I bought a low-budget china no-brand phone brand: 'WELCOME' model: 'P20 Pro' , and some things seem a little odd.
Before using the phone, I did a factory reset. When I first turned it on before the reset, the phone looked fresh, but there was a user looged in on which had the name Phenix (I didn't know at that point, that there was also this app called Phenix).
There's a custom kernel on my device although I bought it as new. I noticed some minor translation errors which I have never seen on my other android devices (only few, but they were obvious enough to catch the eye). This was actually the thing that made me check the kernel version.
There are several system apps, that look odd to me, e.g. Android Easter Egg, Phenix (which seems to be some Asian social platform or a salesTracker-app.
There are a lot more from which I don't know what they do, but I don't like how permissions are set (the lack of transparency is a thing I hate about modern operation systems like Android).
Does someone know some good lists or websites where to find information on them? Do I really need to root my handy to remove Phenix, which seems to be an active process, that can't be removed for longer than some seconds? I like the hardware very much, but I do want to know what it is doing and I really don't like the idea of running processes on my device which share information over the network. If needed I can provide a full list of my Apps (active, installed, deactived, running).
I already tried to deactivate some by myself, and most seemed to break Google Play Store, so that this app wouldn't work correctly.
Another odd thing is the Google Play Store itself, though the phone seems to be quite powerful, it freezes a lot especially when I click on Install. Many apps won't even install, and one app I installed had asian letters mixed with latin letters under the icon though the game is translated into proper english and I do remember that I had the game before on another device, and there weren't this asian symbols.
Can someone give me some advice on how to judge the situation?
Are there more advanced analysis-tools for android that could help to figure out what is running on my phone?
I heared that rooting a device is not recommended anymore, so I'd like not to do that if possible.
As my phone now, only some days after aquiring it, tries to install apps without me even touching it at that time, and showing ads even though I have already deinstalled all apps in question I downloaded (apart from those standard apps I already know long enough so they shouldn't be responsible), I will go the way and flash a custom rom on it. I think there is far too much odd behaviour for an android-system so freshly set up.
I will update this post once I have done so (might take some days, got some other stuff to do atm)
Can someone provide me with a bug report (developer mode) on a freshly factory-reset Android 8.1? Saw some interesting things in mine and would like to compare with a bug report from a phone that's not a no-brander from Asia.
found com.adups.fota on my phone and some other stuff that stays on factory reset. will definitely put a custom rom on it next week. Have not even finished reading the bugreport. There is also an app called Systemaktualisierung (german), translated: System Update, which cannot be deinstalled in usermode, but can be deactivated. It refers to com.adups.fota. Ads still show up, I receive no more bug reports and sadly I can't install anti-virus software. I definitely not recommend byuing china-phones if you don't want to head straight here or to xda xD
Phenix and all apps that refer to com.cooee.whatever (like phenix, WeatherClock..app and so on) seem to be infected regarding to what other found with malwarebytes and co.
Appended: Apps I consider harmful:
- System Update com.adups.fota* UpgradeSys com.fw.upgrade*
Fota Provider com.adups.fota* packages starting with com.cooee.*
com.mediatek ? Warning: mediatek seems to be needed for the phone to run, do not remove if you don't know what you are doing. - MediaTek seems to provide the chipset, and from what I read, the firmware might be infected. Most infected china phones seem to run on MediaTek.
- com.zhuoyi.* Not showing up in the GUI
- Facebook com.facebook.* why? because it shouldn't even be there, not showing up in the GUI!
- twitter com.twitter* See Facebook. Yes. I dislike both anyway.
- FreeTouch com.ibao.c this one was registered as admin
- com.higua.changesalecount I think this one might be salesTracker
- com.kpsh* seems to belong to com.cooee* and is not listed at packages, but at the processes
malwarebyte-scan detected this:
- Google Serv (sadly I did think this belonged to Google
- Clean Weather Clock (com.cooee)
- UpgradeSys (com.fota)
- Phenix (com.cooee.phenix)
and two on my SD-card:
At the moment I am not sure if I even got the real Google Play Store or whether it is a fake one. The icon is green, not like the colorful one. I thought that this was due to the custom rom. As stated above, it doesn't behave quite as I am used to it behave, so the alarm flag is raised there still. As I want to discover the infected phone a little more before I fix it, I'd like to find out, how to discover what Store I really got.
--- Update ---
Packages that needed pm uninstall -k --user 0 $PACKAGE because they threw
after pm uninstall $PACKAGE
After deleting ClearWeatherClock I ran into a looping prompt that prevented me from using the device. You need to reboot the device, which meant on this model that I had to press the powerbutton for almost a minute since anything else wouldn't work.
Package I am not sure if it is safe to delete
You can hide it with pm hide leaving you without a desktop manager.
Packages that could be deleted with a simple pm uninstall without root
Update April 29:
Using the phone after diabling all these packages did work for some days. Just like the first time I put the phone in use it worked something similar to fine for the first week, which means the motion sensor didn't recognize some horizontal line about a centimeter thick in the middle of the screen and completely failed on rotation plus the battery percentage went a complete mess (staying at 100% very long, then falling rapidly); but apart from that the phone worked well and the battery endured much longer. Sadly, some hours ago the phone decided to not recognize my unlock pattern anymore and I could see on the lock screen that abo sms started again, just like last time. At this point, where even the motion recognition seems to have some dependency on obvious bloatware, I am no longer willing to try to make any use of this phone. Correct me if I am wrong and missed a thing.
Pressing Volume UP and Power brings me to some non-standard-android menu that allows me to select recovery, fastboot and normal; recovery leads to an android warning saying "No command", whereas fastboot leads to a freezing screen. The normal-option works.
I eventually managed to get into the Factory mode. It is possible to enter Test mode, which was quite interesting to see, but no factory reset option here, either. Some tests are poorly implemented from what I can tell by the output. Sadly had to leave it as the key test was impossible to pass or go back as the device has no home button but requires it to be pressed. Still trying to reconstruct how I got there.
Randomly pressing Vol Up and Vol Down during the "No command"-screen led me to the factory reset menu (some more options). Can't tell the exact kreystrokes though. Glad it is possible. Phone has all packages back I removed with adb uninstall, as expected. The motionrecognition is still the same mess though. At least I could figure out now that is has seemingly complete random offset to any direction. Don't know if that has anything to do with what I did with it or if it would have happened anyway.
Will make some wireshark tests later.