3

So I have been working on my brother's Elite 6.0l+ Sky device. This poor thing has been struck by the xhelper virus which auto installs firedoor, firemyn and an app that likes to hide itself by appearing to be settings.

I have been chasing this malwares source for a couple of weeks and through a ton of trial and error I've discovered that disabling the playstore seems to keep the malware from being reinstalled. However, if I re-enable the playstore so I can grab a game or check for app updates, the malware is immediately re-installed on the device.

I have also discovered that the device itself is apparently known to come with pre-installed problems (SKY/x6069_trx_l601_sky/x6069_trx_l601_sky:6.0/MRA58K/1482897127:user/release-keys) but what I can't find any where is solutions!

While disabling the playstore does keep the malware off the device, it's not exactly a perfect solution and if it's at all possible I want to remove this malicious pest at the roots so the phone will actually be totally functional.

does anyone know how to deal with this? I'm tech savvy and completely comfortable in command prompt, and I'm not afraid to work with code if need be as long as I have instructions.

Thank you in advance for any and all help!

Improve this question
2

1 Answer 1

Reset to default
2

regarding xHelper

  • unpack firmware247.com/sky-elite-6-0l-plus-firmware
  • install VCOM preloader usb drivers
  • install Mediatek SP Flash Tool
  • load the scatter file, DESELECT all checkboxes (especially preloader)
  • switch off device completely
  • flash boot, system (click Download only, Download, then connect usb-cable)
  • flash cache, userdata (= factory reset if you wanna be 100% sure)

regarding OTA updater

readback boot.img with SP Flash Tool, patch with Magisk Manager, flash magisk_patched.img into boot, root the device and disable the OTA updater from terminal or adb shell 

su
pm disable --user 0 com.adups.fota
pm disable --user 0 com.adups.fota.sysoper
pm disable --user 0 com.fw.upgrade.sysoper

after this, restore the original boot.img (unroot device) and uninstall Magisk Manager

(Note: unlocking bootloader is most likely not required for this old device, SP Flash Tool can flash with locked bootloader. However, be aware unlocking bootloader will perform factory reset)

Improve this answer
3
  • If the device has already been rooted, I find it better to suggest nuking the malware instead of merely disabling it. Since you have already provided flashing instructions, if the device fails to boot after nuking malware than OP can just reflash everything. Otherwise, a factory reset would bring up those malware apps again if they only disable them.
    – Firelord ♦
    Jan 31, 2020 at 3:42
  • @Firelord it's not malware it's the official Firmware OTA and should therefore not deleted. i have disabled and it's fine (can't even remember if disabling requires root at all). the malware of course should be deleted, but do you know how to identify xHelper package?
    – alecxs
    Jan 31, 2020 at 6:10
  • symantec.com/blogs/threat-intelligence/xhelper-android-malware
    – alecxs
    Feb 23, 2020 at 20:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .