Related
I have noticed these chinese apps some how self installing on my S2.
Any idea how to get to the source of these unauthorized installs? (Lookout & AVG & NetQin don't detect them as malicious or find any reason for how they are getting on there).
Currently using KH3 + CFRoot.
Why do people give so little information when they post?
What Chinese apps? (Please provide a screen shot if the app name is in Chinese) .
This sounds really really bad.
Has this happened to any one else?
It should not be possible for this to happen.
Does your phone have any connection with China or have you installed any Chinese software?
If this is happening then you must have done something yourself to start the process. Nothing can install itself without your consent, unless there's malicious software that's bypassing the system and installing for you, but you would have had to install that first.
So, as above, a lot more information is needed. Personally, I'd just do a complete wipe and hard reset and never install anything from untrusted sources again, including warez, 3rd party app stores and the Chinese Market, which is known to have had dodgy software before now.
My friend got an S2 from China and it was preloaded with all those Chinese apps. Examples include QQ Security Suite and some other apps. I used Titanium Backup to uninstall but after each restart, the app re-appears!
I was surprised that Titanium couldn't uninstall. It says it uninstalled successfully but it just re-appears. The only thing I could do is to do a re-flash to a Hong Kong firmware without all those pre-loaded Chinese apps.
But before you wipe everything, please help us try and find out how it happened?
Again has this happened to any one else? Because I want to know if this could happen to my phone!
Mine also did this on stock rom i would uninstall samsung apps reboot and it would reappear on my menu. Is it possible the rom comes with an auto install script for the preloaded apps?
Sent from my GT-I9100 using XDA App
otester said:
I have noticed these chinese apps some how self installing on my S2.
Any idea how to get to the source of these unauthorized installs? (Lookout & AVG & NetQin don't detect them as malicious or find any reason for how they are getting on there).
Currently using KH3 + CFRoot.
Click to expand...
Click to collapse
If you have CF-Root, you have super user installed. Review your permissions. You can also install LBE privacy guard and set permissions for all apps as well, including many system apps (you'll need to 'untrust' them first).
Sent from my GT-I9100 using XDA App
Sorry for the little information guys, was 5am and very tired
I deleted the second incarnation of the app as soon as I saw it (worried about personal details being taken etc.) however it if it reappears again then I will screenshot it.
Virus scanners don't detect them as malicious, when the program opened (after stealth install) I went through it, albeit in Chinese it looked like a legit program and the menu worked etc.
I have market 3.1.3 installed (got the apk off the internet) and a few apps that got removed from the market place (torrent clients and certain games I couldn't find etc.) so it could well have been put in them.
I'm thinking about a hard reset, not using titan backup to avoid it coming back and a re-flash.
Also my phone has no connection with China (purchased in the UK), this has only happened recently.
Is there any more info needed before reset etc.?
Looks like the suspect apps removed from the market may have been the cause.
Does anybody know if running as root alows all download apps to run with root permissions?
LouisJB said:
Looks like the suspect apps removed from the market may have been the cause.
Does anybody know if running as root alows all download apps to run with root permissions?
Click to expand...
Click to collapse
Issue is the damage seems to have been done, looks like I have no choice but to reflash etc. Need a virus scanner that has root so it can do a deeper scan.
Superuser is a lot like UAC on Windows Vista/7, it will popup and ask you to allow/deny.
Also is there any way to wipe the device while re flashing to ensure this gets removed?
I found a folder on my Internal Storage "QinqiQuan" (Google Image search pinpoints this as one of the apps) which translates in Chinese to English as "Infringement", however the app itself appears to be a legitimate Chinese social app so I'm not sure of my original concern regarding "Infringement" being copyright related etc.
Another few suspicious folders were "the9GameCenter" & "waze".
In future I'll be sticking the Market and official sites, even if that means doing without certain apps that aren't available on my handset/region
Isnt waze a community based sat nav app?
poults said:
Isnt waze a community based sat nav app?
Click to expand...
Click to collapse
The apps themselves appear legitimate, but I didn't authorize the installs which is what worries me.
I wiped internal storage, wiped data and then re-flashed + CFRooted.
Hopefully what ever it was, won't come back
And how about the security in your computer? As we know, you can install an app in your phone via your market account using your computer. Perhaps someone is playing around with your market account. If this is the case, changing your password would be a good idea.
Sent from my GT-I9100 using XDA App
angelomaldito said:
And how about the security in your computer? As we know, you can install an app in your phone via your market account using your computer. Perhaps someone is playing around with your market account. If this is the case, changing your password would be a good idea.
Sent from my GT-I9100 using XDA App
Click to expand...
Click to collapse
Yeah I have changed my password and turned on all the Google security settings, albeit a bit of pain, does give peace of mind
Sent from my GT-I9100 using xda premium
Hi,
what does it mean technically if an app is "freezed"? Is the APK moved to another location, or are the unix access rights altered, or is a reference to the app deleted from some kind of "registry" of the Android system, or what else? Can it be done manually by a file manager?
Thanks,
Stefan
It can be done using the purchased version of Titanium Backup and probably a few other apps. It basically renders the app inactive without uninstalling it. Helpful for bloatware that runs in the background but you can't decide if you want to delete it or not.
Thanks, but this was not my question...
lowandbehold said:
It can be done using the purchased version of Titanium Backup and probably a few other apps. It basically renders the app inactive without uninstalling it. Helpful for bloatware that runs in the background but you can't decide if you want to delete it or not.
Click to expand...
Click to collapse
Yes, I know, but what does it do exactly on file system level? Doesn't anybody know?
stbi said:
Yes, I know, but what does it do exactly on file system level? Doesn't anybody know?
Click to expand...
Click to collapse
Most freezing apps simply rename the app to be frozen with an extension, like in the case of Bloat Freezer (IMHO the best one) the frozen app gets a .bzw extension. It remains in place but of course cannot be executed. The nice part is that if you run into an issue you can just rename the app back to what it was (assuming that you have root).
It works!
docfreed said:
Most freezing apps simply rename the app to be frozen with an extension, like in the case of Bloat Freezer (IMHO the best one) the frozen app gets a .bzw extension. It remains in place but of course cannot be executed. The nice part is that if you run into an issue you can just rename the app back to what it was (assuming that you have root).
Click to expand...
Click to collapse
Cool, so simple - thanks! So it can be done with any file manager.
I've just successfully frozen the preinstalled "LGWorld.apk" by renaming it to "LGWorld.apk.bak". As soon as I had done this, a message popped up, saying "Deinstalled", and the icon disappeared from the app drawer, and also the update for "LG World" vanished from the Market app.
Hmm.. freezing doesn't mean rename. It is being remove from system. If.you rename yourself, the apps may failed to work.
Accidentally sent from my Google Nexus S using XDA Premium
Freezing the app works via decreasing the temperature of the app to roughly 50 Kelvin. At this point the the app's molecular structure becomes a super condensed crystal lattice. Due to the nature of the crystal lattice, android treats the super dense app as non existent. Essentially the app is deleted from your system completely. However, think of it not as a permanent deletion but rather a reversible one. Should you chose to 'restore' the app, you can defrost the app. You could defrost the app using a microwave but I for one use TB Pro as it does a far better job.
lambstone said:
Freezing the app works via decreasing the temperature of the app to roughly 50 Kelvin. At this point the the app's molecular structure becomes a super condensed crystal lattice. Due to the nature of the crystal lattice, android treats the super dense app as non existent.
Click to expand...
Click to collapse
Haha smart ass.
lambstone said:
Freezing the app works via decreasing the temperature of the app to roughly 50 Kelvin. At this point the the app's molecular structure becomes a super condensed crystal lattice. Due to the nature of the crystal lattice, android treats the super dense app as non existent. Essentially the app is deleted from your system completely. However, think of it not as a permanent deletion but rather a reversible one. Should you chose to 'restore' the app, you can defrost the app. You could defrost the app using a microwave but I for one use TB Pro as it does a far better job.
Click to expand...
Click to collapse
ha ha ha! that was hilarious man
Press THANKS
stbi said:
Hi,
what does it mean technically if an app is "freezed"? Is the APK moved to another location, or are the unix access rights altered, or is a reference to the app deleted from some kind of "registry" of the Android system, or what else? Can it be done manually by a file manager?
Thanks,
Stefan
Click to expand...
Click to collapse
Press thanks if I helped
Source - How TO Geek
Manufacturers and carriers often load Android phones with their own apps. If you don’t use them, they just clutter your system and sometimes in the background, draining resources. Take control of your device and stop the bloatware.
We’ll be focusing on disabling – also known as “freezing” bloatware here. It’s a safer process than uninstalling the bloatware completely, and is also easier to accomplish with free apps.
Uninstalling vs. Freezing
Uninstalling an app is exactly what it sounds like – the app is entirely removed from your device. Unfortunately, it’s not possible to get many of these preinstalled apps from the Play Store if you ever need them again. Uninstalling some preinstalled apps may result in problems or instability, so you could run into problems.
It’s safer to “freeze” apps instead of uninstalling them. A frozen app is disabled completely – it won’t appear in your app drawer and it won’t automatically start in the background. A frozen app cannot run in any way until you “unfreeze” it. Freezing and unfreezing are instant processes, so it’s easy to undo your changes if you end up freezing a necessary app.
If you really must uninstall apps, you should freeze them first and wait a few days to ensure that your phone or tablet works properly without them.
You can’t uninstall or freeze preinstalled bloatware apps without root access and third-party app managers. Try and you’ll find the options grayed out in the standard Android interface.
klacenas said:
ha ha ha! that was hilarious man
Click to expand...
Click to collapse
I understand and have frozen quite a few apps with TB Pro. My issue is there are shine pre-installed apps that I like to use, but when I run the task killer, they're always running. Is there a way I can fix them where they don't keep starting immediately after killing them, but still having them available when I want to use them?
donnebonn said:
I understand and have frozen quite a few apps with TB Pro. My issue is there are shine pre-installed apps that I like to use, but when I run the task killer, they're always running. Is there a way I can fix them where they don't keep starting immediately after killing them, but still having them available when I want to use them?
Click to expand...
Click to collapse
you can try greenify it will hibernate the apps and hence the app will be available for you any time
donnebonn said:
I understand and have frozen quite a few apps with TB Pro. My issue is there are shine pre-installed apps that I like to use, but when I run the task killer, they're always running. Is there a way I can fix them where they don't keep starting immediately after killing them, but still having them available when I want to use them?
Click to expand...
Click to collapse
Another app called greenify. Or using an autostart manager to prevent them from running without ykur intervention.
sangalaxy said:
you can try greenify it will hibernate the apps and hence the app will be available for you any time
Click to expand...
Click to collapse
Thx a bunch. I dwld and installed the grenify app and disabled them, however, when I run my task killer the gallery app is always running. I wanted to greenify it, but it's not showing up in the greenify app, even when I did a search for it, it just took me to my home screen. I clicked on the app and it just opened but I didn't see any options to greenify it. Any suggestions? Thx for ur help.
so at the end is freezing and renaming the same thing? no one cleared that up, i usually just rename to BAK and thats it, what does TItanium apart from renaming?
ok i answer myself, freezing is the same as going to app manager, and selecting DISABLE
or from a root terminal using:
pm disable {package_name} (e.g. # pm disable com.android.browser)
wich calls:
/system/bin/pm
wich in turn contains:
# Script to start "pm" on the device, which has a very rudimentary
# shell.
#
base=/system
export CLASSPATH=$base/framework/pm.jar
exec app_process $base/bin com.android.commands.pm.Pm "[email protected]"
what it does is set a flag for a component to some of different values:
COMPONENT_ENABLED_STATE_DEFAULT
COMPONENT_ENABLED_STATE_DISABLED
among others. (http://developer.android.com/reference/android/content/pm/PackageManager.html)
where does it store this flag: I DONT KNOW
is this flag a value inside some manifest/ini file? : IDK
is this flag st in the file system? IDK
can someone show me the light?
edit: I DONT KNOW for sure but i think it stores it in : /data/system/packages.xml
that is generated by package manager taking info fro each app manifest. i hope i am right, but dont take my word as absolute truth since it was a quick google research lol
Renaming the apk file can result in unwanted behaviour... I learned by trial&error! I'm running MIUI 6 and wanted Google Play as default app store and not the MI Market. Renaming the apk file for the Mi Market gave me the result I wanted: launching Google Play whenever I clicked a link to a certain app. But that was until I rebooted the phone... it got stuck on the MI startup logo. After renaming the Mi Market apk file in twrp recovery, my phone booted again.
So might try freezing it to see if it will do the job properly.
Freezing Mi Market with AppFreezer worked like a charm!
el_jefe said:
Renaming the apk file can result in unwanted behaviour... I learned by trial&error! I'm running MIUI 6 and wanted Google Play as default app store and not the MI Market. Renaming the apk file for the Mi Market gave me the result I wanted: launching Google Play whenever I clicked a link to a certain app. But that was until I rebooted the phone... it got stuck on the MI startup logo. After renaming the Mi Market apk file in twrp recovery, my phone booted again.
So might try freezing it to see if it will do the job properly.
Click to expand...
Click to collapse
Depends what you mean by "renaming." Changing the extension from .apk to .apkold or .bak or something like that will harmlessly freeze the app since it's no longer seen as an apk by the system. Renaming the app itself is another thing entirely.
I renamed the extension to .noapk and Miui wouldn't boot anymore.
Good stuff
Hi All
Since a day I have a sort of leadbolt virus that opens my browser and shows the website like below:
ad.leadboltads.net with Top Apps/Offers of the Day
This happens when I download something from the playstore or when I delete apps.
It Makes crazy and I have tried some things alrdy so fix it without any succes.
- Downloaded and installed virusscannen, no succes
- Downloaded and installed ad detector, found a app with leadbolt, deleted it but didn't solve the problem
Hopefully someone can help me too fix this annoying problem
Me too!!!
This is so annoying! My browser keeps opening to the leadbolts site with a bunch of apps on it....Please someone help!
+1. From where come this shlt ?
Shaundiesel said:
Me too!!!
This is so annoying! My browser keeps opening to the leadbolts site with a bunch of apps on it....Please someone help!
Click to expand...
Click to collapse
I'm also having the problem and have not found a solution yet.
The only difference for me is I have adaway installed so the webpage never gets to display. Just opens the browser.
I've tried different ad detector apps from google play, but nothing is fixed this problem. Almost ready to reflash the rom and start from scratch.
UPDATE: I fixed the problem.
When the browser hijacking occurred, it happened after installing or updating a program from any source. Google Play, Amazon or a standalone APK. That meant the virus had control over my installer.
Using Lookout's Ad Detector, I identified some potential culprits (Go Launcher EX being at the top of the list) and uninstalled them. That didn't work.
What actually fixed the problem was resetting the defaults for all the apps. Settings > More > Application Manager. Hit the menu key and choose Reset app preferences.
You don't loose any data. You just get prompted for choosing a default app when you run certain applications. I choose to use Lookout's installer instead of the default android installer when I got prompted to install updates.
Haven't had the issue since. Hope this helps.
markmi300 said:
What actually fixed the problem was resetting the defaults for all the apps. Settings > More > Application Manager. Hit the menu key and choose Reset app preferences.
You don't loose any data. You just get prompted for choosing a default app when you run certain applications. I choose to use Lookout's installer instead of the default android installer when I got prompted to install updates.
Haven't had the issue since.
Click to expand...
Click to collapse
Hi everybody. (First sorry for my english but I speak french)
This is a solution but it workn't very good.
After the downloading and installation from a update or a program, Androîd ask me if I want to finish the task with the default browser or Chrome ? So I can't see this f*cking page more but I must always put my choice between the 2 browsers.
I thank you for your solutions....
+1 to lookout fixing. Had the same problem, ripped it right out.
Sent from carbon note 2 on XDA premium app
shbaldw said:
+1 to lookout fixing. Had the same problem, ripped it right out.
Sent from carbon note 2 on XDA premium app
Click to expand...
Click to collapse
Glad I was able to help.
See the solution at
http://forum.xda-developers.com/showthread.php?t=2525965
#@!%&#! 'ad.leadboltads.net' Malware
shbaldw said:
+1 to lookout fixing. Had the same problem, ripped it right out.
Click to expand...
Click to collapse
Lookout Security & Antivirus found mine in ChargeBar Free Edition,
ChargeBar came embedded in the NottachTrix 2.3.0 ROM.
I installed it (NottachTrix) and it (ChargeBar) didn't update for 3 months, then, BANG.
I've deleted ChargeBar's update, moved it from system apps to apps, deleted it, and the browser pop open 'ad.leadboltads.net' still persists.
Lookout Security & Antivirus can not find the new location of the malware, they do not have a forum.
By the very definition and behaviour, this is malware, and, ChargeBar (Asgard Casino Apps) is involved in the distribution of malware.
Asgard Casino Apps distributes 34 apps that behave this way.
They are using Google to distribute this malware, abet, that app is benign in its origin, its a pipeline, or conduit for malware.
Sneaky F##kers aren`t they.........
#1) I would like to get this crap off my phone.
#2) I need to bring this to Google's attention, and have the developer and apps banned from the Play store.
Sooo, starting with #1,,,how do I get this crap off my phone!
NOTE:
I will be linking to this post in the NottachTrix post, I'm asking the developers to to move ChargeBar from the ROM zip.
My MBAM forum post: https://forums.malwarebytes.org/index.php?showtopic=138306#entry764184
hi
i have mi a3 , rooted .
i want a way to force stop apps when i close them from recent apps .
thanks for your help
Greenify app from playstore will do that
MohRez said:
hi
i have mi a3 , rooted .
i want a way to force stop apps when i close them from recent apps .
thanks for your help
Click to expand...
Click to collapse
Most of the apps will get (force) closed when cleared from recents. Only those with background services need actual "force close" button press. As advised, Greenify might accomplish what you're looking for.
_mysiak_ said:
Most of the apps will get (force) closed when cleared from recents. Only those with background services need actual "force close" button press. As advised, Greenify might accomplish what you're looking for.
Click to expand...
Click to collapse
i was think so , but when i installed an app to force stop apps , sew all of them are still running !
please give me the link of greenify
thanks
garylawwd said:
Greenify app from playstore will do that
Click to expand...
Click to collapse
is any magisk module to do not use third app party ?
( i mean a way just the clear all buttom do that )
MohRez said:
is any magisk module to do not use third app party ?
( i mean a way just the clear all buttom do that )
Click to expand...
Click to collapse
Greenify is completely automated and done in the background. You can set whatever apps you want to close whenever you want.
I don't know of anything else that is as effective as it.
Also I wouldn't really be using these anymore as Android is more than capable of ram management.
Spare ram is wasted ram
MohRez said:
i was think so , but when i installed an app to force stop apps , sew all of them are still running !
please give me the link of greenify
thanks
Click to expand...
Click to collapse
Well, that's the risk you take. Most of the killed apps will re-launch themselves automatically, either right away or after a while, when they receive corresponding event/broadcast message. You did not specify why do you want to kill apps in the first place, but generic approach:
1. Greenify (link) - it will kill an app AND prevents automatic restart of an app (doesn't work at 100% though)
2. Disable specific service of an app, so it won't keep restarting (app might be unstable - crash)
3. Uninstall the app and find a better alternative which isn't always running
garylawwd said:
Greenify is completely automated and done in the background.
Click to expand...
Click to collapse
_mysiak_ said:
Most of the apps will get (force) closed when cleared from recents. Only those with background services need actual "force close" button press. As advised, Greenify might accomplish what you're looking for.
Click to expand...
Click to collapse
i installed magisk and using it for some days .
but i dont know that it working correctly or not !
because when i go into it , only show me 2 apps that i need always be open and nothing else !
but another app that i used ( kaspersky battery life ) shoed me every apps that are open
MohRez said:
i installed magisk and using it for some days .
but i dont know that it working correctly or not !
because when i go into it , only show me 2 apps that i need always be open and nothing else !
but another app that i used ( kaspersky battery life ) shoed me every apps that are open
Click to expand...
Click to collapse
https://www.howtogeek.com/198135/how-to-optimize-your-android-phones-battery-life-using-greenify/
Can someone help me fix this, i got this error, and my apps always force close.
vangvull99 said:
Can someone help me fix this, i got this error, and my apps always force close.
Click to expand...
Click to collapse
That's a really weird error message, did you installed something on your smartphone lately ?
When an app request a permission, it asks for it right away, it has been like that since Android 6 (the creation of the feature). So I think it might be a malware. When you click on restore, what does it do ?
vangvull99 said:
Can someone help me fix this, i got this error, and my apps always force close.
Click to expand...
Click to collapse
You need to grant Instagram the permissions it requires or Instagram won't work. You can't deny its permissions and then expect the app to still work without those permissions being granted.
Sent from my SM-S767VL using Tapatalk
Raiz said:
That's a really weird error message, did you installed something on your smartphone lately ?
When an app request a permission, it asks for it right away, it has been like that since Android 6 (the creation of the feature). So I think it might be a malware. When you click on restore, what does it do ?
Click to expand...
Click to collapse
When i click report it does nothing, i literally cannot install app anymore, my internal storage is full, and i just use the phone for whatsapp, ig, youtube, the error come out of nowhere. But thank you
vangvull99 said:
When i click report it does nothing, i literally cannot install app anymore, my internal storage is full, and i just use the phone for whatsapp, ig, youtube, the error come out of nowhere. But thank you
Click to expand...
Click to collapse
Ok that's definitely a trap, don't ever allow anything, review your app list very carefully and come back here with screenshots of apps that seems suspicious. Sometimes viruses have a transparent app icon, if you see a blank space in your app list (usually it's at the end of the list but check the whole thing) click on it and uninstall the app right away.
The malware can also come from an apk you installed (from a normal app like a WhatsApp mod or just a normal apk), so check the battery consumption of every app you installed through an APK file, and if there is a heavy usage one, it might be the one. Come back here with the screenshots of the app list and the suspected apps before disabling/uninstalling anything (to avoid erasing something important to you)
vangvull99 said:
i literally cannot install app anymore, my internal storage is full
Click to expand...
Click to collapse
You can't install an app - here IG - two times or even more often on an Android device. You always have to completely uninstall ( means including its data ) it first and foremost and then to re-install the app in question.