1

I have been recently concerned about a malicious software on my phone, basically - the trojan/virus acts silently in the background, it increases battery drain, gives regular (and system apps) overpowered permissions and installs 'icon' programs that are a link shortcut to a possibly malicious website which I would rather not like to open.

The built-in browser is like an infected zone in which I do not go because its filled with ads, fake 'virus' warnings for every site I open.

Some of the recent 'icons' that have been downloaded are named 'loopscoop' and a what seems to me - possibly named Japanese or Chinese game, can't really tell by the letters. Here are the images.

INFO: Factory resets did not work, nor did Malwarebytes or any other antivirus detect it. It's a VIVAX FLY 3 phone.

1
  • 1
    We need a bit more info. Specifically, which apps have you installed before this started? Any apps installed form outside Google Play?
    – tlhIngan
    Feb 7, 2018 at 0:00

2 Answers 2

2

Those malwares install as system apps and cannot be removed by uninstalling as regular apps, even hard resetting won't get rid of them. The only solution is either to flash the whole phone or manually remove the aps with ADB shell but root privileges is a must. You need also to know the package name of the app.

  • Root your device

  • Install USB drivers for your device

  • Install BusyBox (adds extra commands that help with sticky malwares that even root can't uninstall, such as those with immutable attribute...)

  • Install Minimal ADB and Fastboot

  • Enable USB debugging (Settings > About > Hit 7 times on build number > Back in settings > Developer Options > USB debugging)

  • Connect the device with USB cable then open minimal ADB and Fastboot.

  • A Windows terminal should comes up. type adb devices : Displays some serial numbers which means the phone is detected.

  • Type su : To get root privileges. Check on the phone screen for any prompt.

  • Now mount the file system as read-write: mount -o remount /system rw

  • Now go to the app folder: cd /system/app then list all installed apps: ls

  • Now simply delete any suspicious app with rm malwareName.apk

Note: You may encounter with malwares that refuse to be unistalled. This is where BusyBox comes to the rescue.

  • First check for their attribute: lsattr

  • Those which can't be removed should have the immutable attribute, therefore even root cant delete such file.

  • Clear the immutable attribute : chattr -i *.* or specifically chattr -i malwareName.apk

  • Now you should be able to remove that malware.

Hope this helps you.

2
  • Would using TWRP (custom recovery) to completely wipe & reformat the system partition & install LineageOS or a stock ROM suffice?
    – Jonathan
    Jan 22, 2019 at 20:36
  • 1
    Yes, that would suffice
    – esQmo_
    Jan 22, 2019 at 20:39
0

WARNING: This method is highly technical, and requires finding a precise compatible ROM first, and will erase everything on the phone, and may cause bugs

Use Odin (or heimdall --flash) to load TWRP on the device, boot into recovery mode, wipe everything, format the system partition, and use adb to sideload a the specific stock rom for your device (or, my preference, a compatible lineageOS rom+pico gapps) on it. You may need to reconfigure you APN to make sure MMS still works aftewards. Continue at your own risk.

1
  • This is a bit radical if I may say :D but would work. You don't need adb to push file or sideload the zip,you can install it manually by enabling MTP then copying to an external memory
    – esQmo_
    Jan 25, 2019 at 9:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .