2

My father said to me that he allowed installation of apps from unknown sources when he was asked to do it to go further with something (he said that he don't remember when or what he was doing).

In android 8.0 (the version of his smartphone) we can allow third-party installation in individual apps, so I went in this tab and I saw that only Google Chrome was able to do this type of installation. So, I navigated through my father's apps and found nothing suspicious.

When I went to files, I found a folder called didi. Inside, a file with no extention called psnger_encrypted or something like that. When I went to select the file to see details, I accidentally clicked on the file. Android said to me that it didn't find any app to open that file.

Could a file have been executed even when Android says that message? If this file is malicious, is it possible that it was executed and so infected the phone?

Doing some research, I found that a Chinese app called "DiDi" that have a file called "psnger" too. Also, I found a file in my father's phone called .omega.key, and this file is also seen in topics related to DiDi app. The fact is that I can't find this app on the phone, and I'm looking for ways that can indicate if the phone have any malicious content. I executed AVG, and Malwarebytes but both detected nothing. What else can I do?

4
  • What is the security update status of the device (which date - shown in settings)?
    – Robert
    Mar 31, 2019 at 15:29
  • @Robert, any recommendations?
    – Mycroft
    Mar 31, 2019 at 21:05
  • Is that phone rooted?
    – Puspam
    Apr 1, 2019 at 9:41
  • No, the phone is not rooted
    – Mycroft
    Apr 1, 2019 at 16:43

2 Answers 2

2

The correct approach in case of a virus/malware infected device (even if it already had been clean-up by e.g. Google) is to totally erase the device (user and system data) by performing a factory reset and re-flashing the complete firmware.

Virus scanner apps are next useless on Android as they usually don't have system access. And even with system access it is still easy to hide from Antivirus software.

The main problem is that the security patches are more than one year old. Therefore a malware app could have exploited the device and installed itself into the system. Therefore there may be still active components in the system that are invisible to you and any antivirus software.

I would also not to hurry up to get the device back in a usable state. People (especially relatives) learn better not to click on everything they see when there are negative consequences.

8
  • Can a malware infect Android OS even if the OS isn't rooted?
    – Puspam
    Apr 1, 2019 at 9:40
  • 1
    @Puspam Yes, this is possible if your device is vulnerable to an exploit that allows to execute code with root permission. Therefore I asked for the security update status.
    – Robert
    Apr 1, 2019 at 11:40
  • Thank you for your advice, but he is my father and he use smartphone for work. Re-flashing is not a option since I can not take his smartphone for a long time. Is there anything else that you recommend?
    – Mycroft
    Apr 1, 2019 at 13:00
  • 2
    There are two options left: "buy a new phone" or "do nothing and pray"
    – Robert
    Apr 1, 2019 at 14:20
  • 1
    @Mycroft Looks I have to limity my last comment. This is only true for the Android system itself. Loks like the apps are the real security problem: Hundreds of popular Android apps have open ports, making them prime targets for hacking
    – Robert
    Apr 2, 2019 at 8:08
2

Android is a minefield for trojans, adware and viruses. Your android phone can be compromised from the moment it comes out of the box (most of mine are) (depends generally on where purchased and what comes installed).

If you want extra visibility on your phones networking then you can download NoRoot firewall or similar and that will help you see what connections are active and give you further layer of control.

I have also found generally that antivirus apps are not particularly effective.

1
  • In case you buy a "china phone" the Android device may be already infected when you open the box (Android device infected in the production facility).
    – Robert
    Apr 3, 2019 at 7:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .