7

At some point in time my Android phone start downloading some .apk files in background. I assume this is doing some of the free apps what I've installed on my new phone from Google Play (I've installed 30-40 new apps recently). This is very annoying, but I can't get rid of it. I've tried to scan for viruses by antivirus app, but it found nothing.

How can I detect exactly which app is periodically downloading apk files in background?

Update: In notification bar I can see only usual notification about that .apk file was downloaded successfully. If I click that notification, it opens usual "Downloads" app with list of downloaded files. Here I can see files that I've downloaded by myself and files that was downloaded by some app in background. So, files are downloaded by native browser, I think.

My phone: Sony xPeria Sola, Android OS 2.3.7

|improve this question|||||
  • 1
    Does it show up in the notification bar? – R R Oct 26 '12 at 13:27
  • I've updated my question – HitOdessit Oct 26 '12 at 13:38
  • 1
    Why is this tagged as [airpush]? – Irfan Oct 26 '12 at 13:59
  • I assume that some app is sending some advertising via Push to my device. Maybe this .apk downloads are some kind of advertising? – HitOdessit Oct 26 '12 at 14:01
  • 1
    Its more than likely Google play has the apps set to auto-update so its doing that... – t0mm13b Jan 29 '13 at 15:03
3

Probably the quickest fix is going to be when it downloads an .apk, go to the notification, long press it, and when "App Info" pops up, click it. It will open in the application manager the app that downloaded it. (It may not be available on your phone, but it works on my S3.)

Your application manager is another wealth of information. There are way too many specifics to get into much detail about, but for example an app that is supposed to be offline, look at it's data usage. If it has used several MB of data, there's your culprit.

You could also narrow down the suspects by looking at the permissions. If it doesn't require network access, it can't download anything. (Although if this doesn't work, I'm not sure how trustworthy the permissions tags really are if we're dealing with a Trojan).

|improve this answer|||||
  • The "app info" feature on notifications isn't in Gingerbread: it was added in Jelly Bean. – Dan Hulme Jun 9 '14 at 7:39
0

When that happens, try to see the running apps and services in the background. You will most probably things like messaging apps and other running apps, the app that has downloaded that apk file is most probably still running as a service.

It might in fact be the browser (see if that's running). If not, my understanding is that any app can trigger a download in the "Downloads" app, so it might not be related.

You can get a task killer/manager to inspect and kill apps which you suspect are the source of this, but the one that is in the Settings>Applications>Running (or similar) should be enough.

tl;dr Trial and error. Kill the apps you suspect and see if it continues.

|improve this answer|||||
  • 1
    If a rogue app downloads something using the download manager then this won't help. – R R Oct 26 '12 at 17:22
  • @RichardBorcsik It won't stop the download, but it will prevent it from starting... – jadkik94 Oct 26 '12 at 22:52
  • Since the app will start again and he still won't know which one it is I would say this isn't too useful. Killing all apps all the time so hopefully none of them starts a download is, well not a solution. – R R Oct 27 '12 at 8:24
  • 1
    @jadkik94, I'm sorry, but I'm looking for some more generic and reliable solution. Maybe some kind of app that can analyze "suspected" apps? Maybe some system log analyzer? Or maybe there is a way to know which app has downloaded exact file? – HitOdessit Oct 27 '12 at 17:07
  • 1
    @Hit You might be able to get something from the logcat , something like "starting intent download.app.whatever.it.is.called", but I'm not sure it will give you the name of the app that started it... But an app that will do that for you (if that's even feasible), it's pretty unlikely you'll ever find one. IMO your best bet might be manually trying to kill each one and see... – jadkik94 Oct 27 '12 at 22:38
0

I'm still don't know how to answer my question for Android OS 2.x, but for Android OS 4.x there is a nice feature - you can long press any notification in status bar and choose App info popup menu, which will opens "App info" screen of application, what was created this notification. Very nice feature, but I didn't find analogue on OS 2.x

|improve this answer|||||
  • 2
    I don't know if it would help anyway because the app that technically started the notification is the "Downloads" app most probably... What you need to know is the app that started that one, which you might be able to find in the logcat. – jadkik94 Nov 5 '12 at 9:52
0

I rooted my phone and loaded busybox with terminal and just on a whim, iftop was there. either iftop or tcpdump will tell you everything. tcpdump -i -w myDumpFile.pcap

let it run and when you think it happened, stop tcpdump and bring the .pcap into wireshark. It will tell all.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.