1

Every time I restart my Xolo Era 4g, Android 5 Lollipop phone, it auto enables "allow installation of apps from unknown sources" option. I switch it off manually, then in a few seconds, a pop-up for an unknown app to install shows, and on the background, the "unknown sources" button automatically toggles. This keeps on going forever. I haven't rooted my phone and have factory reset it many times.

I first installed an antimalware app, and when I run it, it found around 16 malware, of which I deleted 14 but there was no option to delete the last two. Then I installed the notification app. I restarted my phone. After that, the internet automatically started. I immediately switched it off. Then I went to settings and switched off to allow unknown apps installation.

Then I opened the menu and slide it a few times and the malware attacked again. Opening the settings disclosed that an unknown app installation is switched on. Many apps are promoted for installation. After pressing cancel around 50 times, I went to the menu again and many new apps were installed. I have repeated this scenario two times once I switched the internet on. But with the internet off, I saw an app installation prompt too. I don't remember with the internet off whether the apps got actually installed or not.

Now I opened the notification app and it showed one process having some text similar to Andriod UI lolipop 5.0, it had a lollipop icon to its left. On clicking on that, it further showed one process. The process was related to the notification app itself and had text "toaster" or maybe "toasted". Now I have factory reset my phone again and have uninstalled all default apps like Flipkart, Snapdeal, Paytm, UC browser, etc. Now if I'll again restart my phone, the virus will start again.

Please tell a method to not allow any app to toggle the "unknown sources" options on without rooting the phone.

Improve this question
2
  • 2
    Install notification history or Toaster to track down the culprit app that is triggering this - if it is due to an app. Other possibility is that device is already infected with malware and this is triggering it. Run Malwarebytes to check that and update your question with findings
    – beeshyams
    Mar 20, 2017 at 10:22
  • In response to your comment "I think the virus didnt show off after I upgraded to Android 6, or may be the virus couldn't turn on the unknown sources option thereafter", I am glad that your problem is resolved and would suggest you to post and accept that answer since that may help others. I am deleting my answer, in favour of a working solution
    – beeshyams
    Aug 12, 2017 at 1:47

4 Answers 4

Reset to default
0

Go to setting / security / Turn off unknown source. Allow installation of app from unknow source.

Turn on App permission. Go to setting / security / Turn on app permission.

check which app using more battery. Remove unwanted apps.

Also turn off developer option.

As your mobile is infected. You can use nortran, panda or Avast antivirus. You can connect mobile to computer and scan it. Take back up of mobile and restore it.

Improve this answer
0

This also happened to my phone. Even after several flashes, the torrent of annoying self-install apps keeps happening. Malwarebytes I used can't touch the last infected file; the system settings itself. Even right after flashing the third time, apparently the settings app which is the backbone of everything has been compromised from the get go.

My findings suggest that this was a known vulnerability issues and Google acknowledge it. Alas, there are still no solution nor updates to rectify it other than suggest user to stop using the phones that use 5.1 altogether. FML.

So, out of rage, I took drastic measure. I delete the settings app with the help of Root Explorer. Of course, I've made certain preps before I did, since I'm fully aware the consequence once I did.

Now, I can't even connect my phone to my PC via USB, nor I am able to log in a new Wi-Fi spot. A price I pay just to save my data cap from being drained by involuntary app download.

Improve this answer
1
  • That's not helpful to the OP, who is looking for a solution "without rooting the phone".
    – Dan Hulme
    Dec 13, 2017 at 11:32
0

Factory reset your phone. That will remove the malware.

Improve this answer
-4

Switch off make passwords visible button as well as unknown sources. This stops unknown sources opening by itself.

Improve this answer
2
  • This post does not contain enough information to be considered an answer. How did it solve the issue? Where to find it? What are the steps to perform?
    – beeshyams
    Dec 13, 2018 at 17:45
  • 2
    This is not making sense. Why would "make password visible" have anything to do with "unknown sources"? Consider explaining that.
    – Firelord ♦
    Dec 13, 2018 at 17:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .