Android Trojan removal

Question

I have the Android smartphone “Lava Iris 455”. My phone is not rooted. Since last week I installed APK file from some website. After a second day I realize that a trojan is installed on my phone. It is downloading Android apps automatically when data connection is on my phone.

I installed AVG Antivirus from Google Play Store. It is showing following trojan is installed on my phone:

• Name : netalpha 3.1.8
• package : com.play.photo.json.alpha
• location : /system/app/LibsCore.apk

• installed Date : 2016/07/19**

  1. AVG antivirus failed to remove this trojan.
  2. Lookout antivirus shows un-installed unsuccessful
  3. After factory reseting, it is getting back again.
  4. I tried manually to force stop service, disable, clear data. it is getting enable automatically.

I searched this problem on Google, but I did not found a solution.

Last option is flash android stock ROM to phone with flashing software.

I have two questions:

1. How is the trojan installed on /system/app directory even if my phone is not rooted yet?
2. Obviously, if it installed on System App directory, then it should be removed without rooting my phone.

Answer 1

After reading this, Iwent and saw on my phone that /system/app contains folders for Google apps, more likely the stock apps. Make a backup of the phone (backups only include apps from the play store and other data) and wipe it. You may need to obtain an image file for your phone, install a recovery like TWRP or CWM, wipe the system partition, and install the os image and restore.

Answer 2

After some research (I.e. the AVG database) it flags three things

LibsCore.apk is the victim in this. Let it live and love.

com.play.photo.Jason.alpha throws up as NOT a trojan, but a collection of three separate malware modules. They are

1. Airpus

2. Generic malware

3. gp ei ccc (can someone explain that name?)

   • Generic Malware is malware that, well, does the basics, like throw cake and log keystrokes (passwords, etc.). The sort of thing you expect a hostile piece of code to do.

   • airpus is malware that does a HELL of a lot less than Its generic, boring brother. The only common thing they do is rob personal data. However, airpus is also adware, and will display adverts EVERYWHERE (trust me from personal experience there)

   • gp ei ccc seems to inject itself into devices by using legitimate AND illegitimate websites. It can pose a threat to privacyz but also cracks open root access for the other malware modules.

So what can you do??

Well, as I see it, you have 4 options

1. Root the device, and remove LibsCore.apk and hope nothing falls apart. It may not work if the malware has a survival script.

2. Root the device, do a clean install of The ROM*. This yields the best success chance, but is not 100% likely to work (Murphy's Law.)

3. Live with it.

4. Get a new phone.

Sorry to be blunt with the last two, but they are options.

Good luck, and Happy hunting, Enthusiast!

*Izzy said it first, so he can have credit. I don't mind. Hell, I'd probably forgotten to put it in the answer otherwise.

To answer your questions...

• many apps can use exploits and system vulnerabilities to gain root access for themselves, such as the malware.

• No, im afraid. The malware used an exploit to gain root and install itself into /system/app. So you will also have to gain root to modify the /system/app directory. Malware essentially gives itself root, so you have to do the same to yourself.