I recently received some updates today from the Play Store. Every so often a pop notification, one of those bubble ones at the bottom of the screen with Chinese characters.

The most recent update I've noticed is the ES File Explorer. I wouldn't mind, but my device is rooted and so I am at risk. I have a screenshot of the notification.

My device is the Samsung Galaxy Tab A 9.7 and I have stock ROM installed.

an image with the bubble notification

What my question(s) are: Do I have a virus (it's not being picked up by Avast) and if I do, how do I remove it?

  • 1
    Please see this new article 2017/02/10 10 most useless apps and games for Android. Most prominent, but specifically named in the list: ES File Explorer (along with quote-Booster apps, Anti-Virus apps, and Task Killers-unquote) – wbogacz Feb 12 '17 at 2:43

Based on the information given, it's indeed caused by the latest update (9 July 2016) of ES File Explorer. From some of recent reviews,

  • This new version has a new issues, whenever I open the ES file explorer it's showing some errors in Chinese language. It's affecting other apps too... (link)

  • Latest was a series of Chinese toast notifications being displayed even when not using the App. (link)

  • new problem raised while using app some chinese lang messeges display which is distracted the main usage (link)

  • Latest update now causing messages in Chinese to popup near the bottom of the screen. (link)

  • and many more...

I don't think it's a virus. It supposed to be kind of "helpful" messages to the user (who can read it).

  • 3
    Loosely translated, "Started instrumentation/monitoring service" – Kyle Jul 10 '16 at 22:44
  • 2
    Looks like debug info that was accidentally left in the release build. – Andrew Sun Jul 11 '16 at 1:19

Try to boot into safe mode, and then carefully scan through the app drawer, and active processes in settings and try to find anything that seems suspicious, or without a description. Personally i have never seen any app use these bubbly toast messages, unless modded. It would be easier if it were written in Latin alphabet, and not Chinese hanzi.

  • Safe mode is the worst thing to be in when scanning active processes, since it prevents any non-system app from running. – Grimoire Jul 10 '16 at 13:06
  • Yes, but with everything that is going on now with the android security these days, it wouldn't be unheard of if malware was trying to disguise itself as system app. Since this is Samsung any app could be disguised as one of those bloat apps. And OP mentioned he has root. Correct me if am mistaken. – Ikarus Jul 10 '16 at 13:14
  • You're correct. However, I would suggest listing all of the background apps in a normal session first, and then find whose of them are being developed by an Eastern developer. – Grimoire Jul 10 '16 at 13:21
  • @DeathMaskSalesman Couldn't he also just record which app sends the toast the investigate further? – user145490 Jul 10 '16 at 16:12
  • @user145490 He could, but not many users are familiar with logcats. – Grimoire Jul 10 '16 at 16:21

Not the answer you're looking for? Browse other questions tagged or ask your own question.