My dad's phone got infected with a virus. The virus will auto enable the WIFI despite after disabling it for a few seconds. Factory restore doesn't work too, the virus came back. I have installed antivirus such as kaspersky, norton, and dr web. They are all unable remove the virus, it re-install itself after removal. It's running on android 4.4.

Here is the screen shot of what dr web's report

Dr Web's report

It keeps downloading back these applications

App image

Can anyone please advice me on what to do?


Looks like mobile is infected with Ghost Push.

Solution for Rooted phones:

1 - You can use apps like StubbornTorjanKiller.

2 - You can also remove malware manually as you know the names of infected application.

  • First Download Terminal Emulator And run following commands.
  • su

    rm /system/app/weQR.apk

    rm /system/app/browser_1.6.2.1sign.apk (write name of app exactlly as your screenshot)

    repeat rm with path of infected 5 apps shown in above screenshot.

| improve this answer | |
  • 1
    You do know that rm -rf /system/priv-app/ will remove the entire tree starting from that directory, including possibly legit and vital apps, do you? – Grimoire Sep 15 '16 at 17:05
  • 1
    I have never encountered with directory priv-app in /system/..so thought it was created by malware..but after a quick search came to know that it is legit directory..Thanks for pointing that.. – Ash-Ishh.. Sep 15 '16 at 18:11

Like above ...

If the file is persistent or un-deletable (usually the associated binary files under system > bin)
You need to use a Chattr first ..

busybox chattr -ia /system/bin/viralFile

and then

rm /system/bin/viralFile

This is helpful for force removing virus or non-deletable files, like most people on here that have used KingRoot or similar programs, it's a last option for hard to remove files !

| improve this answer | |
  • +1: the answer, despite being only a complement for the previous, addresses the topic of file attributes, which is often overlooked. Nicely done. – Grimoire Sep 15 '16 at 19:39

Okay this will be tricky. It looks like the virus somehow gained superuser privilages and made those apps become system apps. System apps cannot be removed because well, they are now system apps! BUT, if you have root access, you can manually remove the viruses. With ROOT/Superuser access, you can use root apps on the play store to possible remove those viruses.

If you phone is NOT ROOTED however, I recommend you use "Malwarebytes". It is avalible on the play store and has been know to remove more viruses than those other virus removing apps that claim to be the best.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.