2

I have a OnePlus One running the latest version of OxygenOS which is rooted for the sole purpose of running CF lumen. I have not installed any other root apps, and only use the Play Store for downloading apps.

Recently, I got two superuser requests in quick succession from an app called Zygote.

As another answer had suggested, I checked for any rogue apps with adb shell ps | grep zygote but only one process was listed. So there doesn't seem to be any malware masquerading as zygote.

image

Scans from Malwarebytes and Kaspersky didn't turn up anything either.

I haven't got any other superuser requests from zygote since this first happened about a day ago.

What's going on?

Improve this question
3

2 Answers 2

Reset to default
1

Do you have Xposed Installer and various modules installed? As I understand it, several xposed modules will use the zygote root process and most likely benign.

Improve this answer
0

"Zygote" is the root process of all app processes in Android. When you start an app, Android forks (https://en.wikipedia.org/wiki/Fork_(system_call)#Overview) this process instead of creating an entirely new process for this app.

There is often a "soft reboot" option in custom ROMs, which doesn't do anything else than killing and restarting the Zygote process and therefore killing all other processes as they are only forks of the zygote process.

To come back to your question: I don't know which super user app you use, but maybe it contains a bug or has been unproperly configured, because zygote should normally get root access without confirmation.

Improve this answer
2
  • 1
    I use SuperSU. When I first got the Zygote request, I first suspected malware, but now I think that it may be an isolated bug in the SuperSU app that pops up very rarely. Since that one time I haven't got any other superuser requests from Zygote. Is it possible that this is just a bug?
    – Vikram
    Commented Feb 8, 2017 at 6:20
  • 1
    It is possible that this is a bug. But it's possible that this is malware, too. It's hard to say. I would revoke the Root request of Zygote and update SuperSU to the latest version.
    – Timo Schwarzer
    Commented Feb 8, 2017 at 6:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .