I recently received some updates today from the Play Store. Every so often a pop notification, one of those bubble ones at the bottom of the screen with Chinese characters.

The most recent update I've noticed is the ES File Explorer. I wouldn't mind, but my device is rooted and so I am at risk. I have a screenshot of the notification.

My device is the Samsung Galaxy Tab A 9.7 and I have stock ROM installed.

an image with the bubble notification

What my question(s) are: Do I have a virus (it's not being picked up by Avast) and if I do, how do I remove it?

  • 1
    Please see this new article 2017/02/10 10 most useless apps and games for Android. Most prominent, but specifically named in the list: ES File Explorer (along with quote-Booster apps, Anti-Virus apps, and Task Killers-unquote)
    – wbogacz
    Feb 12, 2017 at 2:43

2 Answers 2


Based on the information given, it's indeed caused by the latest update (9 July 2016) of ES File Explorer. From some of recent reviews,

  • This new version has a new issues, whenever I open the ES file explorer it's showing some errors in Chinese language. It's affecting other apps too... (link)

  • Latest was a series of Chinese toast notifications being displayed even when not using the App. (link)

  • new problem raised while using app some chinese lang messeges display which is distracted the main usage (link)

  • Latest update now causing messages in Chinese to popup near the bottom of the screen. (link)

  • and many more...

I don't think it's a virus. It supposed to be kind of "helpful" messages to the user (who can read it).

  • 3
    Loosely translated, "Started instrumentation/monitoring service"
    – Kyle
    Jul 10, 2016 at 22:44
  • 2
    Looks like debug info that was accidentally left in the release build.
    – Andrew Sun
    Jul 11, 2016 at 1:19

Try to boot into safe mode, and then carefully scan through the app drawer, and active processes in settings and try to find anything that seems suspicious, or without a description. Personally i have never seen any app use these bubbly toast messages, unless modded. It would be easier if it were written in Latin alphabet, and not Chinese hanzi.

  • Safe mode is the worst thing to be in when scanning active processes, since it prevents any non-system app from running.
    – Grimoire
    Jul 10, 2016 at 13:06
  • Yes, but with everything that is going on now with the android security these days, it wouldn't be unheard of if malware was trying to disguise itself as system app. Since this is Samsung any app could be disguised as one of those bloat apps. And OP mentioned he has root. Correct me if am mistaken.
    – Ikarus
    Jul 10, 2016 at 13:14
  • You're correct. However, I would suggest listing all of the background apps in a normal session first, and then find whose of them are being developed by an Eastern developer.
    – Grimoire
    Jul 10, 2016 at 13:21
  • @DeathMaskSalesman Couldn't he also just record which app sends the toast the investigate further?
    – user145490
    Jul 10, 2016 at 16:12
  • @user145490 He could, but not many users are familiar with logcats.
    – Grimoire
    Jul 10, 2016 at 16:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .