[Q] Directory keeps reappearing: malware? - Android Q&A, Help & Troubleshooting

I have recently noticed a directory appearing in the root directory of my SD card entitled "SexyAlbum." I have not downloaded any apps or files remotely remotely related to anything that this name would suggest. And every time I delete the directory, it reappears within minutes. It is always empty, and always contains the subdirectories "Saved_images" (which is empty) and "cache," which contains another empty subdirectory called "images."
I have run anti-virus scans, but the scans don't seem to detect any virus or malware. However, since this directory reappears every time I delete it, I am convinced it's malware.
Any ideas on how to address this problem? It happens on both my ICS phone and my JB Nexus 7. Thanks.

There must be a app related to that! Go to manage apps and see if you can find the culprit!

Lifehacker7 said:
There must be a app related to that! Go to manage apps and see if you can find the culprit!
Click to expand...
Click to collapse
Thanks. After spending almost all day and night yesterday reformatting my devices, I figured out that this obnoxious directory appears to be installed by the Dolphin E-book add-on to the otherwise terrific Dolphin browser. This really shakes my confidence in Dolphin's integrity, or at least the integrity of its add-ons.

Related

[Q] Android File System Structure?!

Coming from Windows Mobile, I knew I was in for a bit of a shock. But I didn't realize it would be this bad.
You see, I have OCD when it comes to organization and cleanliness. It's pretty bad. On Windows Mobile, I had every program organized by category. I edited all the .cab files to install to "\Program Files\*CATEGORY*\App Name", and the shortcut to be installed to "\Start Menu\*CATEGORY*"
Everything was perfectly organized. On the root of my SD card, I had 2 folders - "My Documents" and "Program Files". There were no stray files on the root.
I had everything setup PERFECTLY with Sashimi so when I reflashed, I could run my script and all settings/apps would be restored.
I found the registry key for all settings and backed them up, made provisioning XMLs for all of my account settings, etc. Anything that needed to be saved between flashes would be saved to the SD card. When I flashed, everything would be back to the way it was an hour ago.
I LOVE my Evo 3D, but I'm getting incredibly frustrated with how insane the clutter is. Every app and its mother decides to make a folder on the root of my SD card. And half the time, they're empty folders. I just want to know:
1. How are settings stored in Android? In WM, there were registry keys for everything from backlight to email signatures. Where and how does Android store these settings?
2. How can I have an app completely installed on the SD card, so that if I hard-reset, all I need to do is put it's shortcut in the app drawer?
3. Are there any tools like Sashimi that streamline the hard-rest/reflash process?
4. Are apps hard coded to store files where they do? Or is there something like an XML file for the app that tells it to write to "%SDCARD%" instead of "%SDCARD\xxx"
Thanks in advance!
saumaun said:
Coming from Windows Mobile, I knew I was in for a bit of a shock. But I didn't realize it would be this bad.
You see, I have OCD when it comes to organization and cleanliness. It's pretty bad. On Windows Mobile, I had every program organized by category. I edited all the .cab files to install to "\Program Files\*CATEGORY*\App Name", and the shortcut to be installed to "\Start Menu\*CATEGORY*"
Everything was perfectly organized. On the root of my SD card, I had 2 folders - "My Documents" and "Program Files". There were no stray files on the root.
I had everything setup PERFECTLY with Sashimi so when I reflashed, I could run my script and all settings/apps would be restored.
I found the registry key for all settings and backed them up, made provisioning XMLs for all of my account settings, etc. Anything that needed to be saved between flashes would be saved to the SD card. When I flashed, everything would be back to the way it was an hour ago.
I LOVE my Evo 3D, but I'm getting incredibly frustrated with how insane the clutter is. Every app and its mother decides to make a folder on the root of my SD card. And half the time, they're empty folders. I just want to know:
1. How are settings stored in Android? In WM, there were registry keys for everything from backlight to email signatures. Where and how does Android store these settings?
2. How can I have an app completely installed on the SD card, so that if I hard-reset, all I need to do is put it's shortcut in the app drawer?
3. Are there any tools like Sashimi that streamline the hard-rest/reflash process?
4. Are apps hard coded to store files where they do? Or is there something like an XML file for the app that tells it to write to "%SDCARD%" instead of "%SDCARD\xxx"
Thanks in advance!
Click to expand...
Click to collapse
Long story short, it won't be easy. The answers aren't likely the most technically complete, but I believe them to be accurate.
1) I know someone has the answer.
2) There is no way to install 100% to SD card.
3) Titanium Backup, MyBackup, etc.. will all backup and restore your applications and settings. You can also take a complete image of the phone, using ClockworkMod. You can then restore all or part of that image. These all require root access.
4) As far as I know, I think it can swing both ways. It would require you to extract, modify, and repack the contents of the APK.
Man do I feel your pain! I absolutely hate the way android allows apps to be installed.
Don't even get me started on the lack of quit buttons on too many apps, or the way apps that have no business running in the background constantly start themselves in the background.
What's crackalackin saumaun. I haven't seen u since ppcgeeks. That's one thing that pissed me off with android when I came from windows mobile. Have you been with android or did u finally get rid of your tp2.
Sent from my PG86100 using Tapatalk
xenx said:
Long story short, it won't be easy. The answers aren't likely the most technically complete, but I believe them to be accurate.
1) I know someone has the answer.
2) There is no way to install 100% to SD card.
3) Titanium Backup, MyBackup, etc.. will all backup and restore your applications and settings. You can also take a complete image of the phone, using ClockworkMod. You can then restore all or part of that image. These all require root access.
4) As far as I know, I think it can swing both ways. It would require you to extract, modify, and repack the contents of the APK.
Click to expand...
Click to collapse
Thanks for the response. I'm going to be looking into those backup apps. But I fear I won't be able to do much more until the 3D is rooted.
touchprofan said:
Man do I feel your pain! I absolutely hate the way android allows apps to be installed.
Don't even get me started on the lack of quit buttons on too many apps, or the way apps that have no business running in the background constantly start themselves in the background.
Click to expand...
Click to collapse
That is definitely a pain too! I wish there was an option to close the browser so when I'm done, the next time I want to use the internet, I would be at my home page.
gmfeny said:
What's crackalackin saumaun. I haven't seen u since ppcgeeks. That's one thing that pissed me off with android when I came from windows mobile. Have you been with android or did u finally get rid of your tp2.
Click to expand...
Click to collapse
Hey man, it's been a long time! This is my first Android device. I just came from the TP2. In fact, it's sitting right next to me lol.

Gallery Question

Coming from the original Incredible, both when resetting the phone or mounting it as a disk drive on your computer would automatically make the gallery and music apps recheck and delete old files/folders and display the new ones, rather than displaying the triangle with a question mark in it that you would come across when deleting a file via Root Explorer or through other methods. However, this doesn't work on the Inc 4G. Resetting the phone deletes nothing, clearing data and cache for the App does nothing, and mounting and dismounting it via USB only removes links to pictures/videos on the internal SD card (which shouldn't be the only place available for saving everything in the majority of apps, nor should it be called 'sdcard' and the real SD card called 'sdcard2', but we'll address that later.)
Barring going through all folders and picking and choosing which triangle-question mark links to delete in the app itself, is there a way to prevent or rectify this annoyance?
IceDragon59 said:
Coming from the original Incredible, both when resetting the phone or mounting it as a disk drive on your computer would automatically make the gallery and music apps recheck and delete old files/folders and display the new ones, rather than displaying the triangle with a question mark in it that you would come across when deleting a file via Root Explorer or through other methods. However, this doesn't work on the Inc 4G. Resetting the phone deletes nothing, clearing data and cache for the App does nothing, and mounting and dismounting it via USB only removes links to pictures/videos on the internal SD card (which shouldn't be the only place available for saving everything in the majority of apps, nor should it be called 'sdcard' and the real SD card called 'sdcard2', but we'll address that later.)
Barring going through all folders and picking and choosing which triangle-question mark links to delete in the app itself, is there a way to prevent or rectify this annoyance?
Click to expand...
Click to collapse
ive come across this.
open the gallery app, then i are able to delete those from within the gallery app, just delete all the ! ones.
worked for me.
andybones said:
ive come across this.
open the gallery app, then i are able to delete those from within the gallery app, just delete all the ! ones.
worked for me.
Click to expand...
Click to collapse
I appreciate the thought. Yeah, I know that works, I was wondering if there was any way besides doing it manually.
IceDragon59 said:
Barring going through all folders and picking and choosing which triangle-question mark links to delete in the app itself, is there a way to prevent or rectify this annoyance?
Click to expand...
Click to collapse
-- sorry bro totally skipped over this part.

[Q] /system/bin/sdcard Process completely hogs Galaxy S3

Hello.
After reading all similar posts, and not finding any solutions I'm turning to XDA developers for help.
I own a brand new (3 month old) T999V Galaxy S3.
The phone is not rooted, and for now, I do not plan on rooting it , in order to keep the warranty.
Approx a month ago , I have noticed, that at times my phone becomes non responsive, and stays non responsive for many hours in a row, significantly heats up, and looses a lot of battery charge.
I have investigated the issue: process /system/bin/sdcard hogs 47-50% of the CPU.
Killing the process simply restarts it again, rebooting the phone does not help.
Galaxy S3 has a "build in" internal SD card, and I'm also using an external one.
I have tried using two different external SD cards, but result was the same.
I have tried running the phone without any external SD card - the result: /system/bin/sdcard at 45% of the CPU !
So it seems that external sd cards are not causing the problem.
I suspected, that a media storage might cause this issue: I had completely reset media storage - to no avail.
Any suggestions, short of "factory reset your device", are more than welcome.
Few illustrations are attached.
Anyone?
Anyone? No one willing to help with the issue?
Solution found
As I figured out that none is volunteering to help, I had resorted to figuring it out myself.
So first I'd like to properly describe the problem:
Every time the galaxy was rebooted, the phone was unresponsive for many hours in a row.
Using an android app called process monitor, I have established that the process that was occupying CPU was named, /system/bin/sdcard .
After reading some Android development documentation I came to a conclusion that the process itself is not to blame: /system/bin/sdcard is a process spanned by SD card access service, and the real culprit could be any application accessing the SD card.
My gut feeling told me that it is somehow related to the notorious media scanner. So I went to Settings>Applications>Running applications, and stopped application called Media. Then I cleared the memory , and suddenly CPU consumption was normal again.
So I found the "what" now I needed to figure "why".
Using android programming documentation again, I have determined that the way media scanner is working is by traversing all directories for all files, and then my bet was that the scanner is getting stuck in one of those directories.
In order to empirically detect which directory was problematic I have used "Storage analyser".
This is a tool showing the size of the folders, and I figured that if a scanner got stuck on a problematic folder, "Storage analyser" will also get stuck on it.
As predicted it got stuck on a following folder:
/Android/data/com.sec.android.allshare .
Using file browser I have determined that the folder contained around 62000 (yes sixty two thousand) files.
As it was impossible to browse within this folder (the file browser was getting stuck when entering this folder, I have simply deleted it.
Further investigation shown that the folder is getting regenerated after reboot, and it contains Samsung Allshare temporary files.
So that's it - removing the folder with a very large number of files has done the trick.
Now my phone works flawlessly, and I'm keeping my eye on the Allshare folder (Samsung shame on you).
So anyone with the "media scanner running slow" problem. Search your drive for a folder with exceedingly large number of files, and get rid of this folder (if you can).
Keywords:
Galaxy S3 high CPU consumption,Android high CPU consumption,Android media scanner slow, Galaxy S3 Slow, Phone is slow on boot.
Amazingly enough, I had this same issue, and I was up to 80k files. Took 3 hours to delete them all. What got me searching was the fact that my tumblr app stop animating gif files. Not sure how, but they were indeed related. Perhaps being rooted had something to do with it. Anyways, I've removed allshare, and there are no signs of temp files growing again.
Removing large folder resolves problem
I too had a similar problem on my Galaxy S3, however, I'm running CyanogenMod 10.1 and not the stock ROM, so my problem was not related to the Allshare app.
I started noticing terrible battery drain (suddenly), I knew something had to be wrong because my battery usually lasts forever, so I started digging. I found that the /system/bin/sdcard process consuming almost all of my battery (battery stats screen under settings).
So next I opened up SSH and connected to my phone's shell. Took a look at top and can see that /system/bin/sdcard was consuming all of my CPU constantly, thus draining my battery amazingly fast. After searching around a bit about this problem, I came across this thread (after looking at pages of similar error reports with no real answers). So I decided to see if I could tell what the sdcard process was doing with files.
So next I ran:
lsof | grep media_rw
Which will show you any files opened by the user media_rw (the user running /system/bin/sdcard)... this led me to the application and directory that was causing the problem. The application stores an image cache and that directory had over 60,000 files in it. Some oddities however, the folder did have a '.nomedia' file in it, which should have told the media scanner to skip it. The files were also not named with an image extension. Also, these files were not on the sdcard at all but the internal phone storage.
I decided to give deleting the files a try, so I did a
rm -f *
in that directory... I got an error message indicating that there were too many arguments... a limitation in the rm binary or the filesystem maybe as well. So I backed up a directory and did a rm -Rf on the directory, which after some time removed the files. Immediately my CPU and battery stabilized and are back to normal.
All of this makes me think that there is really just some limit around 60,000 (65K is a magic number?) to what the filesystem can handle in a single directory (efficiently).
Anyhow thanks for pointing me in the right direction.
Wouldn't putting .nomedia in the root of the folder prevent it from being scanned at all? Rather than deleting folders that you don't know the function of?

[Q] Game saves backup (ie. jetpack joyride)

Hello,
i wanted to backup my progress in jetpack joyride (and other games), but when i look to /data/data/ i don't see com.halfbrick.jetpackjoyride . Other games seems like don't have any save files at all. I have nexus7.
Thanks for guidance.
Is it called something else? That happens to me all the time. It confuses me sometimes...
~-~-~-~-~-~-~-~-~-~-~-~-~
Phone-Samsung Galaxy s2 t989 Hercules
Rom-Jedi Jelly 3.1
Kernel-Insecure Kernel
Radio-Lb7 blaze
~-~-~-~-~-~-~-~-~-~-~-~-~
I'm looking for help with making an app, message me if you are interested in helping!
Try searching in the Android/data folder or use titanium backup and take a backup of your data. Its sometimes more efficient if you don't know in which folder the data is stored.
Sent from my Xperia Pro using xda app-developers app
I also looked in Computer\Nexus 7\Internal storage\Android\data and the folder is not there. It seams to me like permission issue. Also i'm suffering from media server issue and cannot find file that is causing the trouble and i think it might be on the device just not visible to the world, just system or something like that.
Same thing with MLP i have folder Computer\Nexus 7\Internal storage\Android\data\com.gameloft.android.ANMP.GloftPOHM\files with files, but non of these files are save games, but the game on the device saves so again this would lead me to believe that this is security issue.
Savegame files are present in titanium backup output, so again - permissions i would guess. How can i make all of files on storage visible?
evlo said:
I also looked in Computer\Nexus 7\Internal storage\Android\data and the folder is not there. It seams to me like permission issue. Also i'm suffering from media server issue and cannot find file that is causing the trouble and i think it might be on the device just not visible to the world, just system or something like that.
Same thing with MLP i have folder Computer\Nexus 7\Internal storage\Android\data\com.gameloft.android.ANMP.GloftPOHM\files with files, but non of these files are save games, but the game on the device saves so again this would lead me to believe that this is security issue.
Savegame files are present in titanium backup output, so again - permissions i would guess. How can i make all of files on storage visible?
Click to expand...
Click to collapse
I think some Root Explorers might have an option to show hidden folders, not so sure though.

[Q] .tcookieid file....?

just noticed today a file, .tcookieid (33 bytes in length, dated yesterday, opened file, about 30 characters of Hex), has appeared on my M8 in every folder on my SD card, and is also on the root dir. anyone know what it is?
Have you recently installed ifonts app?
I saw that I also had this file throughout my sdcard.
The only thing I can think of is that it has something to do with how ifonts deals with replacing and/or backing up your current Fonts.
I found your post after a google search about it. But there is not much info about it (that I can find)
It may be that everyone knows what these .tcookied files are and me and you are a pair of idiots lol.
But I figured I'd post just so you wouldn't feel on your own!
I'm gonna keep searching for answers and if I find anything I'll let you know.
All the best rich
whoamigriffiths said:
Have you recently installed ifonts app?
I saw that I also had this file throughout my sdcard.
The only thing I can think of is that it has something to do with how ifonts deals with replacing and/or backing up your current Fonts.
I found your post after a google search about it. But there is not much info about it (that I can find)
It may be that everyone knows what these .tcookied files are and me and you are a pair of idiots lol.
But I figured I'd post just so you wouldn't feel on your own!
I'm gonna keep searching for answers and if I find anything I'll let you know.
All the best rich
Click to expand...
Click to collapse
there could have been an update to ifonts recently, in the past few days, cant really remember as i have so much stuff getting updated daily. but ifonts makes sense as to what is making this small file. its harmless anyway, just wondered why it was appearing. surprised no one else has picked up on it here on XDA (apart from ourselves)...
Hello there,
Even i stumbled upon this post from the Google keyword query, my SD card was displaying as being damaged, so i was closely examining the contents of my SD card and i found this newly created file.
It was only in the root path of the SD card, nowhere else.
Even i think that this file might have belonged to iFonts, i have uninstalled the app and removed the file after iFont messed up my factory font restoration pretty badly.
same here
On every folder on my sdcard appeared a file called .tcookieid with a strange code inside
I just installed some new application this afternoon, i am 100% sure that i hadnt it some hours ago.
If someone know what is the cause or what is this please let me know.
I cant find nothing on google
Just found it myself..delete some of it..i hope it doesnt affect my files.....curious?????
Sent from my LG-D802
Well iFont has never even been near my device, I hadn't even heard of it until this thread. So either something else creates it too or it's nothing to do with iFont.
These little buggers are all over my SD card and internal storage.
I have the same issue on my LG G3.
I've never heard of iFonts, So why there are so many .tcookieid files all over my Internal AND External SD cards?!
krashd said:
Well iFont has never even been near my device, I hadn't even heard of it until this thread. So either something else creates it too or it's nothing to do with iFont.
These little buggers are all over my SD card and internal storage.
Click to expand...
Click to collapse
+1
Totally same
i have it all over my sd card
+1, Z2, no IFonts ... weird ...
find . -type f -name ".tcookieid" -exec rm -f {} \;
Not sure what it is. I found one website which gave information stating that it's recognized as a form of a Trojan virus that collects info and sends it somewhere. Can't verify that, however, if you want to remove them all then open up terminal, change directory to root of internal sdcard and copy paste the command above. Do the same for external sdcard as well.
I haven't seen them come back yet, but if it does, then best believe I have every intention of wiping my device out and restoring with a pure stock Rom.
EDIT: I noticed that it's not just the internal and external storage. Its everywhere on the device. However, I still have not seen it come back on my device since I have removed them.
same issue, not that alarming
I believe they are a direct link to a cookie on websites to keep track of your browser traffic, lots of websites use them, some more aggressively than others, I just delete them through 7zipper 2.0. If you stay on top of it, check once a week, it doesn't get too out of hand.
Read this article; type in your browser "what is a cookie?' And click the link, ".... All about cookies" I can't post links yet, sorry.
Correct me or add to if you find anything else
simes6600
simes6600 said:
just noticed today a file, .tcookieid (33 bytes in length, dated yesterday, opened file, about 30 characters of Hex), has appeared on my M8 in every folder on my SD card, and is also on the root dir. anyone know what it is?
Click to expand...
Click to collapse
It's more of a headache than a threat, its a file that allows websites to keep up with browsing history on websites to give suggestive sites on your mobile browser through their cookies. Read this article and put 2&2 together. Type in "All about cookies" in your browser, I can't post links yet, sorry. I just monitor my files closely and it doesn't get out of hand checking once a week, but that would depend on how much you surf and what sites you go to. Hope this helps!
Fill me in on any extra details
krashd said:
Well iFont has never even been near my device, I hadn't even heard of it until this thread. So either something else creates it too or it's nothing to do with iFont.
These little buggers are all over my SD card and internal storage.
Click to expand...
Click to collapse
Me too never had that app but many others have come and gone. I have this file and many others stored in "miscellaneousfolder" or whatever on my Samsung Galaxy s5. I'm going on a deleting spree and still the numbers don't add up and oddly enough the bar reflecting the slices of memory shows a larger, I believe more accurate, slice of free space than my phone is telling me. Ugh I'm just gonna get a bigger SD card it'll probably solve everything.
How do I remove .tcookieid files?
I also have this problem. The files are all over my internal SD card and I need to get rid of them. Are they dangerous files?
I'm pretty sure it is caused by games that offer all sorts of in-app free stuff if you watch videos and such. As the name suggests it's a tracking cookie.
Sent from my LG G3-D855
.tcookieid
I too have found this file, it came from xmodegame which i had install for clash of clan. I think the file contain some kind of ID, for further exchange of data, this app get root permision and voilate privacy by tranmiting other data too. I have install in rooted device, my suggetion to refresh the ROM. Rest phone works only with non rooted device with root and also granted root, my guggetion is that refersh your ROM asap. 5his is leach (worm).
It is a kind of permanent marking. For each directory, the file has the same contents. After installation Xposed with xprivacy and refusal to provide android id, my device has been so marked. It is best to install the new clean rom.
Is it anyhow lethal to my data or my sd card .? should i worry about it .? help will be appreciated

Categories

Resources