OK, I know, some of you would tell my friend to just root the phone, delete the offending APK, and get on with it. Problem is it's under warranty, and he just isn't confident with hacking the device for now. He stumbled upon what appears to be an SMS malware app in /system, and while a few virus scanners flagged it as malicious, Kphone's customer support apparently shrugs it off in a (automated) reply to my friend's inquiry.
My friend bought it off QVC, and so far we haven't succeded in convincing either the manufacturer or QVC in recalling the device and/or issuing an OTA zip to rectify the issue in some way. To put it another way, we need confirmation that the app is of malicious nature, regardless of how the manufacturer tries to downplay or cover things up. I could more or less dechiper the code, but I'm no Java expert so any help would be appreciated.
Hello. I am the OP's friend here. I'm here to share some more details about the APK file and what programs detect it.
First off, this phone piqued my interest when it was actually shown on air late one night on the QVC network, which I don't usually watch much. I got the phone, and upon the recommendation of Blake and another friend, the first thing I did was run Malwarebytes on the Kphone. It initially picked up the APK as a generic SMSSend trojan variant, but after sending in the APK to Malwarebytes for a more detailed analysis, they reclassified it a not-as-severe PUP/Riskware. Another mobile antivirus app, AVG, also detected this APK as an SMSSend variant, but upon rescanning the device a few days ago, it no longer flags this APK. No other AV app I tried flags it, and I have tried ESET, 360 Security, Avast, Kaspersky, Sophos, and Avira. For the AV apps that detected the APK, removal is impossible since it's installed in the system folder. The phone isn't rooted out of the box.
I did initially email QVC about this potential problem, and they claimed to forward my concern to the proper department. I haven't heard from them since and the phone is still listed for sale. I also contacted Kphone's support site. After a few days, they replied back and stated that the file is meant for "international use" and it's a false positive. While the CSR could just be trying to cover up malicious activity, the fact that AVG seems to have removed the file from it's definition files seems to indicate a bit of truth behind their explanation. Even so, we do need a second opinion, which is why my friend put the file up here for further analysis.
It would be a shame too if the file is indeed malicious since the Kphone itself is rather great for the price. The performance and screen are great overall and it would actually make a good Android-based media player if you don't plan on using it as a phone.
wb8976 said:
Hello. I am the OP's friend here. I'm here to share some more details about the APK file and what programs detect it.
First off, this phone piqued my interest when it was actually shown on air late one night on the QVC network, which I don't usually watch much. I got the phone, and upon the recommendation of Blake and another friend, the first thing I did was run Malwarebytes on the Kphone. It initially picked up the APK as a generic SMSSend trojan variant, but after sending in the APK to Malwarebytes for a more detailed analysis, they reclassified it a not-as-severe PUP/Riskware. Another mobile antivirus app, AVG, also detected this APK as an SMSSend variant, but upon rescanning the device a few days ago, it no longer flags this APK. No other AV app I tried flags it, and I have tried ESET, 360 Security, Avast, Kaspersky, Sophos, and Avira. For the AV apps that detected the APK, removal is impossible since it's installed in the system folder. The phone isn't rooted out of the box.
I did initially email QVC about this potential problem, and they claimed to forward my concern to the proper department. I haven't heard from them since and the phone is still listed for sale. I also contacted Kphone's support site. After a few days, they replied back and stated that the file is meant for "international use" and it's a false positive. While the CSR could just be trying to cover up malicious activity, the fact that AVG seems to have removed the file from it's definition files seems to indicate a bit of truth behind their explanation. Even so, we do need a second opinion, which is why my friend put the file up here for further analysis.
It would be a shame too if the file is indeed malicious since the Kphone itself is rather great for the price. The performance and screen are great overall and it would actually make a good Android-based media player if you don't plan on using it as a phone.
Click to expand...
Click to collapse
And it's just as much of a disappointment when similar low-cost Android devices end up being tainted OOB, as what you mentioned on our forum some time ago, and when a friend of mine recalled a tablet belonging to a kid whose parent or relative is a friend of his, to which they had a rather hard time due to the sheer amount of popup ads being shoved up their throats, all thanks to the malware that's present in /system.
Mobile virus scanner apps are ****.
(Atleast most of them.)
I saw 360 security flaged share it.apk as a malware and deleted all my files.
So,I recommend u to get d help of a pc and run a anti-v test.
If it still shows as a malware then disable it from system.
For rooted user's, there's some easy solution like,
delete/freeze/denying permissions.
good luck
BatDroid said:
Mobile virus scanner apps are ****.
(Atleast most of them.)
I saw 360 security flaged share it.apk as a malware and deleted all my files.
So,I recommend u to get d help of a pc and run a anti-v test.
If it still shows as a malware then disable it from system.
For rooted user's, there's some easy solution like,
delete/freeze/denying permissions.
good luck
Click to expand...
Click to collapse
The desktop edition of Avast flagged the APK as malicious, so that's one red flag for me.
blakegriplingph said:
The desktop edition of Avast flagged the APK as malicious, so that's one red flag for me.
Click to expand...
Click to collapse
The mobile version of Avast seemed to just scan a handful of apps and did not detect the APK.
The only AV apps on my PC are Windows Defender and the PC version of Malwarebytes. Both don't flag the APK.
If one could take a look at the code and determine what it does, that could give us a better picture as to what the APK does. We did glance at some of the source code and found what appear to be various Chinese phone numbers and a server URL that seems to belong to the manufacturer of the Kphone K5, K-Touch. These can be red flags on their own, and if the rest of the APK code could be better analyzed, the meanings of these strings could be clearer.
wb8976 said:
The mobile version of Avast seemed to just scan a handful of apps and did not detect the APK.
The only AV apps on my PC are Windows Defender and the PC version of Malwarebytes. Both don't flag the APK.
If one could take a look at the code and determine what it does, that could give us a better picture as to what the APK does. We did glance at some of the source code and found what appear to be various Chinese phone numbers and a server URL that seems to belong to the manufacturer of the Kphone K5, K-Touch. These can be red flags on their own, and if the rest of the APK code could be better analyzed, the meanings of these strings could be clearer.
Click to expand...
Click to collapse
I could barely understand what the code does apart from a few functions, but it's still perturbing given the malware my friends and I encountered with no-name tabs previously.
Related
Is anti virus a waste or is it worth having it run on your phone?
waste......
MrGibbage said:
waste......
Click to expand...
Click to collapse
Why is that?
its a waste, when was the lest time u heard of someone getting a phone virus? lol, plus what are you downloading and running on your phone that might even pose a threat
I vote waste too, for current AV solutions. Like another poster said -- There really aren't any threats at the moment. It's real likely there will be at some point, but I see no reason to believe the current AV providers have any clue what these future hypothetical virii will look like. I'll trust an AV once it is written by a security researcher who has studied live Android virii. Until then they're just wasting resources.
I don't run AV software on my home computers or my phones. I am careful with the email that I open, and when I DL software, I try to be aware of where it is coming from. I am never the guy that that downloads something the day it comes out. If it is nefarious, I'll hear about it. Maybe I'm lucky, but I just don't see the need.
SMS Trojan for Android - http://www.theinquirer.net/inquirer/news/1727325/android-virus-spotted
They do exist just not on a Windows level lol. I'm sure they will jump in numbers as the popularity of the platform continues to explode. Currently, Lookout is one of the top rated AV apps, and its free.
BTW when you install the "SMS Trojan" it asks for permission to send text messages that may cost money.
TOTAL Waste.
Just read the permissions requests when installing apps.
Or go read up on how Android's app sandboxing works. Either way, nothing can harm your phone unless you explicitly allow it to. And if you allow a photo app to read all of your data, and send text messages and connect to the internet, you deserve what you get.
reuthermonkey said:
TOTAL Waste.
Just read the permissions requests when installing apps.
Or go read up on how Android's app sandboxing works. Either way, nothing can harm your phone unless you explicitly allow it to. And if you allow a photo app to read all of your data, and send text messages and connect to the internet, you deserve what you get.
Click to expand...
Click to collapse
Aint that the truth. Idiots need to pay attention to the Android Permissions screen and ask themselves "Why does this flashlight app need to read my contacts, google account and access my dialer, data connection and send SMS??"
Like others have mentioned, threat levels right now are so low that it doesn't warrant the use of money or system resources.
Some apps in the market that are labeled as such are just spam btw.
And also, we are far from a mass infection ala PCs. Just be very careful with what you download. Pay close attention to the permissions and use your very good judgement. If a music player asks permission to read/send/receive text messages and make phone calls, it's probably some type of malware.
jblade1000 said:
SMS Trojan for Android - http://www.theinquirer.net/inquirer/news/1727325/android-virus-spotted
They do exist just not on a Windows level lol. I'm sure they will jump in numbers as the popularity of the platform continues to explode. Currently, Lookout is one of the top rated AV apps, and its free.
Click to expand...
Click to collapse
WASTE ,..,.., hands down......
A virus that has to be manually installed by the user or creator on the host device ????? , and this is after all the warnings to the user before you press ok .,.,.,.,., never mind all the warnings telling you NOT TO DOWNLOAD outside of the market,unless you know what you are doing , download AT YOUR OWN RISK..... Not to mention the anti virus companies CREATING the need for you to install their app ... ever read some of the comments in the market about these "AV" apps ? > 'this app works great, protects my phone'<<<<<? protects it ? from what ???? WTF..
So yes I think it's a waste.....
People make viruses for a living so pretty soon someone will come out with a major one cause it being a phone means nothing its based off of linux and I know linux doesn't have any killer viruses but they do have some just not on a windows level. So ask it takes is one overseas a hole to create one just so he can get famous and then we will need an
Worth installing virus app.
O yea most people only read the permission when installing apps when they are new to android most people don't look at them.especially for apps they regularly use like handcent. Who know what they do with our info?
Sent from my Samsung Vibrant
hmmm lets see, would an app be able to slide in a permission without a warning? as in read contacts after installed but it never showed on the permission screen.
creglenn said:
People make viruses for a living so pretty soon someone will come out with a major one cause it being a phone means nothing its based off of linux and I know linux doesn't have any killer viruses but they do have some just not on a windows level. So ask it takes is one overseas a hole to create one just so he can get famous and then we will need an
Worth installing virus app.
O yea most people only read the permission when installing apps when they are new to android most people don't look at them.especially for apps they regularly use like handcent. Who know what they do with our info?
Sent from my Samsung Vibrant
Click to expand...
Click to collapse
None of that supports a need for an Anti-Virus. Android sandboxes each and every application on the system. It's not like any other Linux distro in how it handles security. It's MORE secure than linux. You can hack individual apps (and thus use their permissions - ie the browser), but that's quickly patched.
The biggest security threat to Android is the same as the biggest security threat for EVERY OS: Lazy users.
reuthermonkey said:
None of that supports a need for an Anti-Virus. Android sandboxes each and every application on the system. It's not like any other Linux distro in how it handles security. It's MORE secure than linux. You can hack individual apps (and thus use their permissions - ie the browser), but that's quickly patched.
The biggest security threat to Android is the same as the biggest security threat for EVERY OS: Lazy users.
Click to expand...
Click to collapse
Thats so true but im speaking on the basic users who dont need a dumbphone instead of a smartphone cause when/if a virus does come out those are the people who ill be flooding the forums. While we sit back and laugh.
everyone is talking **** about anti-virus for taking up resources, but i've found Lookout to be very unobtrusive. Also, besides virus scan, it will locate your phone, send a siren to your device, backup your info, all at schedules you determine.
jamesey10 said:
everyone is talking **** about anti-virus for taking up resources, but i've found Lookout to be very unobtrusive. Also, besides virus scan, it will locate your phone, send a siren to your device, backup your info, all at schedules you determine.
Click to expand...
Click to collapse
Sure, those are a few reasons to keep Lookout installed. But I don't need it scanning all my files for threats that don't exist yet and it probably wouldn't recognize anyway. Fortunately, the AV component is optional.
I posted this in another forum but I want to know what you guys here think about android security.
How worried are you all about security on the android platform? Don't you find it a little unnerving that anybody could upload and app to the android market and there is no verification of the app like on IOS platform. Anybody could write an app that looks legit but does devious things. All this along with there are very very few security applications and they are in the infant state. Don't you find it very dangerous? How do you try to maintain security on your android device? Don't download apps? Only download from known publishers? Or do you roll the dice and download anything? If you use a security app which one?
the_main_app said:
I posted this in another forum but I want to know what you guys here think about android security.
How worried are you all about security on the android platform? Don't you find it a little unnerving that anybody could upload and app to the android market and there is no verification of the app like on IOS platform. Anybody could write an app that looks legit but does devious things. All this along with there are very very few security applications and they are in the infant state. Don't you find it very dangerous? How do you try to maintain security on your android device? Don't download apps? Only download from known publishers? Or do you roll the dice and download anything? If you use a security app which one?
Click to expand...
Click to collapse
There are viruses for Android.....right ?
Besides , if you're smart enough you can check whether an app needs such permissions when installing , through the Mart or an .apk .
I don't like the way iOS works , they give too limited functionality .
Forever living in my Galaxy Ace using XDA App
the_main_app said:
I posted this in another forum but I want to know what you guys here think about android security.
How worried are you all about security on the android platform? Don't you find it a little unnerving that anybody could upload and app to the android market and there is no verification of the app like on IOS platform. Anybody could write an app that looks legit but does devious things. All this along with there are very very few security applications and they are in the infant state. Don't you find it very dangerous? How do you try to maintain security on your android device? Don't download apps? Only download from known publishers? Or do you roll the dice and download anything? If you use a security app which one?
Click to expand...
Click to collapse
i dont use a security app, i use common sense.
a game doesn't need access to my contacts...
notepad app doesn't need access to my private information...
this is why android phones are for the power users and shouldn't be used by soccer moms and grandmas - because they have no clue what they are doing with these phones except for when a phone call or text message comes in... let them have the iphones.
but if you are tech savvy, and want to squeeze every bit of user capability out of your phone, a high end android phone is for you.
the people that are tech savvy also have the awareness because they treat their phone like a computer, and not a phone.
just my thoughts.
I think the best thing would be if android embraced that the user can choose which permissions to give to apps. I mean, an app may want to know your location, you denies it, and the app continnues happily without using that functionality, or quits saying its essantial.
cobraboy85 said:
i dont use a security app, i use common sense.
a game doesn't need access to my contacts...
notepad app doesn't need access to my private information...
this is why android phones are for the power users and shouldn't be used by soccer moms and grandmas - because they have no clue what they are doing with these phones except for when a phone call or text message comes in... let them have the iphones.
but if you are tech savvy, and want to squeeze every bit of user capability out of your phone, a high end android phone is for you.
the people that are tech savvy also have the awareness because they treat their phone like a computer, and not a phone.
just my thoughts.
Click to expand...
Click to collapse
very well put, unfortunately most dont think like this..
It is always a good habit to check the permissions an app needs before installation.I personally think that a system should be implemented in android market where all apps are erquested to give informaation on "Why they need certain permissions?".Certain apps do that.
An antivirus program is also useful in my opinion.I use Lookout antivirus,as i find it simple to use and does not slow down my phone.I tried avg but it slowed down my phone terribly.
hiitti said:
I think the best thing would be if android embraced that the user can choose which permissions to give to apps. I mean, an app may want to know your location, you denies it, and the app continnues happily without using that functionality, or quits saying its essantial.
Click to expand...
Click to collapse
But, as a matter of degree, this just what we wish. The fact may be far beyond our imagination. Sometimes, malware still run certain functionalities even you cancel it. It's worse that some apps run secretly in system. I'm a little scared about security issue based on my PC.
cobraboy85 said:
i dont use a security app, i use common sense.
a game doesn't need access to my contacts...
notepad app doesn't need access to my private information...
this is why android phones are for the power users and shouldn't be used by soccer moms and grandmas - because they have no clue what they are doing with these phones except for when a phone call or text message comes in... let them have the iphones.
but if you are tech savvy, and want to squeeze every bit of user capability out of your phone, a high end android phone is for you.
the people that are tech savvy also have the awareness because they treat their phone like a computer, and not a phone.
just my thoughts.
Click to expand...
Click to collapse
But a game might ask for internet/network permissions which you would probably accept. How do you guard against this? How can you prevent a malicious app that asks for relavent permissions but abuses them?
I never take the time to study the permissions required when I download an app from the market.
I tend to avoid the low number of d'load apps..... partly as there is less feedback to judge.... and partly as any app thats worth the download will have high stars and many d'loads.
Works for me so far.
Netquins running in the background just in case...... but whose to say they dont upload my contacts for spamming?
Prof Peach said:
I never take the time to study the permissions required when I download an app from the market.
I tend to avoid the low number of d'load apps..... partly as there is less feedback to judge.... and partly as any app thats worth the download will have high stars and many d'loads.
Works for me so far.
Netquins running in the background just in case...... but whose to say they dont upload my contacts for spamming?
Click to expand...
Click to collapse
But what about new apps that may be legit? They won't have any reviews yet or stars. If everybody did the same as you it would never get reviews or stars? There's got to be a better way, don't you agree?
the_main_app said:
But a game might ask for internet/network permissions which you would probably accept. How do you guard against this? How can you prevent a malicious app that asks for relavent permissions but abuses them?
Click to expand...
Click to collapse
That's the only question above that can't be answered by LBE Privacy Guard.
Someone mentioned a game that wants access to your contacts. What if you really want the game? You just don't allow it access to your contacts and then play it anyway.
Most apps ask for access to your IMEI (you'd be surprised how many!) With LBE they don't get it.
Antivirus software is all well and good, but it's not the same as on a PC where pattern matching can be used. AV software on Android basically opens the apk file and has a look round to see if anything looks suspicious. Other than that, there's nothing it can do to stop a clever developer bypassing it.
Seriously, if you have concerns then get LBE and start restricting permissions access on an app-by-app basis.
johncmolyneux said:
That's the only question above that can't be answered by LBE Privacy Guard.
Someone mentioned a game that wants access to your contacts. What if you really want the game? You just don't allow it access to your contacts and then play it anyway.
Most apps ask for access to your IMEI (you'd be surprised how many!) With LBE they don't get it.
Antivirus software is all well and good, but it's not the same as on a PC where pattern matching can be used. AV software on Android basically opens the apk file and has a look round to see if anything looks suspicious. Other than that, there's nothing it can do to stop a clever developer bypassing it.
Seriously, if you have concerns then get LBE and start restricting permissions access on an app-by-app basis.
Click to expand...
Click to collapse
this.
i was JUST about to say the same thing about the android "anti-virus" scam... not really a scam, but a false sense of security. as you said, not the same at ALL. people need to get out of the PC mindset with these phones. this is not windows, it's linux.
and i'm going to give LBE a shot. seems pretty legit.
for all of those running antivirus "software" on your phone, how many of you have actually run a virus scan and had it give a detailed description of a malicious "virus"....
Liking lookout
Sent from my GT-I9100 using XDA App
ummm, anyone ever heard of antiviruses (Kapersky, maybe?)? Or at least look up the app's access to things... If it accesses something you don't want it to access (or think the app doesn't need to access it), don't install it!
I know out-of-the-box Androids aren't so vunerable to viruses, compared to rooted ones... So...?
First look up the developer of the app, then if you trust him, install, if you never heard of him, google it (or look at the comments at where you're downloading from), and if you had experience with the developer before (and if the experience is bad, like trojans, etc.), don't install!
(I don't understand half of what I'm typing XD...Don't blame me for misspellings, please )
Cant say I can rave or not when it comes to the anti virus apps.
Have used Lookout in the past and currently using netquin.... neither of which ever flagged up a virus, malware or whatever.
Its nice to think its running in the background but dont know whether it will do anything if its needed.
I was tempted to download a load of apps in a zip file but 20 secs in my Avast siad there was a virus. I'd like to think the market would have its own precautions but having searched the site, cant see any mention of its security for the apps we download.
Its a different thing altogether but we cant take the fact that its the market and relax...... the worst virus my laptop ever had came in an update from Microsoft...... and another directly from google tools.
Kapersky for Android then? You can pick up free full non-trial versions on the web...
About the Market - yes, that's true. You'd expect them to check if apps are infected or at least leave a bot to do it...
Sorta lame...
The best security is the brain.akp just like brain.exe is on windows - best thing it's free, godgiven and everyone got a copy
Zeze21 said:
The best security is the brain.akp just like brain.exe is on windows - best thing it's free, godgiven and everyone got a copy
Click to expand...
Click to collapse
yeah but not everyone got the full version. A few of my friends got a corrupted exe and then this girl I know got the 30 day trial
not that good
Prawesome said:
It is always a good habit to check the permissions an app needs before installation.I personally think that a system should be implemented in android market where all apps are erquested to give informaation on "Why they need certain permissions?".Certain apps do that.
An antivirus program is also useful in my opinion.I use Lookout antivirus,as i find it simple to use and does not slow down my phone.I tried avg but it slowed down my phone terribly.
Click to expand...
Click to collapse
I have both Lookout and AVG, neither has stopped my phone from getting up to 10 junk downloads, you have won an ipad, iphone etc., a day, not sms or email, I have to have every form of external contact turned off, the moment I get wifi or mobile access it starts downloading spam.
If anyone knows of a way to stop it I would appreciate the feedback
Moved to proper section
Hey all,
I'm the proud owner of a Samsung Nexus S (sadly the i9020a model, though). I was forced against my will at gun point by someone named Jealousy to install ICS (4.0.4) on my i9020a when it was released for all other Nexus S devices except for the US AT&T version of the phone.
Anyway, love the ICS and absolutely love the ROM I'm using (Brainmaster's stock ICS, w/ Supercharger V6 and a number of other goodies). But I was a bit confused today when I opened my phone and noticed a recently downloaded APK called "update.apk". Looking at it's info, it's name is "com.android.fixed.update" with no author, developer, and minimum version of 0. It weighs roughly 40kb and is not associated with the market, so I'm going to have to disable my "Market-only" settings in order to install it, otherwise it was about to install itself.
I was wonder what it might be. With no other information, I'm a bit hesitant to install it. The only permissions it asks for is Network Access and Start on Boot.
I thought just maybe it was an OTA from a developer (maybe even Brainmaster) but I wasn't exactly sure what kind of access or ability non-service providers had to OTA functionality and what not. (I suppose, if it can probably be modified with some effort, seeing as the source is available...)
Anyway, hoping to hear your thoughts on it. Google showed ONE result for "com.android.fixed.update" and that's it. Thanks for your input in advance!
We also got the same file on our Moto Xoom, I believe its a virus so do not install it. The file was downloaded at biandroid (dot) info which is definitely not associated with android.com
http://anonhq.com/notcompatible-back-market/
that is the explanation
Back in 2012 malware called Not Compatible was haunting android devices. Now more powerful than ever the latest version of NotCompatible.C has its own self protected encryption. Thus making this program difficult to find and delete.
Lookout Inc, a mobile security firm says that this version of the malware is a threat on a massive scale. Once in it has the tendency to control and hack data. It is an advance form of malware that can be seen on a PC a botnet so powerful that it has a server design architecture, P2P communications and as previously said encryption capabilities.
The programming of the malware is one of the hardest to kill malware that we have observed. Once the malware is installed it does not appear on the android operating system as it keeps itself in the background. It only works when the device is unlocked by the user or if it is restarted.
view
Source: Imgur
The only way you can find out is through Manage Applications>Settings. This will show you that an application by the long name of (com.andriod.fixed.update) is running. All you need to do is simply uninstall it.
Years ago I bought a cheap and powerful rugged phone to use it as a navigation tool on my motorcycle.
A view months ago it began that the phone sporadicly opens up add websites in the chrome browser. This happens about once a day.
I read that the manufacturer is not trustworthy and DooGee delivered some firmware updates with trojan sw. So I guess in the best case DooGee tries to do some extra money by showing me adds. They may installed a backdoor that now opens these websites.
I don't make security critical things on this device but still I want to get rid of these adds. It's annoying to drive with the bike and navigate and then the navigation software is hidden because of these useless adds.
I do have root on this device using an older version of magisk.
I have Titanium Backup and theoretically I would be able to disable all processes / apps if I would know the name of the app.
But I don't know how I can find out which process is the originator of these adds.
I disabled the chrome browser but I guess there is an other process that just shows the website in chrome. So it may not be chrome browser's fault?!
And the list of all apps is long because I have to suspect the system apps also.
I tried some virus scanners from play store but they all found nothing. Useless apps...
Hope someone here can help.
Any idea for a good strategy how to find the bad app or process?
Any tool recommendation that may can find it?
Thanks.
Try Malwarebytes for your mobile device.
fpdragon said:
Any idea for a good strategy how to find the bad app or process?
Any tool recommendation that may can find it?
Click to expand...
Click to collapse
Boot device into Safe Mode: You'll see "Safe mode" at the bottom of your screen
One by one, remove recently downloaded apps.
Tip: To remember the apps that you remove so that you can add them back, make a list.
After each removal, restart your device normally. See whether removing that app solved the problem.
jwoegerbauer said:
Boot device into Safe Mode: You'll see "Safe mode" at the bottom of your screen
One by one, remove recently downloaded apps.
Tip: To remember the apps that you remove so that you can add them back, make a list.
After each removal, restart your device normally. See whether removing that app solved the problem.
Click to expand...
Click to collapse
I am pretty sure that I don't downloaded any app that throws the adds. It must be something that comes from DooGee.
Bernal79 said:
mcafee will help to get rid of the malware
Click to expand...
Click to collapse
mcafee has not found anything
James_Watson said:
Try Malwarebytes for your mobile device.
Click to expand...
Click to collapse
malwarebytes has not found anything
However, thanks for the recommendation.
fpdragon said:
mcafee has not found anything
malwarebytes has not found anything
Click to expand...
Click to collapse
Not surprising me.
Malicious software comes in several flavors, distinguished primarily by their method of propagation. The two most pervasive forms are viruses and worms. A virus attaches itself to an existing program such that, when that program is executed, bad things happen. Like a biological virus, it cannot live without a host. In contrast, a worm is an independent program that reproduces itself without requiring a host program. Depending on the form, a worm may be able to propagate without any action on the victim's part. Most malicious software today consists of worms rather than viruses.
Worms and viruses require slightly different protection mechanisms because of their different propagation methods. A virus scanner operates by searching for the signatures of known viruses. A signature is a characteristic pattern that occurs in every copy of a virus. It might be a string of characters, such as a message that the virus will display on the screen when activated, or it might be binary computer code or even a particular bit of data that is embedded in the virus. These patterns are identified by technicians at organizations specializing in computer security and are then made available on security Web sites. Virus scanners can then download the patterns to bring their internal pattern lists up to date.
An Antivirus software is checking your Android devices's apps and comparing them to known types of malware ( viruses & worms). It will also scan your Android device for behaviors that may signal the presence of a new, unknown malware. Typically, Antivirus software uses all of these 3 detection processes:
Specific Detection – This works by looking for known malware by a specific set of characteristics.
Generic Detection – This process looks for malware that are variants of known “families,” or malware related by a common codebase.
Heuristic Detection – This process scans for previously unknown viruses by looking for known suspicious behavior or file structures.
Unlike viruses and worms, Trojans do not reproduce by infecting other files nor do they self-replicate. Trojans must spread through user interaction such as opening an email attachment or downloading and running a file from the Internet.
IMHO Android itself is a pretty secure operating system.
jwoegerbauer said:
Not surprising me.
Malicious software comes in several flavors, distinguished primarily by their method of propagation. The two most pervasive forms are viruses and worms. A virus attaches itself to an existing program such that, when that program is executed, bad things happen. Like a biological virus, it cannot live without a host. In contrast, a worm is an independent program that reproduces itself without requiring a host program. Depending on the form, a worm may be able to propagate without any action on the victim's part. Most malicious software today consists of worms rather than viruses.
Worms and viruses require slightly different protection mechanisms because of their different propagation methods. A virus scanner operates by searching for the signatures of known viruses. A signature is a characteristic pattern that occurs in every copy of a virus. It might be a string of characters, such as a message that the virus will display on the screen when activated, or it might be binary computer code or even a particular bit of data that is embedded in the virus. These patterns are identified by technicians at organizations specializing in computer security and are then made available on security Web sites. Virus scanners can then download the patterns to bring their internal pattern lists up to date.
An Antivirus software is checking your Android devices's apps and comparing them to known types of malware ( viruses & worms). It will also scan your Android device for behaviors that may signal the presence of a new, unknown malware. Typically, Antivirus software uses all of these 3 detection processes:
Specific Detection – This works by looking for known malware by a specific set of characteristics.
Generic Detection – This process looks for malware that are variants of known “families,” or malware related by a common codebase.
Heuristic Detection – This process scans for previously unknown viruses by looking for known suspicious behavior or file structures.
Unlike viruses and worms, Trojans do not reproduce by infecting other files nor do they self-replicate. Trojans must spread through user interaction such as opening an email attachment or downloading and running a file from the Internet.
IMHO Android itself is a pretty secure operating system.
Click to expand...
Click to collapse
Thank you for the good explanation. But how can I track down the originator of the popup adds?
I would expect that the originator of the adds runs as a system app. If I could find out which system app does this and It's functions is not neccessary (eg system update or something) then I could kill and remove it.
BTW, after disabling the chrome browser it seems that there are no popup adds any more. For two days no more adds. I guess this is because I removed the last browser from the system and now the adds can't be opend? But still it would be cool to track down the application that opens the adds if I need a browser one time.
fpdragon said:
Thank you for the good explanation. But how can I track down the originator of the popup adds?
I would expect that the originator of the adds runs as a system app. If I could find out which system app does this and It's functions is not neccessary (eg system update or something) then I could kill and remove it.
BTW, after disabling the chrome browser it seems that there are no popup adds any more. For two days no more adds. I guess this is because I removed the last browser from the system and now the adds can't be opend? But still it would be cool to track down the application that opens the adds if I need a browser one time.
Click to expand...
Click to collapse
It seems that you have turned on notification from a website in chrome. Clear chrome browsing data. Re-enable chrome. And check whether you receive any adds or not.
Hello. I recently bought a Huawei P40 Lite, without GMS and installed the apps using googlefier. Everything goes well except some errors that are fixed by swiping and blocking them, and one bigger issue: location. Some local apps (the phone is for my mom so she has a lot of shopping apps for local supermarkets with discounts, cards, vouchers etc) require you to set your location through google, so instead of the app showing the map and allowing you to choose your store, you're stuck at a "Google Play services are updated" screen. Is there any fix for this?
How it looks on my P20 Lite (with factory GMS)
How it looks on my P40 Lite (with googlefier GMS)
Also, does anyone know any better solution of installing the google services? As said, this phone is for my mom and I really don't want to have to fix something every week, so I'm up to even root and mess with things so I can have a more permanent fix.
Welcome to XDA
Yes, well... no idea what the solution is but there's no way I leave that junkware run on my phone.
With a user like that always keep in mind it may be malware, a virus or rootkit causing it.
An Android is only as secure as its user...
blackhawk said:
Welcome to XDA
Yes, well... no idea what the solution is but there's no way I leave that junkware run on my phone.
With a user like that always keep in mind it may be malware, a virus or rootkit causing it.
An Android is only as secure as its user...
Click to expand...
Click to collapse
Well it's not junk or malware. It's a genuine app from the playstore for a supermarket chain named Lidl. She's had it for months, you basically get a qr code and you have to scan that code at the cash register to get some discounts. The app shows her each week what products have discounts and what products are gonna have discounts next week. The app is legit.
As for the user, yeah I agree my mom isn't the most careful out there but i managed to teach her to not install or press any buttons and everytime she gets a weird message or notification she comes to me to figure out what it is. Even when a normal app requires a permission, for example "facebook requires permission to take pictures", she comes to me, so I'm pretty sure she'll be fine with it.
Is there any proper way of installing GMS without having these types of issues even if it involves rooting or god knows what else? At the price of this phone there's nothing better than it and I don't really want to downgrade to a bad samsung just for that.
Just because it's on Playstore doesn't make it safe
FB? Bah-ha-ha-ha.... is pure social malware.
Purveyors of disinformation and far, far worse.
No way that be on my phone. I punched out of FB 13 years ago after a month... the puppet cut the strings.
Meh, it's a lick on you... do what you will, but actions have consequences.
blackhawk said:
Just because it's on Playstore doesn't make it safe
FB? Bah-ha-ha-ha.... is pure social malware.
Purveyors of disinformation and far, far worse.
No way that be on my phone. I punched out of FB 13 years ago after a month... the puppet cut the strings.
Meh, it's a lick on you... do what you will, but actions have consequences.
Click to expand...
Click to collapse
It's not that deep. Like I said, all she does is talk about flowers, plants and work-related subjects. I taught her how not to fall in the hands of scammers and how she should come and show me everytime she gets any weird request. She doesn't download any apps without me, doesn't access weird websites, i think it's safe enough for a mature person.
Yes, I know that it isn't safe just because it's on the playstore, I'm just trying to tell you that it's a legit app, developed my the supermarket chain that has over 11k stores in Europe and there isn't any sensitive information apart from her name and a qr code that she has to scan, instead of the typical physical discount card.
On another note, since the topic has been moved to another category, does anybody have any idea on how to fix my issue?
@goldieczr did you find a solution?
I've got the exact same problem on my Hisense a6l.
I got these files (in the rar) from an official seller. With these you can install google service and magisk.
Both files are executable zips that can be opend. All you need is the password from the text file.
Same thing with the installation, just copy paste the passwords when ask.