On my year-old BLU Advance 5.0 HD phone (running Android 6.0), I recently had a few suspicious incidents where the Audio Profile seemed to have changed from Meeting to Normal on its own, and once where the phone started playing music by itself (and not anything that's on the phone). At this point, I noticed three strange entries in the apps list: "androidrbx", "mfn" and "swak news" (all lowercase), all with generic icons. I have never installed anything of the sort, and the swak news one had all kinds of app permissions, which I had not granted. I deleted all three, but they were back the next day. Repeated this for a few days then figured I had malware and did a factory restore.

On the fresh install, the only additional (Play store) apps I added were Safari Queue and Duolingo, which I hoped were fairly trustworthy. No reappearance of the above trio until today, after an update of 6 apps — 5 being Google system apps (Calculator, Keep, Android Messages, Gboard and YouTube), and the last being Duolingo. Now they are back. I foolishly did all the updates at once, so I can't pinpoint the culprit (although Duolingo obviously seems most likely, unless one of the Google apps somehow got corrupted).

So now I'm trying to gather some intel from those who have more experience with the platform before I continue on the tedious process of trying to isolate the offending app or update. (If there are better forums, please point me there.) My main question is whether this is known malware, or at least has the hallmarks of such? I have searched and found no references to any of these names (except for a seemingly legit but different Swak News app), which surprised me, but perhaps the names are randomly generated. If these are legitimate "helper" apps or something, I would like to know to which app they belong, but they seem awfully suspicious to be such.

  • Not a virus (no such thing on Android), but definitely smells for some malware – which even might have managed to convert itself into a system app, so only flashing a clean ROM would safely get rid of it. Might also play "sleeper" after the reset waiting for updates or some other events, to make it harder to spot. You could try fresh again, and not accept any updates for a week (plus after that, only applying them one-by-one starting with the "most trustworthy"). I'd suspect none of the named candidates, Duolingo included. – Izzy Jan 12 '18 at 18:00
  • You're right, @Izzy, I used the wrong term. Was going to edit my post, but you beat me to it! Done now. Your assessment is what I suspected, but I've already done a factory restore and limited installs and updates, though I got careless with the last batch, since they were all Google system apps, save for one. But I'll start over if there's no other likely explanation. – big_m Jan 12 '18 at 19:35
  • Thanks for the update! Though you still missed one "virus" :) And as I wrote: if it's really a malware that managed to convert itself into a system app, factory reset won't get rid of that. You'd really need to flash a clean ROM then. I still very much doubt one of those apps is the culprit: we'd heard many more people crying then. Not only for the GApps involved; Duolingo is a well established software, too. Though I've not heard it came pre-installed on any device; so make sure to check you didn't catch a fake/clone with that one. – Izzy Jan 12 '18 at 22:02
  • 1
    Update: "mfn" and "swak news" have come back 3 days after a factory restore, even though I've turned off all updates and have nothing but the factory apps. ("androidrbx" has not returned yet, though.) So looks like @Izzy was right about the sleeper mode. So now the question is whether they are part of the restore image or somehow attached to the boot loader (or whatever it is that remains to do the factory reset). – big_m Jan 19 '18 at 17:22
  • 1
    @Izzy: There was an OTA update, but my recollection was that it was a month or two earlier. I hadn't installed anything recently when I first noticed the problem, but the malware activation could have been delayed. I will look into the clean-image route; not something I'm familiar with, and I don't know how to find a trustworthy source for the ROM. (There's nothing on the BLU site.) – big_m Jan 22 '18 at 1:59

protected by Community Jan 17 '18 at 7:50

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Browse other questions tagged or ask your own question.