2
  1. I dont know which pre-installed app is auto installing new apps. But I think its com.android.system.service (also on few other phones: http://en.miui.com/thread-459132-1-1.html)
  2. Firewall is not supported for this old OS phone (I think its gingerbread)
  3. Also No root available for my phone. I also tried all auto rooting apps for android and PC.
  4. Because its old Android OS, there is no option to disable any pre-installed app.
  5. I think antivirus is deleting only few harmful apps which are downloaded by pre-installed malware app.

The malware app is downloading apps to a hidden folder (.sysAndroid/Download) in sd card, I have no threat to my internal memory because its full.

How to make a folder on sd card unwriteable without root or with any trick? like making a fake folder with same name to stop virus app from saving new apps in folder again(.sysAndroid or Download)

Or any other method?

Improve this question
1
  • What phone model is that?
    – esQmo_
    Mar 30, 2017 at 12:52

1 Answer 1

Reset to default
1

First, you could make that folder "un-writeable" easily without rooting. As it's located on the SD card, and you're on a pre-Kitkat device, any app should have full access there:

  1. Get yourself a file manager
  2. navigate to /sdcard/.sysAndroid
  3. delete the Download folder
  4. create a new text file called Download, and make it read-only

Now, that malware app can no longer create the directory, as a file with the same name is in that place.

For other measures, we'd need more details (and I could update my answer then):

  • go to Settings › About Phone and check what Android version is running on the device
  • find out which app is installing the unwanted apps. I didn't test it with pre-Icecream devices, but my tool Adebar should be capable of that¹: Among other things (which require at least Kitkat), it creates a list of apps installed on the device, grouped by their installer (see here for an example: as you will notice, the package name of the installer is noted along). If your Android version indeed is older than 4, you most likely will not be able to "kill" that app, but other measures might be known.

¹ Adebar will require installed on your computer, and Bash being available – so a Linux machine is best suited for that. But it's reported to work well on a Mac, and even on a Windows machine running Cygwin.

Improve this answer
6
  • The file trick worked. I can't check android version in "about phone settings" because phone manufacturer edited that text to a later version which is fake. Phone interface, gallery looks like its gingerbread.
    – proseosoc
    Apr 1, 2017 at 9:35
  • OK, that makes it harder. Icons in the notification bar are green I guess? Well, as the file trick worked for you, the original issue seems to be solved. Though it would still be interesting to hunt down the culprit. Who knows what else it has in cue. If you're interested in that, I'd suggest you ask a specific question on it (a la "how to identify the app which installs other apps on my device"). We could check Adebar's "ADB tricks" on that manually then (after all, it's just executing some ADB commands and evaluating the results).
    – Izzy ♦
    Apr 1, 2017 at 9:42
  • malware app is not downloading new apps but still auto installing 1 app again and again without any visible downloaded apk (I check all apks from default file manager > Apks). What should I do now? Thanks for your help!
    – proseosoc
    Apr 1, 2017 at 13:21
  • Have you tried Adebar yet, to find out which app is performing those installs? If so, is it a system app or one you've installed yourself?
    – Izzy ♦
    Apr 1, 2017 at 17:45
  • I am using phone setting to install apps only in internal memory, so malware app can't install new apps on sd card but in internal memory. Because I thought problem solved I cleaned internal memory but after I know it can still install a new app in internal memory I again filled internal memory. Now again phone is working better. I am 100% sure that it is a system app because I already checked by uninstalling every single app installed by me. Now should I use Adebar ? (My phone is gingerbread with a preinstalled malweare app)
    – proseosoc
    Apr 2, 2017 at 16:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .