Intro:
This thread is about a common & bothersome android OS error:
"System UIDs Inconsistent
UIDs on your system are inconsistent, you need to wipe your data partition or your device will be unstable"
popping at the system startup/boot/reboot.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Detail:
There have already been nearly a hundred threads on this topic, partly because of the problem is so prevalent and ubiquitous...
It has been reported from a wide range of devices, running various ROM/any android version. Most people got fed up trying numerous unbecoming solutions & landed up formatting their devices, and often landed up losing all userdata!
Generally it appears after flashing new ROMs/Kernels and the issue is more common with people who tend to try out different ROMs, therefore have to backup and restore the NANdroid backups in brief intervals.
Wiping data partition is not always desirable, as it would cost you all the saved application data, including contacts and messages.
Unfortunately there was no definite cure till now, but fortunately enough, there's something now!
This error is not necessarily emerging from your system apps/core/kernel etc etc (though, the error message seems more like a system prompt!) , rather it might be originating from petty handful of user-apps (even from those you had uninstalled in the past!!! but their corpse have somehow remained as zombies!).
Acknowledgement:
Thanks to xcreatir for hinting at this excellent piece of idea on XDA, on a similar thread.
Many more people got close to the solution, but missed the target by a whisker, and got deflected towards weird and terrible 'solutions'!
But, the problem is easy to fix, and indeed self-explanatory (and also logged by android automatically)!
Pre-requisite:You'll need root-access.
So, get your phone rooted, before you proceed (if its not already).
Solution:STEP 1.
Use a file explorer with root access (e.g. ES File Explorer OR Root Explorer OR File Explorer with Root Addon and browse to /data/system/
and locate a file named "uiderrors.txt"
Here I have relied on ES File Explorer with root privileges.
TIP: Must check "Show hidden files" in the settings of your chosen file manager.
Screenshots:
STEP 2.
Open it via any text reader
Screenshot:
STEP 3.
Look at the last few lines, you'll find the culprit apps whose leftover files have been causing the problem:
05/07/15 11:44 pm: Package com.rovio.angrybirdsseasons has mismatched uid: 10520 on disk, 10125 in settings
05/07/15 11:45 pm: Package ma.wanam.xposed has mismatched uid: 10485 on disk, 10230 in settings
Click to expand...
Click to collapse
In this case, the programs were:
com.rovio.angrybirdsseasons (Angry Birds Seasons)
and
ma.wanam.xposed (Wanam Xposed)
Click to expand...
Click to collapse
This will be completely different in your case.
Disclaimer:
By no means, I'm pointing fingers to these two apps as the culprits (rather, they are some of the best apps available!), this can happen with any give app. Thus, will be completely different in your case.
TIP: Please look through your own "uiderrors.txt" file very carefully to find out which are the apps having UID mismatch in your case!
You need to find every app mentioned in your "uiderrors.txt" file which had UID mismatch. Its not a difficult job, trust me. The list wont be long!
STEP 4.
Now browse to /data/data/
and
/data/app/
you'll need root privileges, otherwise things will show blank.
Screenshots:
STEP 5.
Select the folders with the names mentioned in"uiderrors.txt". Be careful of selecting anything else! This can land you in troubles. Mark only the ones mentioned in your own,
In my case I have to mark/select
/data/data/com.rovio.angrybirdsseasons
and
/data/data/ma.wanam.xposed
+++
/data/app/com.rovio.angrybirdsseasons.apk
and
/data/app/ma.wanam.xposed.apk
OR
/data/app/com.rovio.angrybirdsseasons-1.apk
and
/data/app/ma.wanam.xposed-1.apk
Click to expand...
Click to collapse
Remember: the apk file can bear any number after its name: e,g, it could also be com.rovio.angrybirdsseasons-4.apk
So, don't worry you have to mark everything that matches the name, forget the suffixes!
Again, the culprit files would be completely different in your case than what I have listed here.
Please take a close look at your own "/data/system/uiderrors.txt"
Screenshots:
6. Carefully delete them by hitting Delete Button at the bottom. Be careful of deleting anything else!
7. Reboot & enjoy!
You're done! No more errors! No need to format your device, keep all your data intact.
Caution:
Programs like Link2SD/ App2SD etc tend to complicate the issue to some extent.
In such cases, you must also scrutinize following directories besides: /data/data/ to find any leftover files belonging to those that are mentioned in your uiderrors.txt
These can hide inside (I'm not asking you to delete all of the below directories, just delete specific subdirectories/files as mentioned in your uiderrors.txt:
\data\sdext2\
\data\sdext2\data\
\data\sdext2\app\
\data\sdext2\app-lib\
[Remember, these directories might slightly: instead of "sdext2", you may find "sdext3" OR "sdext4" OR something a little more different. This is basically the mounting point of your SD Card's 2nd partition, formatted into linux file systems: ext2/ext3/ext4]
Click to expand...
Click to collapse
Delete meticulously any such traces!
Good Luck!
UPDATE! i sorted my issue out i had to go to the SD card in recovery and delete the DATA/System files! and everything thats in it, cheers
i have an issue in that i cant get to desktop on my phone to reset the counter as the popups overwhelm me with " System UIDs Inconsistent" i simply cant do anything with it so what i have done is reset factory settings from Recovery rather than the ROM, ive used Odon to reinstal the ROM but i then realised its nothing to to the the OS/ROM i have pretty much tried everything and the one thing i cant do is get the phone to the desktop to install the Apps that will sort this out i dont suppose any of you have an alternative way please? id be really greatfull i just need to stop these popups telling me "System UIDs Inconsistent" and i believe the ONLY way to do this is via your phones operating system in your settings but i cant get the phone past the "Search Wifi" startup when you first install a new ROM?
DJwa163 said:
TIP: Please look through your own "uiderrors.txt" file very carefully to find out which are the apps having UID mismatch in your case!
You need to find every app mentioned in your "uiderrors.txt" file which had UID mismatch. Its not a difficult job, trust me. The list wont be long!
Click to expand...
Click to collapse
I'm not sure about your definition of long, but 46 errors in my case...
Anyway, 46 apps deleted and now the error is gone, many thanks
Still I wonder if there was no other way to get the UID's back in sync, without deleting affected apps.
All 46 apps were linked with Link2SD, so I'm guessing something went wrong there.
IMO S50
thanks. its work:good::good::good::good::good::good:
Related
Is it possible to move an app and its files to that directory on rooted phones? Don't apps in that directory automatically stay installed after a factory reset?
I'd like to install PhoneLocator there in case I lose my phone and the person that finds it does a hard reset. Obviously you'd need to also move the file that holds the specific user's login/password info to be able to communicate back after a reset.
If not, is it possible to just unpack the rom I'm using and then stick the files in there?
ScottSNX said:
Is it possible to move an app and its files to that directory on rooted phones? Don't apps in that directory automatically stay installed after a factory reset?
I'd like to install PhoneLocator there in case I lose my phone and the person that finds it does a hard reset. Obviously you'd need to also move the file that holds the specific user's login/password info to be able to communicate back after a reset.
If not, is it possible to just unpack the rom I'm using and then stick the files in there?
Click to expand...
Click to collapse
Yes, if it is installed in /system it won't be deleted on a factory reset. However, the data in those apps gets wiped. Making the data NOT wipe from that app maybe challenging.
-viperboy- said:
Yes, if it is installed in /system it won't be deleted on a factory reset. However, the data in those apps gets wiped. Making the data NOT wipe from that app maybe challenging.
Click to expand...
Click to collapse
It would take a little bit of work but you could add a script w/ the needed data on the system partition to replace it in case of a wipe. Of course an RUU could still wipe it out but the odds of that being used are slim.
xHausx said:
It would take a little bit of work but you could add a script w/ the needed data on the system partition to replace it in case of a wipe. Of course an RUU could still wipe it out but the odds of that being used are slim.
Click to expand...
Click to collapse
everybody is spot on and it is an interesting question/challenge.
the simplest implementation i can think of would be to store your final version of the application's settings on the /system partition .. i'd hide it somewhere since we're doing this all covert stealth like .. and have a simple script on boot copy the application's data settings from the /system partition back to the /data partition on every boot.
the downside would be remembering, whenever you make a change to the application's data settings you would need to copy it back over the /system location, otherwise the /system version would overwrite it on boot.
if you are running a custom kernel, they often allow for scripts in a custom created /etc/init.d/ .. otherwise you can tag up something decent looking that is called from the stock /init.rc
a little more complicated of an implementation would be to write an android app (stored to /system/app) which uses root permission to copy the hidden application's data settings from the /system partition to the /data partition on every boot. the android app could hide itself from the application tray and be trigger via secret dialer code!
the app could also detect changes to the /data directory settings and copy it back over the /system directory ...
hope that helps contribute a bit to the logistics of implementing the idea!
/system/etc/init.post_boot.sh would be the perfect spot to hide the script if you went that route. It already gets called with the stock ROM and the odds of someone finding it there is slim to none. The data itself could be zipped up and placed anywhere. eg. "/system/lib/lib3dstuff.so"
If you use a custom ROM that you think may get switched you could even go so far as to modifying the recovery to reinstalling the files needed for it. That way if they switch to stock from CM or something like that it would still be there, you would just need to make sure that script gets called or that the recovery at least replaces the app's data.
Thanks for the great replies, a lot of great devs that I've actually heard of in here giving advice.
I'm not so worried about changing up the application's data after I set it up. I've got PhoneLocator and SeekDroid for paid apps that can do the basic relocating of my phone in case it's lost. My plan would be to only use Phone Locator for this since it's an app that's not relying on a data connection to send out GPS coordinates and can be triggered by a silent SMS message. I would set it up initially, not touch it afterwards, and then basically use other apps that do similar functions if I needed it.
And I'm not really so worried about someone "discovering" this buried in some system folder on the root. I'm guessing 95% of the people that would "find" my phone would just try and use it as a fun 4 inch wifi device or MP3 player without a cellular connection. And I have faith that if some XDAer found it they would be one of the few people I'd expect to go out of their way to return it.
Some of the solutions seem a bit over my head at this point, is this something I could post in the Dev section to request someone to write the script for? I know people get pissed if things that aren't really dev requests get posted in there.
Or is there a security app that already does something like this?
Back when I was on WinMo 3 years ago using my Mogul there was an app called NueGPS that the developer allowed chefs to cook into their roms, so I'm surprised this hasn't been developed already. Seems the first thing a dishonest person would do that wasn't planning on finding the owner on a lost phone would be to wipe it so they could either sell it or be able to customize it to just use as a wifi device.
I would donate for an app/script like this
That's genius
Sent from my HTC EVO 3d
Root: revolutionary
Recovery: Twrp cwm 4
ROM: Synergy rls318 (I want aosp)
I emailed the developer and he pretty much said this would work. I asked him the same question in the OP.
His reply:
Copy the com.rvo.plpro-1.apk from /data/app, to system/app with an app like Root Explorer. Uninstall the previous installation of ProLocator Pro. Restart your device. Done ! The user info will be stored in that file. Auto enable GPS is default, if it is off, it will be turned on, when a position is asked.
Click to expand...
Click to collapse
Had to "unlock" the app first from within its program to uninstall it from the /data/app directory, but it looks like it works. Before I flash another rom I'll try a standard wipe from the phone settings to see if it holds the settings I have the SMS GPS notifications go out to. He told me those scripts weren't really necessary and that all the user info gets stored in the .apk file. I'm wondering what all these other files do then. This is what came up under a search for plpro in Root Explorer.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
ScottSNX said:
He told me those scripts weren't really necessary and that all the user info gets stored in the .apk file. I'm wondering what all these other files do then.
Click to expand...
Click to collapse
I'm not in the habit of telling an android developer what his own app does or does not do, but I have developer a few android apps and am semi familar with how the android system works so I'll share my opinion. I'm in agreement more with you than whoever wrote the reply in the email you quoted.
I would be very surprised if his application was somehow internally storing settings inside of its own apk file ...
Those files you found and listed in your screenshot which ,are stored in the application's /data/data directory, are the standard preference type files which most (prob all) android applications use to store their settings. Google provides a very nice and convenient API for storing and managing settings in the app's respective /data/data directory.
It would be worth a try to test out. I would expect the following results from a test:
Move the apk file to /system/app. Wipe /data partition. Reboot and the application should have 100% stock/default settings.
On another approach, a thought just crossed my mind. It could be possible to have the application store your specific settings on a remote server and when the application opens or runs, it could pull down your specific settings from the server. This would of course require internet access (might not have if somebody stole and wiped, at least right away). But thats reverting back to our previous discussion.
Hope that helps as a second opinion from another application developer!
I have been messing with System Cleanup moving apps into system partition, etc. There was a glitch and now there's a 0-byte app that is physically removed (no files left as far as I can see) but still present on the app list. I can neither uninstall it further nor reinstall it (says can't install into the specified directory or something to the effect).
Is there a way to ULTIMATELY remove all traces of a (system) app manually? Is there a database of some sorts in Android where an entry could still be present? I would like to make Android forget it ever had the app in question (much less it was at some point moved to System) and be able to reinstall it as a user app.
Running an old Gingerbread Samsung Gio phone, BTW.
I don't know but I had a similar problem and my solution was to start android into the boot menu and use the restoration function and reset my device.
Sent from my PIONEER using xda app-developers app
Maybe one file of the app is remaining which Android is reading and treating as a complete app. Have you removed all files such as the .apk in /data/app/ or /system/app/, .dex in /data/dalvik-cache/ and data folder in /data/data/ ?
RaHBeR said:
Maybe one file of the app is remaining which Android is reading and treating as a complete app. Have you removed all files such as the .apk in /data/app/ or /system/app/, .dex in /data/dalvik-cache/ and data folder in /data/data/ ?
Click to expand...
Click to collapse
The question wasn't very clear. He said 0-byte files left on the device physically. Of course there is /data/dalvik-cache, too. Maybe that's what I forgot on my device.
Try wiping your dalvik cache and also your cache partition from recovery
Sent from my HTC One using Tapatalk 4 beta
**Press the thanks button if I have helped you.
I have removed all the files I could find. That is, there are none I can find left in /data/app/, /system/app/, /data/dalvik-cache/ and /data/data/. Are there any databases in Android OS that might store app entries?
To clarify: there is no physical 0-byte file as far as I can tell. It's just that Android's Applications thing lists this app along with the actually present ones, saying it takes 0 bytes and having but one "Move to Device" button active (but unable to do anything).
I am reluctant to wipe anything except Dalvik cache (already done so), much less resetting my device.
There are some sqlite files in /data/data/* in subfolder com. android.*. I think this is the files for all system settings and maybe also app files? I wonder too if there's is a package manager. In my other Linux there is apt or zipper. Can you browse sqlite files on the device?
Sent from my PIONEER using xda app-developers app
I think I was able to reproduce your error. See these images, I have highlighted the app I'm talking about:
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
I created this by first linking this application and all other in my phone to the SD-Card by Link2SD application. So the ".apk" file in /data/app/ and ".dex" file in /data/dalvik-cache/ both were transfered to the SD-Card and only this app's data folder remained in /data/data/ but do note that this application had 0 bytes of data.
See these images of the app when it was working:
Then I removed the SD-Card and rebooted my phone so Android could not read the ".apk" and ".dex" files and only an emtpy data folder of that app remained in the phone and then I got that error which is shown in the first 2 images.
And then with a file manager I went to the /data/data/ directory and saw this:
I hope this info helps you. So I think in your case also the data folder is remaining and deleting that may solve your problem.
The trouble is, I can find no folder to delete, neither in data/data nor elsewhere. I have searched my whole device and found nothing. Hence the question about databases etc.. Is this, perhaps, not the most appropriate subforum for such an in-depth OS structure question?
Still, your suggestion made me wonder whether I could manage to install the app after I remove the SD card. Turns out, I can. However, the app is a) not working, b) is regarded as an update to the original "ghost" (or, rather, "zombie") app (that is, I cannot move it, removing it does not remove the "original" 0-byte app, and even System Cleanup that can physically replace bloated system apps like Market with their latest updated versions does not see it as a proper original+update app).
I removed this "update" and the app returned to its previous placeholder icon 0-byte list entry form
elenhil said:
The trouble is, I can find no folder to delete, neither in data/data nor elsewhere. I have searched my whole device and found nothing. Hence the question about databases etc.. Is this, perhaps, not the most appropriate subforum for such an in-depth OS structure question?
Still, your suggestion made me wonder whether I could manage to install the app after I remove the SD card. Turns out, I can. However, the app is a) not working, b) is regarded as an update to the original "ghost" (or, rather, "zombie") app (that is, I cannot move it, removing it does not remove the "original" 0-byte app, and even System Cleanup that can physically replace bloated system apps like Market with their latest updated versions does not see it as a proper original+update app).
I removed this "update" and the app returned to its previous placeholder icon 0-byte list entry form
Click to expand...
Click to collapse
Did you tried my answer? Here is an example application. It seems there is an package mangager but not so complicated like apt, etc.: http://theopentutorials.com/tutorials/android/listview/how-to-get-list-of-installed-apps-in-android/.
I'm sorry, I'm no that deep into Android coding to understand what's on that page. Is there an actual app you might recommend to read these SQL files?
elenhil said:
I'm sorry, I'm no that deep into Android coding to understand what's on that page. Is there an actual app you might recommend to read these SQL files?
Click to expand...
Click to collapse
Maybe this one: https://play.google.com/store/apps/details?id=com.xuecs.sqlitemanager? Problem if you want more then the usual you need to code a few lines. I'm new to c# and java, too.
Update: The app works for me. I have also found some interesting files in data/com. android. vending. There is a list with all app state. When you are lucky it's not encrypted.
I really need some assistance in understand this issue that i'm experiencing on my new XZU phone (not even 2 weeks old!).
I seem to be getting some odd file system issues wherein certain files which are supposed to be in a certain location (OBB folder) suddenly disappear. I've been researching and the general idea is that this is an Android KitKat issue but I posted here on the hopes finding a solution to this problem.
Some pointers regarding on what happened (note: phone is not ROOTED):
1. Installed game like Plants vs Zombies 2 (legit) and the OBB files were correctly placed on the OBB directory.
2. I also purchased Comic Rack full edition which seems to have created a Storage/Emulated directory on the root of my internal drive when creating a comic folder.
-- Initially i made the mistake of deleting this folder which deleted my whole file system (both internal and external sds). I already did a factory reset after this issue, but the obb movement issue as mentioned above still happened.
---- I noticed that some of the Comic files added by Comic rack through wifi syncing are added on the directory in the emulated section i.e (Storage/Emulated/SDCARD/0/Comics/) instead of just Comics/ . However using the android file explorer and the desktop windows explorer shows different files/locations.
------- I'm mentioning the Comic Rack issue because i suspect this might be related to the missing obb due to the folder linking/mirroring system for android (i only read about it so please don't quote me on this)
3. Uninstalling PVZ2 removes the game from the apps list but the files are still accounted for in the storage. Using clean master does not detect these missing files and using other File explorers doesn't show any other directories that may have these files.
4. I read on google that the files might be on Root/Media/SDcard/something but i can't access this directory due to file permission (unrooted)
5. Redownloading the PVZ2 data files, simply puts back the missing files and makes the game work again. However i am not sure until when the issue can or will happen again.
Would anyone be able to explain this issue? or better, if there is a solution? Thanks
How the fudge did you modify the system files and folders in / direction if you are not rooted????
App data are and can be located in these directories
/data/data/
/data/dalvik-cache/
/storage/emulated/android/obb/
/storage/emulated/android/data/
=== if you have an memory card inserted ===
/storage/sdcard1/android/obb/
/storage/sdcard1/android/data/
=== if you have an memory card inserted ===
If you have root permissions. Look in these folders for traces of the app you have issues with and delete any related files. Reboot.
Other common methods is also to reboot in to recovery and clear cache and clear dalvik cache then reboot to system.
But without root permissions or a recovery I don't see many options for you than do than flash a .ftf file which includes the whole stock rom. If that works on locked bootloader...can't remember by now.
SÜPERUSER said:
How the fudge did you modify the system files and folders in / direction if you are not rooted????
App data are and can be located in these directories
/data/data/
/data/dalvik-cache/
/storage/emulated/android/obb/
/storage/emulated/android/data/
=== if you have an memory card inserted ===
/storage/sdcard1/android/obb/
/storage/sdcard1/android/data/
=== if you have an memory card inserted ===
If you have root permissions. Look in these folders for traces of the app you have issues with and delete any related files. Reboot.
Other common methods is also to reboot in to recovery and clear cache and clear dalvik cache then reboot to system.
But without root permissions or a recovery I don't see many options for you than do than flash a .ftf file which includes the whole stock rom. If that works on locked bootloader...can't remember by now.
Click to expand...
Click to collapse
I'm also not sure how those files were modified because i dont have root permission. Comic Rack was somehow able to make the Storage/Emulated folder visible on windows and somehow messed up my file system (just a guess). I already looked at those directories (through windows) and they are empty. Those folders are not visible through android based file explorers on my phone
ckenni2000 said:
I'm also not sure how those files were modified because i dont have root permission. Comic Rack was somehow able to make the Storage/Emulated folder visible on windows and somehow messed up my file system (just a guess). I already looked at those directories (through windows) and they are empty. Those folders are not visible through android based file explorers on my phone
Click to expand...
Click to collapse
You can not look in to these folders with a computer as android nowadays use MTP protocol to communicate with usb. You need to use ADB or a local file manager on your device like https://play.google.com/store/apps/details?id=com.speedsoftware.rootexplorer
To write files in sdcard1 without root permissions you need to mount the sdcard manually in a pc. Android has these functions disabled since not so long ago.
Remove the sdcard from the phone. Insert sdcard in a sdcard reader connected to your computer and open the folder.
If you are only read and write files in /storage/emulated/ you do not need root permissions as this is your personal storage space and you can use an app like this https://play.google.com/store/apps/details?id=com.estrongs.android.pop
Install this app and look in
/storage/emulated/android/obb/
/storage/emulated/android/data/
When you install es file explorer by standard the app starts in /storage/emulated/ directory so you only need to locate a folder called "android"
Screenshot on my device with ES file explorer started
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
I think i figured out the issue somehow. Just as a reference, if you guys used the Disk Usage APP, does your System Data show more than 4GB? Mine does and i assume these are the files that were previously on my OBB folder that were somehow transferred to the Root or System/Data of the phone that i am unable to access/delete.
Would there be a way to delete these files aside from rooting/factory reset
ckenni2000 said:
I think i figured out the issue somehow. Just as a reference, if you guys used the Disk Usage APP, does your System Data show more than 4GB? Mine does and i assume these are the files that were previously on my OBB folder that were somehow transferred to the Root or System/Data of the phone that i am unable to access/delete.
Would there be a way to delete these files aside from rooting/factory reset
Click to expand...
Click to collapse
I don't know what that app is.
Apps installed in /data/app can not be moved to /system/app without root permissions unless it is a bloat app from either google or the manufacture ie samsung/SONY/LG etc
However app data and cache files can remain if there was an error with uninstallation or some error in the system.
Your only option if you don't have root permissions to access those folders is to do a factory reset or a reinstallation by flashing a stock .ftf rom
Hello, I have been having trouble for months with a Gretel A9 smart phone provided by my employer.
The thing seems to be infected by a Trojan which cannot be removed by Factory Restore, or any virus program I have been able to find. (Malwarebytes will detect and clear it, but it comes back straight away).
Here are the symptoms:
-Horrendous pop-ups advertising games
Such as "Grumpy Gorrilla", "Oh No", "99 Balls", and "Sticky Glue). These pop ups are difficult to remove and require scrolling on the advert to find the X to remove, which often leads to clicking on the pop up itself.
This ended up with the phone being subscribed to "Demon Games", running up a £50 phone bill with the network provider.
-Constant browser pop ups to a website called "Aiboo.cc" which I am sure has something to do with it.
-An app called "Magic" which comes up as a virus on malware bytes, and keeps reappearing on the phone, with a little picture of a blue Octopus.
-Constantly tells me I have a new Whatsapp message, but when clicked on, something called "H5 Games" comes up.
-Lake worth ISD is another dodgy app that keeps appearing.
The phone is running Android 6.0.1
Please, help me if you can. I have tried resetting numerous times, and I've researched everything I have found but there's no information online about any of these things.
If it's provided by your employer than return it to him and refuse to use it until fixed or received new one.
To remove any files from system you need a root access. You have to root your device first but you lose warranty
If I return it, they will only provide me with a tiny 'Alcatel Pixi' phone, which is just awful to use.
I think I may try to Root it, but I have no experience doing this
Huscarl said:
I think I may try to Root it, but I have no experience doing this
Click to expand...
Click to collapse
Please post a screenshot of 'About phone' and also run Anti-virus Dr.Web Light (https://play.google.com/store/apps/details?id=com.drweb&hl=en) and post the results. Feel free to post the results from Malwarebytes as well.
Palm Trees said:
Please post a screenshot of 'About phone' and also run Anti-virus Dr.Web Light (https://play.google.com/store/apps/details?id=com.drweb&hl=en) and post the results. Feel free to post the results from Malwarebytes as well.
Click to expand...
Click to collapse
Ok, I will figure out how to get this done and post it tomorrow night (it's late here now and I need to figure out how to do it).
I will also keep a log of what appears on the phone during the day, as I get various messages and pop-ups.
Really do appreciate any help on this, as it has me and my work stumped. It would be a decent phone to use were it not for this terrible virus/trojan.
A quick scan on Malwarebytes came up with this:
2 Malware found
-Android/Trojan.Agent.ASH
(Installed Application - Settings) [I repeatedly get a fake application called Settings]
--------------
-Android/Trojan.Dropper.Agent.CKA
(Installed Application - Magic) [This is the app with the Octopus Icon which I mention earlier]
Tried wiping these off the phone numerous times, both manually and using Malware bytes and other virus apps, but they persistently come back.
Huscarl said:
Really do appreciate any help on this, as it has me and my work stumped. It would be a decent phone to use were it not for this terrible virus/trojan.
Click to expand...
Click to collapse
Did my own research. A number of phones came pre-installed with the Triada malware/virus, which is a well-known case. Unfortunately, Gretel A9 was one of those.
I downloaded the stock rom 3.04 and 3.02 both are infected and the only solution I see is replacing the lib which is causing this and deleting the .apk that is also causing this (based on what I could tell). However, I need to know specifically which version you are running and also what the result of the Dr. Web scan is (please post a screenshot). We could try to repack the cleaned system.img and then you can flash that. However, there are no guarantees it'll work.
TWRP and a few custom roms are available for your phone + general discussion here: https://4pda.ru/forum/index.php?showtopic=807386.
I have posted a Dropbox link to a screenshot of my About Phone..
https://www.dropbox.com/s/lie3868wcrquchg/LongShot_20190415_092503.png?dl=0
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Currently running a full scan with Dr Web Lite and it has detected 20 threats so far, that's far more than malware bytes or any other virus scanner I have used.
Once that's done I will post the results
Huscarl said:
Currently running a full scan with Dr Web Lite and it has detected 20 threats so far, that's far more than malware bytes or any other virus scanner I have used.
Once that's done I will post the results
Click to expand...
Click to collapse
Sounds good! Did some more research, Alberto96 posted this in 2017 (huge thanks for providing both TWRP + the K10 and A9 firmware) https://forum.xda-developers.com/showpost.php?p=77545922&postcount=7 and I've succesfully compared the firmware. My thinking here is - replace the clean files from the Oshiyama K10 stock firmware with the infected ones from the Gretel A9. Repack system.img and then you can try flashing the new system.img via SP Flash Tools. Alternatively, flash TWRP and we'll have to figure out how to create a new flashable system.img script.
I'm having a hard time getting it onto one screenshot despite trying to save it as a long shot, but here is some of the Dr Web diagnosis..
https://www.dropbox.com/s/na47qmq9ek4fvs0/LongShot_20190416_084021.png?dl=0
Palm Trees said:
Sounds good! Did some more research, Alberto96 posted this in 2017 (huge thanks for providing both TWRP + the K10 and A9 firmware) https://forum.xda-developers.com/showpost.php?p=77545922&postcount=7 and I've succesfully compared the firmware. My thinking here is - replace the clean files from the Oshiyama K10 stock firmware with the infected ones from the Gretel A9. Repack system.img and then you can try flashing the new system.img via SP Flash Tools. Alternatively, flash TWRP and we'll have to figure out how to create a new flashable system.img script.
Click to expand...
Click to collapse
Just looked through this thread and I can confirm they were getting the exact same symptoms. Everything they described is what is happening with my phone.
Huscarl said:
I'm having a hard time getting it onto one screenshot despite trying to save it as a long shot, but here is some of the Dr Web diagnosis..
https://www.dropbox.com/s/na47qmq9ek4fvs0/LongShot_20190416_084021.png?dl=0
Click to expand...
Click to collapse
Thanks. If you can pull the full detection list that would be great.
I need to know what some of the detections are associated with, so can you run 'adb shell' and then 'pm list packages –f' like this example:
Then copy the list and post it here as .txt preferably.
Currently decompiling the rest of the 3.04 firmware to see if they've hidden malware in the other partitions as well. If not, we're all set to have you flash a test cleaned test rom if you're up for it.
deleted: \system\priv-app\SecurityService\
https://www.virustotal.com/#/file/1...2b95f86b37e1fd65d495ec4f7782a1df5b8/detection
replaced: system\lib\libandroid_runtime.so with the clean libandroid_runtime.so from the Oshiyama K10 (the device Alberto was referring to).
https://www.virustotal.com/#/file/4...63a1eaca0329162e1d5bd6a6205c1ce78ab/detection
Furthermore, I've removed these vendor apps (pre-installed bloat).
\system\vendor\operator\app\FaceBook
\system\vendor\operator\app\Gmail2
\system\vendor\operator\app\Instagram
\system\vendor\operator\app\Maps
\system\vendor\operator\app\Twitter
\system\vendor\operator\app\YouTube
Here is everything I am getting from Dr Web:
https://www.dropbox.com/s/4a8xw8838vizxul/OneShot_20190416_164440.png?dl=0
https://www.dropbox.com/s/gvl5it7ucfo0s01/OneShot_20190416_164541.png?dl=0
https://www.dropbox.com/s/04am7g7mdw1vlk1/OneShot_20190416_164604.png?dl=0
https://www.dropbox.com/s/04am7g7mdw1vlk1/OneShot_20190416_164604.png?dl=0
https://www.dropbox.com/s/e987ajlgp3hjriz/OneShot_20190416_164612.png?dl=0
Sorry about the format, I'm not so tech savvy, I'm sure that's the lot. I'll now start working on the other instructions you gave me (abd)
Still trying to figure out how to use ABD.
I am following the instructions on here:
https://www.howtogeek.com/125769/how-to-install-and-use-abd-the-android-debug-bridge-utility/
I have download the SDK tools, and unzipped them to a new folder, but I do not see the SDK Manager EXE
I think that it would be easier to flash new rom from the link few posts above - xda site
a602820922 said:
I think that it would be easier to flash new rom from the link few posts above - xda site
Click to expand...
Click to collapse
The problem is, it won't boot. You need to flash the system.img only - but the K10 system.img needs to have the required libs from the A9, e.g. fingerprint, cam libs. Though there's no indication hereof, the K10 may pack malware as well. But like I said, I can repack the K10 system.img with the required A9 files and Huscarl can test it. This can likely be omitted, if we can repack the stock rom with the clean files from the K10 system.img. That's why I need to know what packages are linked to the Dr. Web detections aside from SecurityService and libandroid_runtime.so.
An alternative quick fix: flash TWRP, root the phone, run Dr. Web and let it remove the malware. However, as research indicates, the problem still persists for some users.
my phone was accidentally factory reset by a 3 year old holding two buttons, which shouldnt even be an option honestly. i did not have an sd card or a backup for literally the two things i care about most, my notes(samsung notes app) and my photos, and i have no idea why those two were specifically turned off.
i have tried recovering them through my computer with multiple services, minitool, drfone, photorec, fonelab and at least 2 others, all of them said my device had to be rooted, so i tried several things to root my phone as well,(i can only remember kingoroot off the top of my head) but im unable to get the OEM option, ive tried turning off auto updates, changing the date and restarting my phone several times, turning off mobile and wifi data, and im not sure but i think it wont work simply because the option to turn off software updates isnt available(at least, thats the only thing thats different with all the tutorials/videos i watched showing how to do it. i found a post that said its because android updated to make it harder to do and that now software updates happen through google services and to turn that off to do it, but that didnt work either.
my phone is a samsung galaxy a50 and the version(since it reset) is 10.
im begging, please please someone help, anything i can try at all, the last few years of my life are in those photos and notes, i cant lose them, ive been trying to fix this for 6 hours, i dont have much money but i am willing to pay to get back my photos and notes, i really need them. i apologize if this is the incorrect place to post, if it is, please let me know where i can post this to get help.
@Possumpal
A Factory Reset wipes phone's disk space ( what is a non-volatile flash memory ) filled up with user-data and rewrites that partition with the apps provided by OEM/Carrier. As long as the flash memory space ( blocks ) used before wiping and after rewriting doesn't get physically "overwritten" it's basically possible to recover deleted files.
It's not necessary phone is rooted to do so, because you aren't dealing with Android's system-data.
I'm so sorry for not replying sooner, our internet was out for days because someone fixing a leak apparently cut the line. Thank you so much for the reply, that's really exciting to hear! Can you tell me how to retrieve the files then? Or point me to a post or someone who can? Do I need to repost this is the galaxy a50 section? I searched for hours and the only things I found all said I had to root my phone, so I'm not sure how to find it
Possumpal said:
I'm so sorry for not replying sooner, our internet was out for days because someone fixing a leak apparently cut the line. Thank you so much for the reply, that's really exciting to hear! Can you tell me how to retrieve the files then? Or point me to a post or someone who can? Do I need to repost this is the galaxy a50 section? I searched for hours and the only things I found all said I had to root my phone, so I'm not sure how to find it
Click to expand...
Click to collapse
If ADB ( read: USB debugging ) is enabled on phone, then to clone ( read: create a raw image - on byte level - of ) Android's /data and/or /userdata partition to PC
At 1st establish connection running command
Code:
adb devices
Then obtain Android's /data partition's mount-point name by running command
Code:
adb shell mount
and query command's output for line that contains substring
1. if partition name is /data: on /data type ext4
2. if partition name is /userdata: on /userdata type ext4
Left of that substring is shown name of the mount-point, e.g. /dev/block/sda35. Note down that mount point, you need it in next step.
Then, using the mount-point you remembered, run this command
Code:
adb exec-out "dd if=[color=red]/dev/block/sda35[/color] 2>/dev/null" > C:\data.img
what will create the clone on PC's drive C:
Done
is it possible you could link me to the ' how to create a raw image byte level' one? I tried searching the forum for it and google, I'm sure I'm just not doing it right but I cant find it, ive never done this sort of stuff before, I'm sorry I'm being so difficult, I appreciate the help so much, seriously, it means the world to me to be able to retrieve my files
Unfortunately after a factory data reset it may not be possible to regain that data without a backup. You may be able to use custom tools to potentially gain data back that was there but haven't ever seen any success of that
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
My 2 cents: A Factory Reset doesn't mean that user-data are irretrievably lost. The term Wipe Data used in recovery memu is errleading.
Wiping
means overwriting storage space with random data, e.g.
Code:
dd if=/dev/urandom of=/dev/sdX bs=1M
Hence original data in no way can get recovered.
Deleting
means resetting the entry in Android's file system to inform OS that the storage space used is free to write new data onto.
Until that happens the data can be easily recovered by software of which some is free to use.
Formatting
means clearing the entries in Android file system what allows to find/read files on the device, but leaves the files data intact.
You can still recover the data from a formatted storage space.
Personally don't think a Factory Reset wipes user-data in the sense described above, but only deletes them in the sense described above.
But this estimation can be wrong.
the first step isnt working, am i doing something wrong?
i tried it without the space, i tried just adb and just devices, and all of it just says the same thing and i tried doing what it said by putting a \ in front, it still says the same thing
jwoegerbauer said:
My 2 cents: A Factory Reset doesn't mean that user-data are irretrievably lost. The term Wipe Data used in recovery memu is errleading.
Deleting
means resetting the entry in Android's file system to inform OS that the storage space used is free to write new data onto.
Until that happens the data can be easily recovered by software of which some is free to use.
Formatting
means clearing the entries in Android file system what allows to find/read files on the device, but leaves the files data intact.
You can still recover the data from a formatted storage space.
Personally don't think a Factory Reset wipes user-data in the sense described above, but only deletes them in the sense described above.
But this estimation can be wrong.
Click to expand...
Click to collapse
Like I've said even formatting yes you can potentially recover said data, but I've never seen such a tool successfully extract data without it already existing into he device.
---------- Post added at 08:20 AM ---------- Previous post was at 08:16 AM ----------
Possumpal said:
the first step isnt working, am i doing something wrong?
i tried it without the space, i tried just adb and just devices, and all of it just says the same thing and i tried doing what it said by putting a \ in front, it still says the same thing
Click to expand...
Click to collapse
If you have the platform-tools and/or ADB folder use CMD (Command Prompt) to get the job done. Ensure its set to the same directory as the executables
Im.. not sure what that means. I really dont know anything about coding stuff, I can only google how to do everything ive been told, but it doesnt always pull up anything related..