3

I have the Android smartphone “Lava Iris 455”. My phone is not rooted. Since last week I installed APK file from some website. After a second day I realize that a trojan is installed on my phone. It is downloading Android apps automatically when data connection is on my phone.

I installed AVG Antivirus from Google Play Store. It is showing following trojan is installed on my phone:

  • Name : netalpha 3.1.8
  • package : com.play.photo.json.alpha
  • location : /system/app/LibsCore.apk
  • installed Date : 2016/07/19**

    1. AVG antivirus failed to remove this trojan.
    2. Lookout antivirus shows un-installed unsuccessful
    3. After factory reseting, it is getting back again.
    4. I tried manually to force stop service, disable, clear data. it is getting enable automatically.

I searched this problem on Google, but I did not found a solution.

Last option is flash android stock ROM to phone with flashing software.

I have two questions:

  1. How is the trojan installed on /system/app directory even if my phone is not rooted yet?
  2. Obviously, if it installed on System App directory, then it should be removed without rooting my phone.

migrated from superuser.com Jul 22 '16 at 6:24

This question came from our site for computer enthusiasts and power users.

  • 1
    "then it should be removed without rooting" – obviously too late already. If it installed in /system/app, it already rooted your device (if only for itself). No way to remove that without rooting. But even with rooting, you cannot tell if you really got rid of it; the only safe method would be flashing a clean ROM – as Andy points out in his answer. – Izzy Jul 22 '16 at 7:23
  • Hmmmmmm...... I have the feeling "LibsCore.apk" is useful for something. Can't remember what. App seems a tad legit, tbh. – Dan Brown Jul 22 '16 at 20:43
  • , it seems LibsCore is a app that gets popular search results. Possibly a google backend app. – Dan Brown Jul 22 '16 at 20:48
  • @Izzy Got an answer up. Who'd have thought that AVG had a Wikipedia of viruses and stuff available for viewing anytime? – Dan Brown Jul 22 '16 at 21:18
  • dear lzzy, i mention already, my phone is not rooted yet. please read carefully my question and then reply. – Parag Humane Jul 25 '16 at 11:21
1

After reading this, Iwent and saw on my phone that /system/app contains folders for Google apps, more likely the stock apps. Make a backup of the phone (backups only include apps from the play store and other data) and wipe it. You may need to obtain an image file for your phone, install a recovery like TWRP or CWM, wipe the system partition, and install the os image and restore.

  • I don't want to flash fresh ROM in my phone. i asked 2 questions. if you have answer then you are welcome. – Parag Humane Jul 25 '16 at 11:26
1

After some research (I.e. the AVG database) it flags three things

LibsCore.apk is the victim in this. Let it live and love.

com.play.photo.Jason.alpha throws up as NOT a trojan, but a collection of three separate malware modules. They are

  1. Airpus

  2. Generic malware

  3. gp ei ccc (can someone explain that name?)

    • Generic Malware is malware that, well, does the basics, like throw cake and log keystrokes (passwords, etc.). The sort of thing you expect a hostile piece of code to do.

    • airpus is malware that does a HELL of a lot less than Its generic, boring brother. The only common thing they do is rob personal data. However, airpus is also adware, and will display adverts EVERYWHERE (trust me from personal experience there)

    • gp ei ccc seems to inject itself into devices by using legitimate AND illegitimate websites. It can pose a threat to privacyz but also cracks open root access for the other malware modules.

So what can you do??

Well, as I see it, you have 4 options

  1. Root the device, and remove LibsCore.apk and hope nothing falls apart. It may not work if the malware has a survival script.

  2. Root the device, do a clean install of The ROM*. This yields the best success chance, but is not 100% likely to work (Murphy's Law.)

  3. Live with it.

  4. Get a new phone.

Sorry to be blunt with the last two, but they are options.

Good luck, and Happy hunting, Enthusiast!

*Izzy said it first, so he can have credit. I don't mind. Hell, I'd probably forgotten to put it in the answer otherwise.

To answer your questions...

  • many apps can use exploits and system vulnerabilities to gain root access for themselves, such as the malware.

  • No, im afraid. The malware used an exploit to gain root and install itself into /system/app. So you will also have to gain root to modify the /system/app directory. Malware essentially gives itself root, so you have to do the same to yourself.

  • 1
    Nevermind that I said that first – I didn't invent it. If you've got scrambled eggs into your sugar box, you don't try to clean up the sugar – that would be too difficult a goal to attain. You empty the entire box and fill it with fresh sugar instead. Same with malware that made it into your ROM :) – Besides, Andy had this already covered. – Izzy Jul 22 '16 at 21:25
  • @Izzy Yeah. But why punch a gift horse when you can praise it? Anyway, the options are there, and it is much, much easier to just do a clean install, but some people are nitpicky mother truckers. It may be easier to empty the box, but sometimes stuff can get stuck on it. – Dan Brown Jul 22 '16 at 21:27
  • 1
    Don't forget you've got to reconfigure everything in the afterplay – which is one of the main reasons some people hesitate. But trying to clean up definitely has a lower success rate than starting with a fresh install. But we won't start a discussion here, this ain't no forum :) // If something still sticks, you need a new device ;) – Izzy Jul 22 '16 at 21:29
  • 1
    @Izzy That is very true. And we are no forum. You go to XDA for that :) – Dan Brown Jul 22 '16 at 21:30
  • Good information about trojan. i like details. but my questions are not solved yet. anybody there to answer my questions? – Parag Humane Jul 25 '16 at 11:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.