0

If Device maintenance app is launched in Samsung S8, after pressing Clean Now button, storage cleanup briefly shows different apps, storage space of which is being cleaned:

System cache
OneNote
TopBuzz

Actual view visible for about 2 seconds:

enter image description here

I know that the last one is not among installed apps (when checking by name) so it must be part of some other app, but how can I find out to which app it actually belongs? No antivirus which I tried so far reported this as the malware. But maybe there is some system analyzer which shows similar cache ownership like the above app, but with more details?

(Or maybe there is another method how to find origin of that TopBuzz symptom.)

The phone is not rooted.

2

First, I have no affiliation with the app SD Maid.

Without root the app SD Maid can show you the emulated path and name of its public cache of user installed apps.

  • Within the apps settings menu
  • Go to AppCleaner
  • then press the green circle at the bottom right corner to start the scan.
  • Next press the circle on the right with the i in the center of it.

This will show the path and name of the apps public cache.

pic of cache info

Edit: Thanks to darken who is the app developer whom suggested:

"Enable 'Show Systemapps' within in SD Maid's AppControl settings"

"After a scan just search for "buzz", if it is a distinct app it should find something."

"The search will look for both packagenames and app names of all types of apps except maybe instant apps if you don't have root."

I was also playing around with settings.

  • within the AppCleaner settings select show inaccessible items

  • next start a scan within the AppCleaner

  • scroll down and select the i if suspected app shows up

inaccessible AppCleaner picture

This will broaden the scan to show inaccessible app caches. This possibily will help narrow down the probable malicious app.

That is about the best you are going to be able to get without root.

Root access is need to access the apps private cache which is stored within /data/data/.

  • Thank you. At least I can see the cache is not there. Perhaps the Device Maintenance app has access to /data/data you mentioned. – miroxlav Jan 8 at 10:48
  • 2
    Note: SD Maid app currently crashes on longer scanning process. A workaround is to switch to another app after starting the scan and then the scan is able to finish normally. – miroxlav Jan 8 at 10:49
  • Further research: identical symptoms are present also in the safe mode. After all, can TopBuzz be a built-in thing? – miroxlav Jan 8 at 21:57
  • 1
    Enable 'Show Systemapps' in SD Maid's AppControl settings and after a scan just search for "buzz", if it is a distinct app it should find something. Search will look for both packagenames and app names of all types of apps except maybe instant apps if you don't have root. (sd maid dev) – darken Jan 11 at 8:25
  • @darken – perfect tip... you probably meant Settings > AppControl > Include System-Apps ...and the "buzz" was not found. I wonder what tricks are played here by system. – miroxlav Jan 11 at 16:28

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.