Malicious Virus/Trojan on my phone, hard to remove

Question

I have been recently concerned about a malicious software on my phone, basically - the trojan/virus acts silently in the background, it increases battery drain, gives regular (and system apps) overpowered permissions and installs 'icon' programs that are a link shortcut to a possibly malicious website which I would rather not like to open.

The built-in browser is like an infected zone in which I do not go because its filled with ads, fake 'virus' warnings for every site I open.

Some of the recent 'icons' that have been downloaded are named 'loopscoop' and a what seems to me - possibly named Japanese or Chinese game, can't really tell by the letters. Here are the images.

INFO: Factory resets did not work, nor did Malwarebytes or any other antivirus detect it. It's a VIVAX FLY 3 phone.

— Confused Tom | Sources

Answer

Those malwares install as system apps and cannot be removed by uninstalling as regular apps, even hard resetting won't get rid of them.
The only solution is either to flash the whole phone or manually remove the aps with ADB shell but root privileges is a must. You need also to know the package name of the app.

Root your device

Install USB drivers for your device

Install BusyBox (adds extra commands that help with sticky malwares that even root can't uninstall, such as those with immutable attribute...)

Install Minimal ADB and Fastboot

Enable USB debugging (Settings > About > Hit 7 times on build number > Back in settings > Developer Options > USB debugging)

Connect the device with USB cable then open minimal ADB and Fastboot.

A Windows terminal should comes up.
type adb devices : Displays some serial numbers which means the phone is detected.

Type su : To get root privileges. Check on the phone screen for any prompt.

Now mount the file system as read-write: mount -o remount /system rw

Now go to the app folder: cd /system/app then list all installed apps: ls

Now simply delete any suspicious app with rm malwareName.apk

Note: You may encounter with malwares that refuse to be unistalled. This is where BusyBox comes to the rescue.

First check for their attribute: lsattr

Those which can't be removed should have the immutable attribute, therefore even root cant delete such file.

Clear the immutable attribute : chattr -i *.* or specifically chattr -i malwareName.apk

Now you should be able to remove that malware.

Hope this helps you.

— esQmo_ | Sources

Malicious Virus/Trojan on my phone, hard to remove

Topics