/app/com.haxor-1.apk=com.haxor
package:/system/app/HTMLViewer.apk=com.android.htmlviewer
package:/system/framework/theme-res-mocha.apk=com.mediatek.theme.mocha
package:/system/priv-app/GoogleLoginService.apk=com.google.android.gsf.login
package:/system/app/Bluetooth.apk=com.android.bluetooth
package:/system/priv-app/CalendarProvider.apk=com.android.providers.calendar
package:/system/app/VoiceCommand.apk=com.mediatek.voicecommand
package:/system/app/Calendar.apk=com.android.calendar
package:/system/app/Browser.apk=com.android.browser
package:/system/app/Music.apk=com.android.music
package:/system/app/MTKLogger.apk=com.mediatek.mtklogger
package:/mnt/asec/com.belgacom.fon-1/pkg.apk=com.belgacom.fon
package:/system/priv-app/OneTimeInitializer.apk=com.android.onetimeinitializer
package:/system/app/DownloadProviderUi.apk=com.android.providers.downloads.ui
package:/system/app/DocumentsUI.apk=com.android.documentsui
package:/system/priv-app/SharedStorageBackup.apk=com.android.sharedstoragebackup
package:/system/app/Videos.apk=com.mediatek.videoplayer
package:/system/app/FileManager.apk=com.mediatek.filemanager
package:/system/priv-app/VpnDialogs.apk=com.android.vpndialogs
package:/system/priv-app/Mms.apk=com.android.mms
package:/system/app/Provision.apk=com.android.provision
package:/system/priv-app/MediaProvider.apk=com.android.providers.media
package:/data/app/com.google.android.marvin.talkback-2.apk=com.google.android.marvin.talkback
package:/system/app/CertInstaller.apk=com.android.certinstaller
package:/system/priv-app/CDS_INFO.apk=com.mediatek.connectivity
package:/data/app/com.google.android.gms-1.apk=com.google.android.gms
package:/system/priv-app/CallerID.apk=com.android.tools.callassistant
package:/system/framework/theme-res-raspberry.apk=com.mediatek.theme.raspberry
package:/system/app/MtkBt.apk=com.mediatek.bluetooth
package:/system/app/BatteryWarning.apk=com.mediatek.batterywarning
package:/system/priv-app/Settings.apk=com.android.settings
package:/data/app/com.google.android.apps.pdfviewer-1.apk=com.google.android.apps.pdfviewer
package:/system/app/Street.apk=com.google.android.street
package:/data/app/com.google.android.apps.genie.geniewidget-1.apk=com.google.android.apps.genie.geniewidget
package:/system/app/MTKThermalManager.apk=com.mediatek.thermalmanager
package:/system/app/CalendarImporter.apk=com.mediatek.calendarimporter
package:/system/priv-app/Velvet.apk=com.google.android.googlequicksearchbox
package:/system/app/Gallery2.apk=com.android.gallery3d
package:/system/app/DrmProvider.apk=com.android.providers.drm
package:/system/app/VisualizationWallpapers.apk=com.android.musicvis
package:/system/app/Exchange2.apk=com.android.exchange
package:/system/app/EngineerModeSim.apk=com.mediatek.simmelock
package:/system/app/LiveWallpapersPicker.apk=com.android.wallpaper.livepicker
package:/system/framework/theme-res-mint.apk=com.mediatek.theme.mint
package:/system/app/FWUpgradeProvider.apk=com.adups.fota.sysoper
package:/system/app/PackageInstaller.apk=com.android.packageinstaller
package:/system/priv-app/GoogleBackupTransport.apk=com.google.android.backuptransport
package:/data/app/com.google.android.tts-1.apk=com.google.android.tts
package:/system/app/TelephonyProvider.apk=com.android.providers.telephony
package:/system/app/SchedulePowerOnOff.apk=com.mediatek.schpwronoff
package:/system/app/CellConnService.apk=com.mediatek.CellConnService
package:/system/app/PicoTts.apk=com.svox.pico
package:/system/app/NoiseField.apk=com.android.noisefield
package:/system/app/Email.apk=com.android.email
package:/data/app/com.google.android.apps.maps-1.apk=com.google.android.apps.maps
package:/system/priv-app/Dialer.apk=com.android.dialer
package:/system/priv-app/FusedLocation.apk=com.android.location.fused
package:/system/priv-app/BackupRestoreConfirmation.apk=com.android.backupconfirm
package:/system/app/MagicSmokeWallpapers.apk=com.android.magicsmoke
package:/system/priv-app/SettingsProvider.apk=com.android.providers.settings
package:/data/app/com.yahoo.mobile.client.android.weather-1.apk=com.yahoo.mobile.client.android.weather
package:/system/priv-app/DownloadProvider.apk=com.android.providers.downloads
package:/system/app/FMRadio.apk=com.mediatek.FMRadio
package:/system/app/MusicFX.apk=com.android.musicfx
package:/system/app/PhaseBeam.apk=com.android.phasebeam
package:/system/app/Todos.apk=com.mediatek.todos
package:/system/app/SoundRecorder.apk=com.android.soundrecorder
package:/system/priv-app/MtkVideoLiveWallpaper.apk=com.mediatek.vlw
package:/data/app/com.microsoft.launcher-2.apk=com.microsoft.launcher
package:/system/app/LatinIME.apk=com.android.inputmethod.latin
package:/data/app/be.smartschool.mobile-2.apk=be.smartschool.mobile
package:/data/app/com.buak.Link2SD-1.apk=com.buak.Link2SD
package:/system/priv-app/GoogleOneTimeInitializer.apk=com.google.android.onetimeinitializer
package:/system/priv-app/GooglePartnerSetup.apk=com.google.android.partnersetup
package:/data/app/org.mozilla.firefox-1.apk=org.mozilla.firefox
package:/system/app/Omacp.apk=com.mediatek.omacp
package:/system/app/FactoryMode.apk=com.mediatek.factorymode
package:/system/priv-app/ProxyHandler.apk=com.android.proxyhandler
package:/system/priv-app/InputDevices.apk=com.android.inputdevices
package:/system/app/HoloSpiralWallpaper.apk=com.android.wallpaper.holospiral
package:/system/priv-app/GoogleFeedback.apk=com.google.android.feedback
package:/system/priv-app/JHThemeApkManager.apk=com.nbbsw.theme
package:/system/app/Stk1.apk=com.android.stk
package:/data/app/com.android.ma.path4-1.apk=com.android.ma.path4
package:/system/app/UserDictionaryProvider.apk=com.android.providers.userdictionary
package:/system/app/MTKAndroidSuiteDaemon.apk=com.mediatek.apst.target
package:/system/priv-app/ConfigUpdater.apk=com.google.android.configupdater
package:/system/app/PacProcessor.apk=com.android.pacprocessor
package:/system/app/Galaxy4.apk=com.android.galaxy4
package:/system/app/DataTransfer.apk=com.mediatek.datatransfer
package:/system/app/MtkWeatherProvider.apk=com.mediatek.weather
package:/system/app/PrintSpooler.apk=com.android.printspooler
package:/system/framework/mediatek-res.apk=com.mediatek
package:/system/app/GoogleCalendarSyncAdapter.apk=com.google.android.syncadapters.calendar
package:/system/framework/framework-res.apk=android
package:/system/priv-app/ContactsProvider.apk=com.android.providers.contacts
package:/system/app/Protips.apk=com.android.protips
package:/system/app/MediaUploader.apk=com.google.android.apps.uploader
package:/system/priv-app/ExternalStorageProvider.apk=com.android.externalstorage
package:/system/app/ApplicationsProvider.apk=com.android.providers.applications
package:/system/app/BasicDreams.apk=com.android.dreams.basic
package:/data/app/be.vrt.mobile.android.deredactie-1.apk=be.vrt.mobile.android.deredactie
package:/system/priv-app/PrivacyProtectionLock.apk=com.mediatek.ppl
package:/data/app/com.android.vending-1.apk=com.android.vending
package:/system/priv-app/SystemUI.apk=com.android.systemui
package:/system/app/KeyChain.apk=com.android.keychain
package:/system/app/JHTorch.apk=com.nbbsw.torch
package:/data/app/com.google.android.gm-2.apk=com.google.android.gm
package:/system/app/LiveWallpapers.apk=com.android.wallpaper
package:/system/app/MtkWeatherWidget.apk=com.mediatek.appwidget.weather
package:/system/app/EngineerMode.apk=com.mediatek.engineermode
package:/system/app/FWUpgrade.apk=com.adups.fota
package:/system/app/DeskClock.apk=com.android.deskclock
package:/system/priv-app/GoogleServicesFramework.apk=com.google.android.gsf
package:/system/priv-app/Keyguard.apk=com.android.keyguard
package:/system/app/FaceLock.apk=com.android.facelock
package:/system/app/ISmsService.apk=com.hissage
package:/system/priv-app/Shell.apk=com.android.shell
package:/system/app/ApplicationGuide.apk=com.mediatek.appguide.plugin
package:/system/app/StkSelection.apk=com.mediatek.StkSelection
package:/system/app/GoogleContactsSyncAdapter.apk=com.google.android.syncadapters.contacts

I'm afraid that this might be some trojan or virus that might be stealing information. Does anyone know what I should do to stop this from happening?

Improve this question
2

6 Answers 6

Reset to default
1

If you are not rooted, this sounds like the work of something the manufacturer put into their Android image, especially if it's one of those no-name brands. If that's the case, you aren't getting it out without root, and even then I just plain wouldn't trust their build of Android anyway. Who knows what else it has in it?

See if you can find a port of Cyanogenmod for your device and install that instead. If you can do that, it'll get rid of your problem and any other nasties in the OEM system image for sure.

Improve this answer
0

I solved this type of problem with Dr Web antivirus after many failed attempt even when I reformated my phone.

Hope you can try the antivirus.

Improve this answer
1
  • careful with Android antivirus programs, avast messed up my display driver.
    – user186920
    Commented Nov 23, 2016 at 15:05
0

You can use Debloater by Gatesjunior to block that Malware. I found it on Android gadgethacks.com and it doesn't require Root access.

Improve this answer
1
  • 4
    Please include link to the app, and the steps to do it :)
    – Gokul NC
    Commented Jul 10, 2017 at 13:47
-1

This might be better suited for a comment, but I don't have enough reputation, but here you go anyway.

That does sound like a virus. You can get free trials for many antivirus apps. The app that generally receives the best reviews is ESET, so get a trial for that one. Run a virus scan with it, and while you're at it, set up Realtime protection and Anti-Theft.

Improve this answer
2
  • I tried that but it found nothing suspicious.
    – user164555
    Commented May 7, 2016 at 13:42
  • I don't know then. Do what @Firelord tells you. He seems to know more than I do.
    – foxite
    Commented May 7, 2016 at 18:08
-1

A possible solution to get rid off the bloatwares is to use stock android or CM mod most suitable to your current device hardware and Android version. Two of my friends owning different devices of different companies had similar problem. Both got it solved by going to care center / phone repair shop and got flashed different OS package other than provided ones. Both of their phones are working today.

  • Check if you have 2 different version of SystemUI system App on your phone, if so,

  • the clone one will be responsible for unwanted installations. Check if other system apps have similar clones disable all of them, though they will keep reappearing every restart if your problem is similar to my friends mentioned above, then possible solution will be mentioned above, my friend had Lenovo phone with Idea SIM card.

Hope this helps

Improve this answer
5
  • chances of this happening are 0% unless device is rooted
    – user186920
    Commented Nov 23, 2016 at 19:24
  • The manufacturer might have modified the SystemUI app or found a loophole to run a clone SystemUI process that possess same permissions of the original process( just a suspicion though), most ads on my friend's phone were shown while the clone app was running, it replaced default launcher and certain other apps, then it would start installing bloatwares and apps like 9Apps and other apps
    – Harshiv
    Commented Nov 24, 2016 at 1:41
  • but then it's the manufacturer's fault and you can't do a thing about it
    – user186920
    Commented Nov 24, 2016 at 11:41
  • Owner of the device can do anything with it, having stock Android OS or Cynogen Mods would be better than the corrupt OS. Many times, installation of of new OS after a complete wipe solves such problems, just like windows, reinstallation fix most of the issues.
    – Harshiv
    Commented Nov 24, 2016 at 11:52
  • I suppose that's true.
    – user186920
    Commented Nov 24, 2016 at 12:56
-2

I have solved this problem by rooting my android phone using king root & uninstalled all the useless app

Improve this answer

You must log in to answer this question.