[Completed] [Q] XXX Video / Droid Porn Ransomware Removal via ADB - XDA Assist

Hello,
So long story short my brothers an idiot and installed a "Flash Player" because he thought he needed it. Now he has the "Prism FBI Child Porn/Bestiality" ransomware installed. I can get into safe mode and I am unable to uninstall the app. It is listed as "XXXVideo Droid Porn." It does not exist in safe mode under "Device Administrators" so the uninstall button is locked in normal and safe mode. I have since rooted his phone and I can gain access via ADB, I figure removing the package via ADB is my only option at this point. Within the shell I can gain Superuser access and can navigate fairly well having just learned how to do all this in an hour. So far I am having no luck locating the package or where to go at this point to remove this for him. I have tried Avasts ransomware removal tool as well as some others but none of them are working. I can get into these apps and run them normally but after about 30 seconds the ransomware starts and cuts off any progress made, and none are available in safe mode. About the only thing I can find is when I connect through the ADB Shell and list the packages I recognize all but one. It is labeled "package:ysvv.dvvsg.bfydrij." I cannot find any information online regarding this package, I even hail mary-d and tried to uninstall the package but it failed. I have also searched through the root folders looking for some hint of where it could be. If there is a way to enable one of these in safemode to try and have them run it then i cant find it. Or if there is some shell command to list packages by install date, I can try to uninstall it that way.
So any help at this point would be appreciated. Sorry if this is the wrong area but after a few hours working on it I am at a loss.
Phone: Galaxy S3
Carrier: Tmobile
Model: SGH-T999
Android: 4.1.2

vyletrakun said:
Hello,
So long story short my brothers an idiot and installed a "Flash Player" because he thought he needed it. Now he has the "Prism FBI Child Porn/Bestiality" ransomware installed. I can get into safe mode and I am unable to uninstall the app. It is listed as "XXXVideo Droid Porn." It does not exist in safe mode under "Device Administrators" so the uninstall button is locked in normal and safe mode. I have since rooted his phone and I can gain access via ADB, I figure removing the package via ADB is my only option at this point. Within the shell I can gain Superuser access and can navigate fairly well having just learned how to do all this in an hour. So far I am having no luck locating the package or where to go at this point to remove this for him. I have tried Avasts ransomware removal tool as well as some others but none of them are working. I can get into these apps and run them normally but after about 30 seconds the ransomware starts and cuts off any progress made, and none are available in safe mode. About the only thing I can find is when I connect through the ADB Shell and list the packages I recognize all but one. It is labeled "package:ysvv.dvvsg.bfydrij." I cannot find any information online regarding this package, I even hail mary-d and tried to uninstall the package but it failed. I have also searched through the root folders looking for some hint of where it could be. If there is a way to enable one of these in safemode to try and have them run it then i cant find it. Or if there is some shell command to list packages by install date, I can try to uninstall it that way.
So any help at this point would be appreciated. Sorry if this is the wrong area but after a few hours working on it I am at a loss.
Phone: Galaxy S3
Carrier: Tmobile
Model: SGH-T999
Android: 4.1.2
Click to expand...
Click to collapse
Your best bet is gonna be to fully wipe the device. Then reload the rom.

[Solved!]
zelendel said:
Your best bet is gonna be to fully wipe the device. Then reload the rom.
Click to expand...
Click to collapse
Actually I was able to do it without wiping the phone.
I just navigated to /data/app and did the "rm" command on the suspicious package and it worked. The prism ransom ware became broken and I was able to boot up normally and delete the broken piece of the app.
-----
adb shell
su
pm list packages -3 [found the start of the ransom ware]
cd /system/app
ls [found the ransomeware .apk file here]
rm /system/app/ysvv.dvvsg.bfydrij-2.apk
------
Then it worked

Related

Does ADB require rooting your phone?

I'm trying to delete the GenieWidget from my phone, and it won't install from Applications > Manage, the uninstall option is not highlighted anymore. It use to be, but not any more, very odd. I tried Terminal, Root Explorer but those require root and I'm on stock 2.2 Froyo (Evo 4G). I tried ADB, install it, everything is fine, I even type in "adb devices" in the cmd prompt and it finds my phone. When I type "adb shell" a "$" appears and whatever I type says "permission denied".
When I type "adb" all the adb info comes up fine, when I tried to type "adb uninstall [insert apk here] I get a "failed" or I get some Java error telling me to put Java in the path (same path as the Android SDK Tools) but I have and its still not working.
Please help!
The GenieWidget lives on /system/ and requires root to access that partition. ADB itself does not require root, but the action you want does.
Any other way to get to it? This is stressing me out. I just want to delete it and add a modify one, thats all.
Like I said, it requires root.
Dude I installed it on my phone, I've deleted it multiple times, all the sudden now I can't uninstall it.
The only thing I can think of is, it came preloaded on my phone with the 2.2 Froyo update which would make since that I can't delete it without root access.

Let's root the i858 - ADB access is here!

Okay, I have been able to get ADB access to the I-Mobile i858; but I cannot get root. There is an SU program and Busybox pre-installed on this device. I tried changing the permissions of SU to 4755 and 6755 without success. It looked like it was trying but something is interfering with root. Maybe if we work together we can figure this out. I even modified a flash image to set the permissions when it flashed the new image. That still did not give me root.
Here is how you get ADB to connect. It is kind of a pain but at least now we can talk to the device.
1. Install the "Android Terminal Emulator" by Jack Palevich from the Android Market to your device.
2. Download the Android ADB device drivers from this link and un-rar them.
http://www.generalmobile.com/support/dstl1/DSTL1_USB_Driver.rar
3. Open Device Manager on your computer.
4. Make sure debugging is turned off on your device in Settings>Applications>Devices.
5. Open the Terminal Emulator you downloaded in step 1 and type in the following command "<enter>setprop persist.service.adb.enable 1<enter>".
6. Go back to Settings>Applications>Development on your device and turn USB Debugging on. Click OK when prompted to confirm.
7. Plug the USB cable into your i858 and then your computer's USB port. In my tests using a reliable hub is okay.
8. You will see a device under Universal Serial Bus Controllers that says either "USB Mass Storage Device" or "USB Composite Device." Watch that section in Device Manager to see which one is the new one when you plugged in your device.
8. Uninstall the Mass Storage or Composite Device that was added to Device Manager when you plugged in your computer. You do this by right-clicking it and selecting "Uninstall".
9. On Device Manager Click the Actions pull down menu and click "Scan for hardware changes".
10. If you are lucky an unknown Android Device will no be listed in the Device Manager as not working due to no drivers installed. Go to properties of this device and update drivers browsing to the folder when you unzipped the drivers downloaded in step 2 above. The Android ADB drivers will now install.
11. If that doesn't work keep uninstalling the Mass Storage or Composite Device and rescan until the Android Device appears in Device Manager.
12. If you unplug it you will have to go back to step 4 but you can skip step 5.
13. If you reboot or turn off your device you will have go to back to step 4.
14. Unfortunately, I have to do this ritual every time I want to connect to the device by ADB; but heck it sure beats having no ADB access at all.
Now that you guys have ADB access let's rock this device, root it and have some fun. I spent all day trying to root it without success. I did manage to make the phone do some weird things and reboot a couple of times. I was changing permissions for the pre-installed "su" program in "/system/bin" but obviously there is something else that needs to be done to root this device. At least we are one or two steps closer now.
Thanks for sharing with us your work
For me i just delete apps befor i flash the rom because after when the apps installed i can t delet them because there are protected.
closer66 said:
Thanks for sharing with us your work
For me i just delete apps befor i flash the rom because after when the apps installed i can t delet them because there are protected.
Click to expand...
Click to collapse
If the device was rooted then you could delete them on the phone.
I-Mobile i858 has been rooted!!!
Okay, the I-Mobile i858 comes pre-rooted but there is something wrong with the way it was setup and root doesn't work. You download a program called Universal Androot and let it re-root the device so that it corrects whatever mistakes the ODM put in that made root not work. In your browser go to the following URL and install the program.
http://bit.ly/cwNm9u
When you run the program it says the device is already rooted; but there is some problem as the rooting is not complete. So you tell the program to root the device again. After it is done the device is rooted and stays rooted after reboot. Programs like Boot Control that require root access now work. There is a SuperUser Authorizer app that will intercede the first time and ask you if you want to give root permission to that app. That is a good thing and will protect you from malicious programs getting root that can cause you all kinds of nightmares.
But, I am root and I still cannot uninstall the pre-installed apps. How do you do that even as root? I am missing something.
hey great new s thanks for your work today i went to the i-mobile shop in samui and there say rom update is official confirm to 2.1 or maybe 2.2 there dont know excactly
Now i have root thanks. But following problem when i try to delete some apps that pre installed.
Says delete it but in real do not delete the app ummm
do you have any id why i can not delete the apps??
closer66 said:
Now i have root thanks. But following problem when i try to delete some apps that pre installed.
Says delete it but in real do not delete the app ummm
do you have any id why i can not delete the apps??
Click to expand...
Click to collapse
Any pre-installed apps cannot be deleted the normal way. Install Titanium Backup from the Android Market and let it have root when requested. You can use that program to uninstall pre-installed apps with root.
Rooted! ADB! Now this device gets much more useful! Great work jboxer, thanks!
BTW the rooting app has been updated to v1.6.1
Home page:
http://blog.23corner.com/tag/universalandroot/
Download:
http://bit.ly/aa4jxJ
Follow this Link droidsans.com/node/4018

[Q] Best regards to greatest wizards; any idea for dead rooted Garmin Asus A50 ?

Hi all you wizards,
I had this now brick rooted and jiggling around it with uninstalling some preinstalled apps, but when I attempted to replace some fonts which was my main goal, it turned out that it was not really rooted!!! probably the rooting method and app was malicious. Then none of the apps could fully root it. Z4root followed by Superoneclick and Universalandroot have been tried, no chance but slow and unstable device. finally I decided to master reset. After this, a strange virus like fake warning sticks to the screen saying the battery cover is open and asking to restart! when I really open the cover another warning comes up that battery cover removed. phone is working in background. It responds to USB connection, even detects an update of ROM I copied to solve the problem but no chance.
Has anybody any idea to get it back to life by using PC as there is no direct interactions with the phone coz of the virus?
basically I prefer to get rid of the virus through SDK and ADB if possible although I am a mushroom and Dono how.
Is it possible to wipe off some infected data or I have to wash out all the ROM and install a new one?
I have another phone handy exactly the same thing, should I copy all data from other one to this one or the update version of original ROM would work?
it is Garmin Asus A50 nuvifone with built in full GPS and navigator; 256 ROM, 256 RAM, 600 MHtz CPU, ARMv6, android 2.1 update 1
Thanks so much in advance for any participation even your experiences without useful result
here is some more information about the matter;
I needed to install some fonts for other languages which are not supported by android
So I tried to use information and files to get my device rooted and replace some fonts in system/fonts directory and some files in system/lib directory to use other languages in my android.
1- I started with Z4root , I downloaded through device and installed it, and I uninstalled my antivirus as it always said it is not safe, so I activated USB debugging and then permanent root and I had the super user. I installed some apps and used them to uninstall some preinstalled app and similar issues. When I tried to replace fonts and files, my file explorer with root ability, it said I don’t have enough authorization or something to access the file, I tried more root file explorer but same result, even a root checker said my device is not rooted!
2- Then I tried UniversalAndroot-1.6.2-beta5. Again I downloaded it through my device browser but it could not help as it said fails! I thought it is because of Z4root so I uninstalled Z4root but failed to root again.
3- I wanted to use pc method and root my phone by PC, even though this method was for android ginger bread and not my brand but as much as tried, my device did not show a recovery mode in start up by pressing power button and volume key but when I pressed middle key of arrow keys went to safe mode. so I ignored it.
4- Finally I downloaded the oneclick app through my device from the net. It was a zip file with so many files and super user, I just installed superuser but not helpful to replace font, then uninstalled.
5- Again installed Z4root but my phone was freezing and unstable so decided to master reset to factory setting. I did it once but after reset, nothing changed so I did it again. This time a warning sticks on the screen says;
” close the battery cover, and restart the device to complete first time set up.”
and asks for restart.
There should be something wrong as when I really open the battery cover, another warning comes up and says; battery cover removed!
Phone is working in background, even I copied a factory update of my ROM and its been detected but the crazy warning does not let to do anything but restart!
Now I need help to show me how I can use my PC to reset my device as upon a usb connection it asks for interaction and lets me to work via usb cable, and then how I can go to recovery mode in start up?
Otherwise it is a brick, lol
it does not let me to do any interaction cause of the crazy warning. it asks for restart, thats all I can do, or other warnings like asking to do update or usb connection option or battery cover removed, but no more. it means I can not activate usb debugging if needed or follow update process through mobile UI. besides in this kind of phone there is no recovery mode but just something like "USB polling mode" and "safe mode." the warning is in safe mode too and I dono how to use "USB polling mode".
however the only option is ADB, and I do not have an backup of the rom but another simillar phone to make copy or the update file, if possible to copy them via ADB which I am dono how; like which commands and where to copy them?
honestonline said:
it does not let me to do any interaction cause of the crazy warning. it asks for restart, thats all I can do, or other warnings like asking to do update or usb connection option or battery cover removed, but no more. it means I can not activate usb debugging if needed or follow update process through mobile UI. besides in this kind of phone there is no recovery mode but just something like "USB polling mode" and "safe mode." the warning is in safe mode too and I dono how to use "USB polling mode".
however the only option is ADB, and I do not have an backup of the rom but another simillar phone to make copy or the update file, if possible to copy them via ADB which I am dono how; like which commands and where to copy them?
Click to expand...
Click to collapse
same situation, no solution ???
ogabic said:
same situation, no solution ???
Click to expand...
Click to collapse
solution for this?
http://kazzi.net/tips-tricks/revive...r-deadly-close-the-battery-cover-message.html
found this but dont know how to adb .
but for sure on giving a missed call and following the idea in link u can use the phone but annoying error wont go away
I have the same problem but I cannot receive calls
Hello
A couple days ago I got a Garminfone from a friend, I use it mostly as a GPS only, because T-Mobile does not have any coverage in my country and I don't have the unlock code.
Yesterday I wanted to make a hard reset to start over, holding the D-pad left while powering on the phone, **WIPE USERDATA** appeared on the screen.
Everything was fine until it restarted, after the restart it showed the following warning: "Close the battery cover, and restart the device to complete first-time setup", the battery cover is closed and it does not let me do anything, the official ROM update does not install and If I do another hard reset the error persist and the phone does not make or receive calls.
Before this issue I got it rooted using z4root
Is it there anyway to update the device without using the update launcher from the phone?, or reinstall the 2.1 update using the usb cable via command prompt or any tool?.
I just want to get rid of this error and keep using the device as a regular GPS
Anyone can help?
I really appreciate any help you can provide.

Root Huawei U8652 Success!!!

Several people have been asking for help to root the Huawei U8652 (i.e. AT&T GoPhone Fusion U8652). After a little work, I figured out how to get this to work.
All previous users were having problems utilizing known techniques to root other Huawei phones of similar design.
Seems that the good folks at AT&T used a little trick to block the fundamental layers by which the root kits were using to gain access. It appeared that the phone had disabled certain logging features that would allow one to root the phone.
Here is how to do it (keep in mind you are doing this at your own risk, I am not responsible for any problems that you may encounter):
1. You need to install the latest Android SDK (search google for latest version)
2. download unlockroot v2.3
3. Follow the instructions and make sure that you have set your Settings > Development > USB Debugging box checked. I also set Unknown sources checkbox on.
4. Type in the following code on the phone keypad
*#*# 2846579 #*#*
This will open up the Service Mode
Go to Project Menu > Background Settings > Log Settings
Turn on Log Switch and set Log Level Settings to Verbose
go back one screen
Go to Dump and Log and place a check in all log settings.
Reboot the phone
Once rebooted use UnlockRoot and root you phone.
Confirm success by using a Terminal app from the marketplace (free) and when you open a terminal type su at the $ prompt. It will ask if you want to install SuperUser, accept. The terminal prompt should now read # instead of $ which means you are a root user.
Good Luck!
Tried your method but says "Not find devise"
i did it worked on huawei u8652 thanks dude
It Really Works, My Huawei is Finally Rooted. Thx
Thanks
Thanks, worked first time. Now to ADB and remove the ATT bloatware.
No device detected
Followed your guide but when i got to unlock root it would say that no device was detected but i had enabled usb debugging and the log files.
K SHOE did you install sdk manager that happened to me but i downloaded sdk manager and the plugins and it worked the second time
HUAWEIu8652 said:
K SHOE did you install sdk manager that happened to me but i downloaded sdk manager and the plugins and it worked the second time
Click to expand...
Click to collapse
what plugins are you supposed to install i installed the sdk manager and then nothing else was their somthing in manager i was supposed to install.
Nope doesn't work on mine either. But I have Android 2.3.5 so I am sure that's the issue.
K SHOE i downloaded the sdk manager that said android sdk r16 windows.zip opened sdk then installed a bunch of things or if you want i can unroot mine and make a tutorial for u and post it on utube
I like that idea !
HUAWEIu8652
I have tried and tried but when I read the compatibility version 2.3.5 is not listed.
Thanks
Update: Got it to work with superOneClick.
Worked like a charm on my daughters phone! I used superoneclick 2.3.3.
Ok so I downloaded SDK manager , put the cell on debugging mode also did the *#*# 2846579 #*#* step but when I connect my phone to de pc it doesn’t come up on superoneclick or ultra lock . Is there any particular package that I must download from SDK manager? Or am I missing any step in the proses? I have Android 2.3.5
Go here: http://forum.xda-developers.com/showthread.php?t=803682
It will tell you all you need to know. Make sure not AV software is running and that you are running it as admin on windows. I know it's scary but it's what's required to make it work. Good luck.
palalan said:
Go here: http://forum.xda-developers.com/showthread.php?t=803682
It will tell you all you need to know. Make sure not AV software is running and that you are running it as admin on windows. I know it's scary but it's what's required to make it work. Good luck.
Click to expand...
Click to collapse
Thank you very much man. I watched the video on the button and did exactly as it says. Once I connected the phone, in the general tab I pressed the Root button and it worked its magic. It works on 2.3.5, I used SuperOneClick2.3.3
Worked for me!
This process worked for me. UnlockRoot did not recognize my device on the first try, but after restarting my computer it went off without a hitch. Followed up the rooting with bloatware removal, now this phone is a true value. Thanks!
UPDATE: I purchased another one of these phones for my mother to introduce her to the world of smartphones. I rooted it using this method and it went pretty well. UnlockRoot did not recognize the device on the first try, but eventually picked it up and took care of business. I'm a noob to rooting and the android OS, so I figured I would pass along the easy method I went with to remove the AT&T bloatware. I downloaded link2sd (which is free) and after gaining superuser permissions, I used the "convert to user app" function on the bloatware. I then was able to move those apps to the SD card and then uninstall them. This might not be as efficient a process as using root explorer to delete the files, but for a noob it was much safer. I was able to free up over 70 MB of internal memory which finally allowed me to install more apps to the SD card.
SuperOneClick 2.3.3 worked for me. Awesome!
How do you reboot the phone?
I have a question:
How do reboot a huawei U8652 phone?
I need to know in order to continue...
worked like a charm!! thanks now i hope there a rom fo this phone.
sd_james said:
Several people have been asking for help to root the Huawei U8652 (i.e. AT&T GoPhone Fusion U8652). After a little work, I figured out how to get this to work.
All previous users were having problems utilizing known techniques to root other Huawei phones of similar design.
Seems that the good folks at AT&T used a little trick to block the fundamental layers by which the root kits were using to gain access. It appeared that the phone had disabled certain logging features that would allow one to root the phone.
Here is how to do it (keep in mind you are doing this at your own risk, I am not responsible for any problems that you may encounter):
1. You need to install the latest Android SDK (search google for latest version)
2. download unlockroot v2.3
3. Follow the instructions and make sure that you have set your Settings > Development > USB Debugging box checked. I also set Unknown sources checkbox on.
4. Type in the following code on the phone keypad
*#*# 2846579 #*#*
This will open up the Service Mode
Go to Project Menu > Background Settings > Log Settings
Turn on Log Switch and set Log Level Settings to Verbose
go back one screen
Go to Dump and Log and place a check in all log settings.
Reboot the phone
Once rebooted use UnlockRoot and root you phone.
Confirm success by using a Terminal app from the marketplace (free) and when you open a terminal type su at the $ prompt. It will ask if you want to install SuperUser, accept. The terminal prompt should now read # instead of $ which means you are a root user.
Good Luck!
Click to expand...
Click to collapse
Nice work!
I want to know though, if there is a way to unlock the AT&T Huawei U8652 without paying any code from any unlocking site?
Thank you

I need help with an apk that comes with a malware

Hi, everyobody. So, I've downloaded an apk for a multiplattform emulator that I used to have installed in my phone but lost when rebooting and happens to have been removed from the PlayStore. The thing is, said apk seems to come with a malware. I've done a couple of test to see if the malware was from somewhere else or if it comes from the phone's system but it seems like it comes in the apk of the emulator.
This malware installs some bloatware apps and even if I uninstall them, the malware just installs them again by itself. It also starts to take control of the phone. The malware, however, disappears if I do a factory reset. I tried opening the apk file with a file explorer and see what's inside the apk file to see if I could identify the malware files or whatever that triggers it and erase them from the apk, but unfortunately I lack the knowledge to tell what belongs to the emulator and is the malware.
I know it's a little bit silly of a help request, but I really like that emulator and I can't find a clean malware-free apk of it. If someone with knowledge on the subject has some spare time and is willing to help me with this silly request I would be really greatful to them.
Here's one of the few links to the apk. CAREFUL: don't install it, the malware seems to install itself in your phone's system and won't gomeven if you uninstall the emulator.
Retrogaming Emulator for Android for Android - APK Download
Download Retrogaming Emulator for Android apk 4.14.0 for Android. PSX Emulator, GBA Emulator, SNES Emulator, NES Emulator, PSP Emulator, TV Box
www.google.com
I have read the rules and I don't think I'm breaking them by asking help with this, but if I'm making something wrong or if this is not the place for asking for this kind of help, please let me know and I'll delete the post. Also, it would be nice if you could tell me what is a proper site for asking help with this.
Thanks in advance, everybody.
I wouldn't even attempt to download a known infected file
Scan it with online Virustotal and see what you got. You should have done this before side loading it... not very clever.
If it's not the cause a factory reset is in your future, and if you're running Android 8 or lower more may be required if its a rootkit.
Find and ID the malware and uninstall/delete it... if you can.
ZIGS318 said:
Hi, everyobody. So, I've downloaded an apk for a multiplattform emulator that I used to have installed in my phone but lost when rebooting and happens to have been removed from the PlayStore. The thing is, said apk seems to come with a malware. I've done a couple of test to see if the malware was from somewhere else or if it comes from the phone's system but it seems like it comes in the apk of the emulator.
This malware installs by itself again if I uninstall it and starts to take control of the phone. I tried opening the apk file with a file explorer and see what's inside the apk file to see if I could identify the malware files or whatever that triggers it and erase them from the apk, but unfortunately I lack the knowledge to tell what belongs to the emulator and what could not.
Click to expand...
Click to collapse
how does this malware manifest itself?
you can always run the apk through an online android-apk decompiler to get the source code and then look into it
ZIGS318 said:
Hi, everyobody. So, I've downloaded an apk for a multiplattform emulator that I used to have installed in my phone but lost when rebooting and happens to have been removed from the PlayStore. The thing is, said apk seems to come with a malware. I've done a couple of test to see if the malware was from somewhere else or if it comes from the phone's system but it seems like it comes in the apk of the emulator.
This malware installs by itself again if I uninstall it and starts to take control of the phone. I tried opening the apk file with a file explorer and see what's inside the apk file to see if I could identify the malware files or whatever that triggers it and erase them from the apk, but unfortunately I lack the knowledge to tell what belongs to the emulator and what could not.
I know it's a little bit silly of a help request, but I really like that emulator and I can't find a clean malware-free apk of it. If someone with knowledge on the subject has some spare time and is willing to help me with this silly request I would be really greatful to them.
Here's one of the few links to the apk. CAREFUL: don't install it, the malware seems to install itself in your phone's system and won't gomeven if you uninstall the emulator.
Retrogaming Emulator for Android for Android - APK Download
Download Retrogaming Emulator for Android apk 4.14.0 for Android. PSX Emulator, GBA Emulator, SNES Emulator, NES Emulator, PSP Emulator, TV Box
www.google.com
I have read the rules and I don't think I'm breaking them by asking help with this, but if I'm making something wrong or if this is not the place for asking for this kind of help, please let me know and I'll delete the post. Also, it would be nice if you could tell me what is a proper site for asking help with this.
Thanks in advance, everybody.
Click to expand...
Click to collapse
Did u just said malware can't be uninstalled even after doing factory reset. The malware is called xhelper that's a malware that can't be uninstalled once u get it.
Austinredstoner said:
Did u just said malware can't be uninstalled even after doing factory reset. The malware is called xhelper that's a malware that can't be uninstalled once u get it.
Click to expand...
Click to collapse
Yeah but that's on Android 8 and lower.
On Pie and above it can't do that.
It's a nasty little critter
blackhawk said:
I wouldn't even attempt to download a known infected file
Scan it with online Virustotal and see what you got. You should have done this before side loading it... not very clever.
If it's not the cause a factory reset is in your future, and if you're running Android 8 or lower more may be required if its a rootkit.
Find and ID the malware and uninstall/delete it... if you can.
Click to expand...
Click to collapse
Thanks for the advice.
xXx yYy said:
how does this malware manifest itself?
you can always run the apk through an online android-apk decompiler to get the source code and then look into it
Click to expand...
Click to collapse
Well, for what I've seen it's a malware that hides in the system files (I don't know where). Once there, it starts installing bloatware and spyware on the phone and starts to take control of things like the browser (mostly to show pages of ads and bets) and calls and messages. I can uninstall the bloatware apps, but the malware installs them again after some time has passed. After a Factory Reset, the malware is gone, that's how I realized the malware comes from the emulator apk. But Iike that emulator so I want to erase the malware from the apk. Also, thanks for the advice, I will try it. :"D
Austinredstoner said:
Did u just said malware can't be uninstalled even after doing factory reset. The malware is called xhelper that's a malware that can't be uninstalled once u get it.
Click to expand...
Click to collapse
No, I expressed myself wrong. The malware disappears after a factory reset. What I can't uninstall is the bloatware apps that the malware installs while it's in the phone. Once the malware is gone, so are the bloatware apps.
ZIGS318 said:
Once the malware is gone, so are the bloatware apps.
Click to expand...
Click to collapse
The hard reset deletes the malware together with the apps, what am I missing here?
Can't help with de-compiling but when I was investigating a malware outbreak, I turned off the system setting apk.
It later turned out to be ES file explorer and the apps were being installed via google play/mobile services.
Of course you can't change any settings but at least I could use the phone and nothing got installed.
Use the terminal/adb commands to turn off and back on when your done:
pm disable com.android.settings / pm enable com.android.settings
mobnoob said:
The hard reset deletes the malware together with the apps, what am I missing here?
Click to expand...
Click to collapse
I want to identify which parts of the app files are the maleare ones so I can delete them and get the app to be malware-free.
xdabookam said:
Can't help with de-compiling but when I was investigating a malware outbreak, I turned of the system setting apk.
It later turned out to be ES file explorer and the apps were being installed via google play/mobile services.
Of course you can't change any settings but at least I could use the phone and nothing got installed.
Use the terminal/adb commands to turn off and back on when your done:
pm disable com.android.settings / pm enable com.android.settings
Click to expand...
Click to collapse
Emmm...I didn't get that well. How do I enter that command? Thabks you for the answer, though.
ZIGS318 said:
Emmm...I didn't get that well. How do I enter that command? Thabks you for the answer, though.
Click to expand...
Click to collapse
ZIGS318 said:
Emmm...I didn't get that well. How do I enter that command? Thabks you for the answer, though.
Click to expand...
Click to collapse
He’s talking about ADB, android debug bridge.
That needs to be installed on ur pc and run while your phone is connected to the PC.
I’ll post a tutorial here.
K3V1991 said:
View attachment 5520451
NFO:
Code:
• Versions: Installer, Portable & ADBKit
• Android Debug Bridge & Fastboot updated to latest v1.0.41 (Version 32.0.0-8006631, January 2022)
Installer Features:
• Installation Folder chooseable
• Creates Desktop & Start Menu Shortcut
• Toolkit & Desktop Shortcut
• Creates Commands Shortcut
• View Commands List
• Add to System Path Environment
• Universal ADB Driver Installation
ADBKit:
• Pure ADB (Android Debug Bridge)
• Open CMD.bat to easily open a CMD
• Only 5.81MB (compressed 2.74MB)
Requirements:
Code:
• Windows OS
• USB Driver for your Device or Universal ADB Driver (Included in the Installer)
• PowerShell for the Toolkit
​Developer Options & USB Debugging:
Code:
01. Install the USB Driver for your Phone or Universal Adb Driver.
02. On your Phone, go to Settings > About Phone. Find the Build Number and tap on it 7 times to enable Developer Options.
03. Now enter System > Developer Options and find "USB debugging" and enable it.
04. Plug your Phone into the Computer and change it from "Charge only" to "File Transfer" Mode.
05. On your Computer, browse to the directory where you extracted the Portable Version or use Tiny ADB & Fastboot Shortcut.
07. Launch a Command Prompt with Open CMD.bat or use Tiny ADB & Fastboot Shortcut.
09. Once you’re in the Command Prompt, enter the following Command: adb devices
10. System is starting the ADB Daemon (If this is your first Time running ADB, you will see a Prompt on your Phone asking you to authorize a Connection with the Computer. Click OK.).
11. Succesful enabled USB Debugging.
Installer:
Code:
1. Download ADB_&_Fastboot++_vXXX.exe
2. Follow the Installers Instructions and select where you would like to install ADB & Fastboot++
3. After the Installation Wizard has completed you can select to start ADB & Fastboot++
4. You should see a Command Window open, now you can use ADB and Fastboot Commands
Portable:
Code:
1. Download ADB_&_Fastboot++_vXXX_Portable.zip
2. Extract the Zip Archive
3. Double click on Open CMD.bat
4. You should see a Command Window open, now you can use ADB and Fastboot Commands
ADBKit:
Code:
1. Download ADBKit_vXXX.zip
2. Extract the Zip Archive
3. Double click on Open CMD.bat
4. You should see a Command Window open, now you can use ADB Commands
Toolkit Features:​
• Uninstall Bloatware without Root Access
(This works because Applications truly aren’t being fully uninstalled from the Device, they are just being uninstalled for the current User
• Re-install uninstalled Apps
• Install Kernel (Popup Menu, reboots automatically to Bootloader)
• Install Recovery (Popup Menu, reboots automatically to Bootloader)
• Install APKs (Popup Menu)
• Push Files (Popup Menu)
• Check Firmware Version
• Check Android Version
• Check Kernel Version
• Check Firmware Build Date
• Check Kernel Build Date
• Check Security Patch Date
• Check IMEI
• Check IP Adresses
• Check App Packages
• Check Process Activity (Real Time)
• Take Screenshots (PNG Format)
• Video recoding - 30 Seconds (Without Device Sound)
• Video recoding - 60 Seconds (Without Device Sound)
• Video recoding - 120 Seconds (Without Device Sound)
• Video recoding - 180 Seconds (Without Device Sound)
• Reboot the Device
• Reboot to Bootloader
• Exit Bootloader to System
• Reboot to Recovery
• Create Logcat
• Exit (adb kill-server & close Toolkit)
Downloads:
• Installer
• Portable
• ADBKit
• Universal Adb Driver
View attachment 5521523
Donate Link​
Click to expand...
Click to collapse
You could try firewall blocking the app or maybe running under VMOS.
Personally I just ditch it...
There are decompiler apps that might enable you to defang it.
blackhawk said:
You could try firewall blocking the app or maybe running under VMOS.
Personally I just ditch it...
There are decompiler apps that might enable you to defang it.
Click to expand...
Click to collapse
Or there are perfectly “virus-free” emulators on the internet.
The malware will be downloaded by a background process. You need to find the link for the website and break it.
The best place to start would be an app that can log dns and ip calls, like Adguard. It will also block any already known links.
If you can break the link to prevent the apps installing its a start.. But as already suggested you are better off using a more up to date app because retroarch may not run correctly on newer tech.
Kenora_I said:
He’s talking about ADB, android debug bridge.
That needs to be installed on ur pc and run while your phone is connected to the PC.
I’ll post a tutorial here.
Click to expand...
Click to collapse
Yes the pm command was entered via adb from a PC via USB. A shell terminal on the device as a standard user never seems to have the right privileges to run the pm command but su - (superuser root) will.
shivadow said:
The malware will be downloaded by a background process. You need to find the link for the website and break it.
The best place to start would be an app that can log dns and ip calls, like Adguard. It will also block any already known links.
If you can break the link to prevent the apps installing its a start.. But as already suggested you are better off using a more up to date app because retroarch may not run correctly on newer tech.
Click to expand...
Click to collapse
Thanks for the advice! I'll see what I can do!
Kenora_I said:
He’s talking about ADB, android debug bridge.
That needs to be installed on ur pc and run while your phone is connected to the PC.
I’ll post a tutorial here.
Click to expand...
Click to collapse
Thank you for putting it more clear for me. I'll see what I can do when I get some free time!

Categories

Resources