I saw various unwanted pop up ads on an Android 5.x phone. Then installed the free Sophos Mobile Security on it (from the Play Store) and ran it several times over last few days. Each time it shows some files that it either says are malware, or PUA (Potentially Unwanted Apps). It allows me to delete most of them.

But for two, there are problems. One is called UC News and keeps coming back, even if deleted. Another is com.android.syshandler. For the last one, there is not delete option. It just says that it is PUA: Adware (PUA = Potentially Unwanted App). When I click on it, it says "Potentially unwanted app: Android Ewind (Adware) identified." And goes on to list many more points about it, all negative or indicating potential for harm to the phone.

E.g. the first point says:

"A type of app which may also include third party packages, whose primary purpose is to deliver advertising content in a manner or context that may be unexpected and unwanted by users."

It has a "More Details" link but when I touch that, it opens what seems to be the stock Android browser (instead of Chrome) and that goes to a URL that gives a 404 Page Not Found error. Unable to copy the link to open in it Chrome or to paste it here.

If any more details are needed in order to suggest any steps, please let me know.

Thanks in advance to all who reply.

Edited two days later to add more new info:

  • More unwanted ads and also apps have been popping up - some even during scans of the phone using anti-malware software - both before and after installing the other two anti-malware software mentioned next. I also installed MalwareBytes's Anti-Malware (MBAM) as one of the commenters here suggested. It worked to remove some infected files but could not remove two - Activation Tracker (file: /system/app/ActivationTracker/ActivationTracker.apk - which MBAM reports as being infected by Android/Trojan.Spy.SmsThief.de) and Install Helper (file: /system/app/OLXHelper_v2.5_Lava/OLXHelper_v2.5_Lava.apk - which MBAM also reports as being infected by Android/Trojan.Spy.SmsThief.de). The two infected files it could not remove appear to be in a system partition on the phone. Then also installed Kaspersky anti-malware and ran a scan with it. It also could detect and remove some, but not others. I think the system software in the phone has also been corrupted, because, e.g. Kaspersky or Malwarebytes anti-malware give a security warning about the setting for allowing installation of packages from third-party sites being set to Yes/On. When I change it back to No/Off manually, after some time it goes back to Yes/On on its own - which seems to indicate that malware apps are actively changing it back to that.

Edited again: Also, now, once in a while, apps with names like CrazyRacer2 and Super File Manager (or similar name) are popping up without my installing them. I am exiting them each time. But they appear again.

  • Not an answer but my reputation is too low to comment: Does it say in what folder Android Ewind (Adware) is installed? Have you tried Malwarebytes Anti-Malware from play store? – kirodge Nov 12 '16 at 21:21
  • 1
    I don't know about the second, but for that "UC News": have you checked whether you have other apps from the same dev installed? AFAIR there was a browser going by the name "UC Browser" reported to be "suspicious" in many places. – Izzy Nov 12 '16 at 21:22
  • @kirodge: Thanks for the reply. No, it does not say which folder Ewind is in. I do have a File Manager app, but IIRC it does not allow me to view any arbitrary folder - only some standard ones. Will try some other Manager app. Not tried Malwarebytes Anti-Malware, but will check it out after your suggestion, thanks. – Vasudev Ram Nov 12 '16 at 21:38
  • @Izzy: Thanks for your reply. No I don't have any other apps from that dev or company. I know what UC Browser is but do not have it. I think it may be from the same company. Will check that link you gave, thanks. – Vasudev Ram Nov 12 '16 at 21:40
  • 1
    @DanBrown: There seems to be no effect yet on the phone app - but who knows. In fact I will check that to see if it works okay. The device is a Lava A79 Android phone with Android 5.1. Indian make. Was working okay until this recent issue came up. But I had noticed some symptoms a bit earlier, like slowing down of the phone, maybe related to the malware. – Vasudev Ram Nov 14 '16 at 22:16

Unable to comment because of low reputation: Did malwarebytes indicate which files the malware resides in? (.apk)

And about UC News - those are notifications from the application UC Browser. You should be able to get rid of those by either uninstalling UC Browser or by blocking notifications for UC browser.

  • Yes, see above in my original post which I edited to add that and other info. – Vasudev Ram Nov 14 '16 at 22:34
  • 1
    Sorry, but I can't tell if ActivationTracker and OLXHelper are really infected or if you are looking at false positives. Regardless, the remaining issues indicate that your device is still infected by something. Best bet, as Dan Brown suggested, might be to try to get hold of a clean ROM. – kirodge Nov 14 '16 at 23:03
  • Thanks, I get it. Will write to the phone vendor about getting a clean ROM. – Vasudev Ram Nov 15 '16 at 15:10
  • Re. "Sorry, but I can't tell if ActivationTracker and OLXHelper are really infected or if you are looking at false positives" --- One of the anti-malware I ran, identified the two files mentioned (in the /system/...) folder, as being infected with a malware called something like Spy.SmsThief.de . So it looks like it is not a false positive. Just FYI. Any tips on where to look for clean ROM? – Vasudev Ram Nov 15 '16 at 20:48
  • Oops. Sorry no tips. I can find a few sites having stock rom for Lava A79 if I google. But since I don't know if any of them is trustworthy i can't recommend any of them to you. Perhaps you can ask a new question "Where to find stock rom for Lava A79, and how do i install it?" – kirodge Nov 15 '16 at 22:17

Malwarebytes anti virus app will scan and remove all apps opened by other apps. Not only that, but you can turn it off if you don'don't want it to run. Otherwise, it constantly scans your device for malware and notifies you.

  • I installed the Malwarebytes Mobile Security app. It did a scan and found two malwares. When I said to delete them, it says "Uninstall successful". I had Sophos running too (as said in original post above). So I uninstalled Sophos and ran the Malwarebytes Mobile Security app again to scan the phone. It again detected the same ones but was again unable to delete or uninstall them. Had also tried rebooting and then scanning. Any ideas? – Vasudev Ram Nov 13 '16 at 20:45
  • Sorry, replying to my previous comment above to correct a typo: Instead of: "Uninstall successful". , I meant that it says, UNsuccessful. And that happens for both the malwares it found - which are Activation Tracker and Install Helper as said in my edit to my original post above. The file system paths for those paths are also mentioned in the edit. – Vasudev Ram Nov 14 '16 at 22:39

Not the answer you're looking for? Browse other questions tagged or ask your own question.