How to Block Pre-Installed Auto App Installer Malware?

First, you could make that folder "un-writeable" easily without rooting. As it's located on the SD card, and you're on a pre-Kitkat device, any app should have full access there:

1. Get yourself a file manager


2. navigate to /sdcard/.sysAndroid


3. delete the Download folder


4. create a new text file called Download, and make it read-only

Now, that malware app can no longer create the directory, as a file with the same name is in that place.

For other measures, we'd need more details (and I could update my answer then):

• go to Settings › About Phone and check what Android version is running on the device


• find out which app is installing the unwanted apps. I didn't test it with pre-Icecream devices, but my tool Adebar should be capable of that¹: Among other things (which require at least Kitkat), it creates a list of apps installed on the device, grouped by their installer (see here for an example: as you will notice, the package name of the installer is noted along). If your Android version indeed is older than 4, you most likely will not be able to "kill" that app, but other measures might be known.

¹ _{Adebar will require adb installed on your computer, and Bash being available – so a Linux machine is best suited for that. But it's reported to work well on a Mac, and even on a Windows machine running Cygwin.}