3

I have been trying to solve a malware problem for the past couple days in a certain chinese phone (Android system version=6.0), the problem I am facing is that a malware keeps being reinstalled even after uninstallation, I have tried a couple of methods to no avail.

First, I tried uninstalling using the pm command, rebooted the phone and the problem was gone but as soon as I was connected to the internet the malware was installed again. I didn't want to touch the system at first so I tried to start a fresh and performed a factory reset. I tried using the internet again and I was back to square one, this time with more than 5 malware apps installed. I checked the installer package for the malware packages using pm list packages -i and all I got was installer=null so I couldn't get the app responsilble.

After this I was sure the problem lied within the system so I took fresh system images from 2 different factory ROMs and flashed them separately to the device each time performing a factory reset before switching the phone on and believe it or not when I connected to WiFi again the malware apps were still reinstalled.

I then tried capturing the traffic using Packet Capture in hope to see what app was responsible for downloading the malware, for the entire time of the packet capture session (about 1 hour) I was using internet without seeing any malware, I stopped capturing packets and after a period of 5-6 hours of using internet the malware problem began again. At this point I have really tried everything I know to spot the culprit app that installs the malware and I have run out of options, so is there really a way to get what process or app that caused silent installation of a package or should I just admit defeat and move on?

Here is a list of some malware package names:

com.yunshi.market
com.app.dov
com.glb.compass  
com.loee.lv 
com.androidapp.filemanager
9
  • Raw idea (untried): Capture the broadcast receiver for PACKAGE_INSTALL and PACKAGE_ADDED (should be doable with Tasker), then let that trigger a logcat dump to file. Investigating that dump it should be possible to find what triggered the broadcast. As said, raw idea and not tried, so I cannot give a detailed step-by-step guide to it or guarantee success.
    – Izzy
    Dec 15, 2017 at 13:04
  • It might try then, but still keep its own records out of the log (still, it won't be able to suppress entries from other apps (here: PackageManager) unless having root powers.
    – Izzy
    Dec 15, 2017 at 14:49
  • I have a hunch that it might be a modified system app in /system/priv-app that is doing this but I have no way to verify it yet, as logcat seems to make the culprit app dormant somehow
    – AguThadeus
    Dec 15, 2017 at 14:56
  • 2
    Wouldn't it be strange that the very same app should be present in different ROMs? Unless those ROMs are all by the same dev, that is. Maybe you should edit your question and include which device, Android version and ROM it is about?
    – Izzy
    Dec 15, 2017 at 14:59
  • Have you tried identifying apps with permission android.permission.INSTALL_PACKAGES?
    – Firelord
    Dec 15, 2017 at 16:08

0

You must log in to answer this question.

Browse other questions tagged .