6

My phone randomly shows the Download Manager downloading "Google play". I usually cancel this download since it seems fishy to me, and that's what my question (asked below) is about. Since this sounds all too common and like many questions posted here, let me clarify what this is not:

  • This is not a download within the Google Play store.
  • All apps are up to date in my play store.
  • My OS was recently updated to Oreo (Samsung Galaxy S8).
  • All my Samsung apps are also up to date.
  • As far as I can tell, I have set all updates to happen only on wifi, not on mobile data connections.
  • The download is happening via Download Manager. Long-press etc shows me info about the default "download manager" app itself, not about what it is trying to download.

This reeks of malware to me, wherein some shady app might have just named itself "Google Play" so that I allow it to be downloaded and run it. A malware scan shows nothing (of course, I aborted the attempted download so that file was not scanned, but there seems to be no trojan trying to download more stuff) My questions are:

  • Has anyone seen this issue? Is it a regular deal, so that I should just let the phone do what it wants?
  • If this is "business as usual", how do I set it to happen on wifi and not on mobile data?
  • If this seems suspicious, what steps could I take to further investigate / remove the problem?
  • Have you enabled instant apps? If so, could be download of that – beeshyams Mar 9 '18 at 8:32
  • I'd never heard of instant apps, but just found that they were enabled. Just disabled them, let's see if the problem recurs. It did not show me any "recent instant apps" though. Also, this is a download that starts without any interaction from me (i.e. I didn't click something new which would need the use of an instant app to preview, etc). The phone was lying there, and I picked it up to notice a random download. Multiple times. – VBB Mar 9 '18 at 8:40
  • 1
    Read about instant apps. Play store and instant apps download happen without user intervention. Being system apps they are automatically downloaded. There's a question around this too on the site. – beeshyams Mar 9 '18 at 8:46
  • 1
    Also install this app. Check under com.packageinstaller in the app to see what's been downloaded and update your question – beeshyams Mar 9 '18 at 8:54
  • 1
    You could use a network monitoring app like Network Log or Privacy Friendly Net Monitor to find out which URL (or at least which server) is accessed by which app (probably the download manager). That might help narrowing it down. – Izzy Mar 9 '18 at 10:12
0

Update: I have seen this happen many times by now, and typically right before other apps are updated. I have concluded that this is normal behaviour, just like microsoft office auto-updater updates itself first before updating office itself. If anyone knows otherwise, please respond!

(Posting as an answer, because it seems a lot of people have this issue based on how many views this question is getting!)

0

Hmm, I had the same activity on my samsung galaxy j1 a couple months back despite the fact that all the apps were updated, and as you said it started downloading apps via the download manager. Recently an android vulnerability named strandhogg was discovered which potentially spreads via the google play store.... sources:

  1. https://m.youtube.com/watch?v=plP96fPJSa4
  2. https://m.youtube.com/watch?v=ED_xOP2WNXg

Hope this helps "To whom it may concern" into further digging (:

Not the answer you're looking for? Browse other questions tagged or ask your own question.