-1

My device has Android 7.0. I believe my device is affected with some malware.

Symptoms:

  1. Pop up ads in the middle of the screen. When I click on the close button, it starts downloading random apps.
  2. Sometimes uninstall UI appears to be changed and when it says "Uninstall successful", I click the OK button and it starts downloading random apps.
  3. I uninstall suspected apps, but somehow it comes back.
  4. Even if I uninstall suspected apps, it still shows me ads.

I've turned off unknown sources, but somehow it still gets installed.

Suspected apps:

  1. Clock (there are two apps named clock)
  2. Application.app.sdk2.config

I don't want to reset my phone except as a last resort. How else can I remove the malware when uninstalling doesn't work?

  • Have you tried a factory reset? This should work unless you restore from backup or the malware has somehow installed itself to the system partition. – Dan Hulme Apr 17 '18 at 15:57
  • I don't want to reset my phone, that's why I asked the question here. Resetting should be the last option. – surjit Apr 17 '18 at 16:49
  • Given that you've observed this malware come back after you tried to uninstall it, I think resetting is the only way you'll be able to trust this phone again. – Dan Hulme Apr 18 '18 at 8:22
1
  1. Backup your contacts and media files. Backing up contacts to your Google account is the best way, your media files can be backed up on your computer.
  2. Do a factory reset Depending on your specific model instructions will vary. You need to enter the "recovery menu," which involves first turning your phone completely off, and then holding a specific key while pressing power. It's usually one of the volume keys. Then navigate the menu using the volume keys to select factory reset.
  3. Only reinstall apps from the Google Play store. Yes, there's plenty of cool apps and games that are not in the Play Store. If they're not in the Play Store, they are likely doing bad things.
  • General the right advice (+1) – but there're apps even on Playstore "doing bad things". Just "being on playstore" doesn't mean they're "safe" – though of course changes are much higher getting something bad from "some website". Make that "only install apps from F-Droid", that'd lower the risk pretty close to zero :) – Izzy Apr 12 '18 at 18:55
0

There are two ways to do it.

METHOD 1: Uses adb tools.

  1. Download ADB Tools from Google. On Linux run sudo apt install adb.
  2. Enable "Allow USB debugging" in Developer options in Settings. If they aren't there, go to About and tap Build number 7 times.
  3. Run adb devices and select "Allow" on your device when it asks you.
  4. Run adb uninstall (package name). (package name) is not the name of the package (that is the label). It is , for example, com.android.clock for the system Clock app.

METHOD 2: Requires root.

  1. Root your device. One-click root options like KingRoot exist, but only for Android 5.1.1 or below. In your case, you will need to use custom recovery to gain root (do-able with TWRP and SuperSU, for example).
  2. Install Lucky Patcher from luckypatchers.com/download. If i says it is a virus, tap "More Options" then "Install Anyways (Unsafe)".
  3. Allow root access, and then find the apps you suspect are viruses. For example, in the case of the Clock apps, don't uninstall com.android.clock or com.google.android.clock.
  4. Find the app. If it is adware, it will usually say "Google Ads found" in blue under it (Keep in mind many genuine apps use Google Ads, too). Tap the app, and then select "Uninstall".
  5. Afterwards, uninstall Lucky Patcher with the system package manager, and select "Permanently unroot" if you don't want to keep root.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.