Every time I restart my android 5 lollipop phone It auto enables allow installation of apps from unknown sources option. I switch it off manually then in a few seconds a pop up for an unknown app to install shows and on the behind the unknown sources button automatically toggles. This keeps on going forever. I haven't rooted my phone and have factory reset it many times. My phone is Xolo Era 4g.

Please tell a method to not allow any app to toggle the unknown sources options on without rooting the phone, thanx.

Update: I first installed Antimalware app and when I run it, it found around 16 malwares, of which I deleted 14 but the there was no option to delete the last two. Then I installed the notification app. I restarted my phone. After that the internet automatically started. I immediately switched it off. Then I went to settings and switched off to allow unknown apps installation.

Then I opened menu and slide it a few times and the malware attacked again. Opening the settings disclosed that unknown apps installation is switched on. Many apps promoted for installation. After pressing cancel around 50 times I went to menu again and many new apps were installed. I have repeated this scenario two times once I switched internet on. But with internet off I saw apps installation prompt too. I don't remember with internet off whether the apps got actually installed or not.

Now I opened notification app and it showed one process having some text similar to Andriod UI lolipop 5.0, it had a lollipop icon to its left. On clicking on that it further showed one process the process was related to notification app itself and had text toaster or may be toasted. Now I have factory reset my phone again and have uninstalled all default apps like flipkart, snapdeal, payTM, UC browser etc. Now if I'll again restart my phone the virus will start again.

  • 2
    Install notification history or Toaster to track down the culprit app that is triggering this - if it is due to an app. Other possibility is that device is already infected with malware and this is triggering it. Run Malwarebytes to check that and update your question with findings
    – beeshyams
    Mar 20 '17 at 10:22
  • In response to your comment * I think the virus didnt show off after I upgraded to Android 6, or may be the virus couldn't turn on the unknown sources option thereafter*, I am glad that your problem is resolved and would suggest you to post and accept that answer since that may help others. I am deleting my answer, in favour of a working solution
    – beeshyams
    Aug 12 '17 at 1:47

Go to setting / security / Turn off unknown source. Allow installation of app from unknow source.

Turn on App permission. Go to setting / security / Turn on app permission.

check which app using more battery. Remove unwanted apps.

Also turn off developer option.

As your mobile is infected. You can use nortran, panda or Avast antivirus. You can connect mobile to computer and scan it. Take back up of mobile and restore it.


This also happened to my phone. Even after several flashes, the torrent of annoying self-install apps keeps happening. Malwarebytes I used can't touch the last infected file; the system settings itself. Even right after flashing the third time, apparently the settings app which is the backbone of everything has been compromised from the get go.

My findings suggest that this was a known vulnerability issues and Google acknowledge it. Alas, there are still no solution nor updates to rectify it other than suggest user to stop using the phones that use 5.1 altogether. FML.

So, out of rage, I took drastic measure. I delete the settings app with the help of Root Explorer. Of course, I've made certain preps before I did, since I'm fully aware the consequence once I did.

Now, I can't even connect my phone to my PC via USB, nor I am able to log in a new Wi-Fi spot. A price I pay just to save my data cap from being drained by involuntary app download.

  • That's not helpful to the OP, who is looking for a solution "without rooting the phone".
    – Dan Hulme
    Dec 13 '17 at 11:32

Switch off make passwords visible button as well as unknown sources. This stops unknown sources opening by itself.

  • This post does not contain enough information to be considered an answer. How did it solve the issue? Where to find it? What are the steps to perform?
    – beeshyams
    Dec 13 '18 at 17:45
  • 1
    This is not making sense. Why would "make password visible" have anything to do with "unknown sources"? Consider explaining that.
    – Firelord
    Dec 13 '18 at 17:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.