Database Info

[Q] Antivirus s/w detected malware in my settings

Hi Everyone,
OK, I am completely new to using tablets and android (and XDA! ) but I recently bought an Android tablet and although I put AV s/w on it I seem to have caught a bug. The problem is that, apparently, my settings app is now malware and it seems the only option to resolve it is to uninstall my settings application. Understandably I don;t want to forge ahead and do this because then I cannot manage my device. Anyone got any suggestions or can point me somewhere that could help? I have trawled the internet for an answer but haven't found anywhere reporting the same thing, so far. I am flummoxed and getting very frustrated. Also, any recommendations for malware prevention apps? Ta.
Thanks for taking time to read this. Sorry if it's in the wrong place!

You do know you should provide more details like which phone, which firmware, what antivirus app, etc.
But the simplest answer you would get is to stop using antivirus apps. Because most of them are hoaxes or give false results. There is nothing wrong with your settings app. I suggest you uninstall the AV app first.

immortalneo said:
You do know you should provide more details like which phone, which firmware, what antivirus app, etc.
But the simplest answer you would get is to stop using antivirus apps. Because most of them are hoaxes or give false results. There is nothing wrong with your settings app. I suggest you uninstall the AV app first.
Click to expand...
Click to collapse
It's not a phone, it's just a no-mark tablet (Tabtronics, if that makes any difference).
Seeing as the last several days (maybe a week now) it has had serious performance issues -- crashing, rebooting itself without my initiating it, not turning on for long periods, notification messeges telling me apps don't work when I have never tried to use them -- I'd say this is not a false result. And the AV (Avast) is the same brand I've been using on my desktop for years and has always been fiine, and I've had no problems with it until the last week.
Seems odd that the assumption here is that there isn't a problem, when there are a shed load of articles online stating how vulnerable Android is to malware. Unfortunately I can't find any that tell you where to go/ what to do in order to get rid of the bug. :crying:
Anyway, thanks for the reply.

BlankScreen said:
It's not a phone, it's just a no-mark tablet (Tabtronics, if that makes any difference).
Seeing as the last several days (maybe a week now) it has had serious performance issues -- crashing, rebooting itself without my initiating it, not turning on for long periods, notification messeges telling me apps don't work when I have never tried to use them -- I'd say this is not a false result. And the AV (Avast) is the same brand I've been using on my desktop for years and has always been fiine, and I've had no problems with it until the last week.
Seems odd that the assumption here is that there isn't a problem, when there are a shed load of articles online stating how vulnerable Android is to malware. Unfortunately I can't find any that tell you where to go/ what to do in order to get rid of the bug. :crying:
Anyway, thanks for the reply.
Click to expand...
Click to collapse
Here's a good discussion that might interest you:
http://forum.xda-developers.com/showthread.php?t=2186782
As for the issues you have, I would attribute it to either a rogue app or low memory. Try uninstalling any apps you recently installed. Also, try clearing app caches, freeing memory etc. See if that helps.

Chrome Home Page changed

A few days ago out of the blue my homepage in Chrome was changed from https://www.google.com to http://portal.fly2tech.com/?channel=13#!/, without me doing so. So i ran a malware check with Malwarebytes and nothing, so better safe than sorry i start looking at apps, com.android.partnerbrowsercustomizations.example is showing as a normal app, whereas before it was a hidden system app. My phone is running stock MM 6.0.1 with Nov 2016 security patches. Not rooted with stock recovery. As a precaution I did a factory reset, and everything was fine then just about an hour ago it changed again, to the fly2tech portal as homepage, i went into apps and the com.android.partnerbrowsercustomizations.example program was showing again, i selected the three dot menu in upper right and clicked uninstall update, at which point i was prompted if i wanted to revert a system app to previous version, I clicked yes, and it disappeared from apps back to hidden system app. I uninstalled chrome just to make sure I was getting a clean copy and so far no more fly2tech portal. I have fired off a support request to Alcatel. I certainly hope they are not pushing this garbage out to customers. Or there is a vulnerability that needs fixed!!! A google search has indicated this has happened to one touch devices from all I have seen....
Anybody else having this problem??

oops, Clicking that link crashed a few apps on my Chrome. Weird how that could be an Alcatel thing.

Huskied said:
oops, Clicking that link crashed a few apps on my Chrome. Weird how that could be an Alcatel thing.
Click to expand...
Click to collapse
It did it again, i rolled back system app, they have also pushed an update to their updater app, I have disabled automatic updating of system and system apps, hopefully it doesn't do it again. I called Alcatel support today, they didn't deny it was them, but they created a ticket and will get back with me.

So I just got a phone call from Alcatel support, they are investigating, the guy said they are in touch with the dept in charge of FOTA updates to see if its something they are pushing or if there is a vulnerability at play. At least they are interested enough to actually call me for details....

Interesting....

That's what is usurp my stock browser for over a month. I set homepage to google.com but it's​always changed autonomous to this portal thing. It's like some mw on Windows doing it's job. Weird.
Sent from my 6045K using Tapatalk

Nikola Jovanovic said:
That's what is usurp my stock browser for over a month. I set homepage to google.com but it's​always changed autonomous to this portal thing. It's like some mw on Windows doing it's job. Weird.
Click to expand...
Click to collapse
At this point I'm convinced Alcatel is pushing the customization, via the system update, and not any malware.... But they have no right to choose my homepage. I have blocked automatic updates to system and system apps so I'm going to run a few days and see if that fixes it...

I'm ​not sure that is the case cause mine have been disabled long time before this happened...
Sent from my 6045K using Tapatalk

Nikola Jovanovic said:
I'm ​not sure that is the case cause mine have been disabled long time before this happened...
Click to expand...
Click to collapse
Well the problem has not repeated itself, since disabling automatic system app updates. I'm still waiting to hear back from Alcatel USA. I find it hard to believe they would force a customization on a phone that is not subsidized, and I could be entirely wrong about it being them, regardless if it's them or not, I don't think I should be forced into using a portal that keeps resetting itself to the homepage. If it's Alcatel, they need to stop, if it's a security vulnerability I hope they patch it.

I doesn't make sense. I've checked my updates to found out that i freezed the update app in titanium backup prior this homepage changes.
Sent from my 6045K using Tapatalk

Nikola Jovanovic said:
I doesn't make sense. I've checked my updates to found out that i freezed the update app in titanium backup prior this homepage changes.
Click to expand...
Click to collapse
Well i spoke too soon, it has happened again, i guess until I get an answer I'm, just going to have to keep uninstalling updates to com.android.partnerbrowsercustomizations.example. which really stinks. If it gets too bothersome I'll just get a new phone

Weird stuff. I'm looking towards note7r
Sent from my 6045K using Tapatalk

So Alcatel wants to send me another Idol 3 and wants to analyze my current phone... I'm glad they are taking this seriously

I have just discovered the same thing on mine. I'm going to freeze com.android.partnerbrowsercustomizations.example in Titanium Backup, and see what happens.

Fiasco said:
I have just discovered the same thing on mine. I'm going to freeze com.android.partnerbrowsercustomizations.example in Titanium Backup, and see what happens.
Click to expand...
Click to collapse
I have to call back the rep from alcatel us support Tomorrow afternoon, they want to examine my phone, not sure how comfortable I am sending my phone back to them, I will remove as much sensitive info as I can, but don't want to strip it bare, I want them to get to the bottom of the problem, but not sure how invasive they will be, but if it helps to stop the problem I guess it's worth it.... They are going to send me another Idol 3 to use while they investigate.... I thought about just doing an OOB restore via Mobile Upgrade Q, but if it's a vulnerability eventually it will creep back up on me, I guess the best bet for all of us is to let Alcatel disect my phone and determine how they can plug it....

Alcatel can always pull your info anytime anywhere you have connection to internet, as google and app developers.. so don't trip you are already been examined.
Sent from my 6045K using Tapatalk

It's not a "bug" it's intentional. I froze it with Titanium Backup then after a couple of days I removed it completely. No more homepage jacking.
Of course, you must be rooted to do this.

Fiasco said:
It's not a "bug" it's intentional. I froze it with Titanium Backup then after a couple of days I removed it completely. No more homepage jacking.
Of course, you must be rooted to do this.
Click to expand...
Click to collapse
Ok so Alcatel is acknowledging the issue and has asked that I refrain from making any modifications to device, including restore via Mobile Upgrade Q. At this point im sure someone at TCL has dropped the bomb, but I'm getting the feeling even the US support team knows this isn't gonna fly. If they want to force it, then push your own browser, don't mess with Chrome, I like my settings just the way they are. I'm giving it another week tops, then I shall root and set up my phone where it can't be violated. I can see a phone company forcing customizations on subsidized phones, but not on an unlucked phone bought outright....

So looks like they stopped pushing it...

Should we reset the phone to factory then? can't they just send an update?

Annoying "no location" popup on boot

Hello everyone.
I decided to post this question here instead of my specific device's forum because I believe it is an issue of android itself, not my phone.
Since a couple of days ago, there is an annoying popup that appears on every boot, right after I unlock for the first time. The message reads:
No location access
Device location for all apps is
turned off, and you might not be
able to locate your device if it's
lost.
Yes, I'm aware of that, since I keep my location off for privacy and battery concerns, and that popup annoys me because it's an extra step for me to take. I suspect it's generated by Google Play Services, but I can't be sure.
Has anyone else seen it? Any ideas to disable it?

BreadedChicken said:
Hello everyone.
I decided to post this question here instead of my specific device's forum because I believe it is an issue of android itself, not my phone.
Since a couple of days ago, there is an annoying popup that appears on every boot, right after I unlock for the first time. The message reads:
No location access
Device location for all apps is
turned off, and you might not be
able to locate your device if it's
lost.
Yes, I'm aware of that, since I keep my location off for privacy and battery concerns, and that popup annoys me because it's an extra step for me to take. I suspect it's generated by Google Play Services, but I can't be sure.
Has anyone else seen it? Any ideas to disable it?
Click to expand...
Click to collapse
I have. And you're right. Its generated by Google Play Services. I got rid of it by disabling a bunch of Google Play Service's services

Freewander10 said:
I have. And you're right. Its generated by Google Play Services. I got rid of it by disabling a bunch of Google Play Service's services
Click to expand...
Click to collapse
Thank you very much for your confirmation.
Do you remember by any chance which services did you disable to get rid of the popup? I'm betting doing that will screw up google maps and possibly some other gapps, but I'm willing to do it because that popup is sooo annoying.
Thanks.

BreadedChicken said:
Thank you very much for your confirmation.
Do you remember by any chance which services did you disable to get rid of the popup? I'm betting doing that will screw up google maps and possibly some other gapps, but I'm willing to do it because that popup is sooo annoying.
Thanks.
Click to expand...
Click to collapse
Disabling them will cripple the device's location services. Though you'll probably still be able to get your location info by using the GPS only.
Here are the services I disabled
com.google.android.gms/com.google.android.gms.locationsharing.service.LocationSharingSettingInjectorService
com.google.android.gms/com.google.android.gms.nearby.connection.service.NearbyConnectionsAsyncService
com.google.android.gms/com.google.android.gms.clearcut.service.ClearcutLoggerService
com.google.android.gms/com.google.android.gms.clearcut.service.PlayLogBrokerService
com.google.android.gms/com.google.android.gms.common.stats.GmsCoreStatsService
com.google.android.gms/com.google.android.location.fused.FusedLocationService
com.google.android.gms/com.google.android.location.internal.PendingIntentCallbackService
com.google.android.gms/com.google.android.location.geocode.GeocodeService
com.google.android.gms/com.google.android.location.network.NetworkLocationService
com.google.android.gms/com.google.android.location.internal.GoogleLocationManagerService
com.google.android.gms/com.google.android.location.geofencer.service.GeofenceProviderService
com.google.android.gms/com.google.android.location.internal.server.GoogleLocationService
com.google.android.gms/com.google.android.location.reporting.service.LocationHistoryInjectorService
com.google.android.gms/com.google.android.location.reporting.service.DispatchingService
com.google.android.gms/com.google.android.gms.mdm.services.NetworkQualityAndroidService
Finding them all might be a bit tedious so here's a backup you can restore using DisableService from the Playstore

Woah, that's mighty cool of you. Thanks! I appreciate it.

BreadedChicken said:
Woah, that's mighty cool of you. Thanks! I appreciate it.
Click to expand...
Click to collapse
No problem bro

Freewander10 said:
No problem bro
Click to expand...
Click to collapse
Mine still appear after disabling services you mentioned

evildog1 said:
Mine still appear after disabling services you mentioned
Click to expand...
Click to collapse
That's weird.
Did you go about disabling them manually? Or by using the DisableService backup?

Freewander10 said:
That's weird.
Did you go about disabling them manually? Or by using the DisableService backup?
Click to expand...
Click to collapse
Using backup. I double-checked and they are disabled

On my Note 4 I noticed an auto update a few days ago which I couldn't stop.
Today, my Skype auto logged out and when I tried to log in I couldn't. I entered my password 4 times and I couldn't log in. I tried login into my PC and it was fine so it wasn't a problem with my password.
So I restarted my note 4 and got this "No location access" pop-up. However I was able to login to Skype.
Are these two things connected? It seems weird. And the pop-up is blatantly scaremongering saying if location is disabled the phone cannot be tracked if it's lost.. yeah Google, on yer bike.

evildog1 said:
Using backup. I double-checked and they are disabled
Click to expand...
Click to collapse
Okay. Try restoring this backup instead. I'm 100% sure it'll work because thats my current config and I'm pop up free. It seems to have broken the smart lock feature though. But if you don't mind/use that then you should be fine.
citta said:
On my Note 4 I noticed an auto update a few days ago which I couldn't stop.
Today, my Skype auto logged out and when I tried to log in I couldn't. I entered my password 4 times and I couldn't log in. I tried login into my PC and it was fine so it wasn't a problem with my password.
So I restarted my note 4 and got this "No location access" pop-up. However I was able to login to Skype.
Are these two things connected? It seems weird. And the pop-up is blatantly scaremongering saying if location is disabled the phone cannot be tracked if it's lost.. yeah Google, on yer bike.
Click to expand...
Click to collapse
I really don't know. Maybe it was just a minor glitch/bug in the app. It does seem weird though. But if you're interested in getting rid of the pop up then check the post above.

I just disabled preference service. And the popup is gone.

Freewander10 said:
Okay. Try restoring this backup instead. I'm 100% sure it'll work because thats my current config and I'm pop up free. It seems to have broken the smart lock feature though. But if you don't mind/use that then you should be fine.
Your backup also not working, annoying popup still come back on boot
I really don't know. Maybe it was just a minor glitch/bug in the app. It does seem weird though. But if you're interested in getting rid of the pop up then check the post above.
Click to expand...
Click to collapse
Akmal_hyperion said:
I just disabled preference service. And the popup is gone.
Click to expand...
Click to collapse
Thanks it works

Akmal_hyperion said:
I just disabled preference service. And the popup is gone.
Click to expand...
Click to collapse
Running the following on boot works for me too. Any idea what else it disables?
Code:
pm disable com.google.android.gms/com.google.android.location.util.PreferenceService;

Issue with Coolpad Torino R108 (CoolReaper?)

My cell phone still is under guarantee protection but I it doesn't help. Well, I discovered few times strange app installed w/o my action with Chinese title, something like eNews or feed app. I deleted it and thought that's all. After some time I started to receive push notification with red background and yellow Chinese sign! In same time I discovered again same app and stock app Sim1 changed its name into something Chinese! After factory reset I thought everything is OK but it last just 3 weeks and same game again! Malwarebytes detect Wireless Update as culprit for this "feature" but it wasn't able to solve problem as this app is part of OS! I have read many facts about Coolpad.Coolreaper.a so I planned to remove this nasty part from my device but don't know how? Service officer didn't find out nothing suspicious after few days of observation and blamed me for click onto ads and adverts links!
Please help me!

Hey there, did you solve the problem with the Coolreaper?
I have the same problem, i just flashed with another Official ROM but Malwarebites finds again the Coolreaper. Now going to wait few days to see if its going to start installing the apps again...
https://forum.xda-developers.com/general/general/coolpad-torino-r108-max-lite-y91-u00-t3735792
ludush1 said:
My cell phone still is under guarantee protection but I it doesn't help. Well, I discovered few times strange app installed w/o my action with Chinese title, something like eNews or feed app. I deleted it and thought that's all. After some time I started to receive push notification with red background and yellow Chinese sign! In same time I discovered again same app and stock app Sim1 changed its name into something Chinese! After factory reset I thought everything is OK but it last just 3 weeks and same game again! Malwarebytes detect Wireless Update as culprit for this "feature" but it wasn't able to solve problem as this app is part of OS! I have read many facts about Coolpad.Coolreaper.a so I planned to remove this nasty part from my device but don't know how? Service officer didn't find out nothing suspicious after few days of observation and blamed me for click onto ads and adverts links!
Please help me!
Click to expand...
Click to collapse

Unfortunately its part of coolpad's system core programs and I havent found any way of removing it... Nasty piece of work from them to include something like that.. but I guess it serves me right for buying a phone made by them... I guess I will either stay away from any chinese made phone in the future - coolpad for certain, but if they are allowed to do this then I dont see what is there to stop other chinese companies from doing the same... very dissapointed.... but not surprised really...

Popup

I am unable to use my new Teclast 40 tablet because when an app starts up and is working fine a popup appears saying `xxx keeps closing... ' and there is no option to dismiss the false warning. I have ran 2 anti virus plus Malawarebytes and my device is clean. Help please!

Guayruro said:
I am unable to use my new Teclast 40 tablet because when an app starts up and is working fine a popup appears saying `xxx keeps closing... ' and there is no option to dismiss the false warning. I have ran 2 anti virus plus Malawarebytes and my device is clean. Help please!
Click to expand...
Click to collapse
Does the 'xxx' in the warning message stand for an app name? Are you sure from which app the message was?

Do a factory reset. Nothing to loose if you haven't used it much.
Be careful what you load next time... if you did load any apps on it.

James_Watson said:
Does the 'xxx' in the warning message stand for an app name? Are you sure from which app the message was?
Click to expand...
Click to collapse
I came up with this in a google search:
[solved] All my apps (even system) crash randomly, Asus can't fix it
Hi, At some times my ASUS ZenFone 3 (ZE520KL) phone is unusable but Asus's after-sales service does not find the problem and simply updates it when I send it to them. I haven't figured out what's causing the problem. This can happen to me...
forum.xda-developers.com
If a factory reset doesn't solve it, it may be a hardware failure.

blackhawk said:
I came up with this in a google search:
[solved] All my apps (even system) crash randomly, Asus can't fix it
Hi, At some times my ASUS ZenFone 3 (ZE520KL) phone is unusable but Asus's after-sales service does not find the problem and simply updates it when I send it to them. I haven't figured out what's causing the problem. This can happen to me...
forum.xda-developers.com
If a factory reset doesn't solve it, it may be a hardware failure.
Click to expand...
Click to collapse
Hello all,
Thank you so much for the replies. I did manage to sort this out. It is a corruption of Google Play Services. Uninstalling and installing it again solves the problem.
This happens frequently, I gather, as I found online many people facing the same problem

Guayruro said:
Hello all,
Thank you so much for the replies. I did manage to sort this out. It is a corruption of Google Play Services. Uninstalling and installing it again solves the problem.
This happens frequently, I gather, as I found online many people facing the same problem
Click to expand...
Click to collapse
Yay
Clearing it's data may be all that's needed.
I clear this messy apk's data a lot as well as firewall block it most of the day.

Guayruro said:
Hello all,
Thank you so much for the replies. I did manage to sort this out. It is a corruption of Google Play Services. Uninstalling and installing it again solves the problem.
This happens frequently, I gather, as I found online many people facing the same problem
Click to expand...
Click to collapse
I forgot to mention that I had written the string "xxx" to mean that the problem appeared with any and all my apps.