yashsingh1/xdaforums huggingface dataset:
[Security Discussion] sziraqui:
I have solved this issue on canvas a116 and core duos (gt i8262)

firstly, to check the severity of the virus do this : go to settings>security>device administrators

try to remove all apps under device administrators. If u are unable to remove them implies the virus is now embedded to ur fone's firmware.

solution : 1. backup ur contacts and media only, (do not backup apps and app data)

2. now u need to do a factory reset either from recovery menu or using adb (factory reset from 'settings' wont work)

3. if u again see any app under device administrators then the only solution is to reflash ur firmware

About the virus: This virus come packed in several apps on playstore in april 2015, those apps were immediately removed from playstore. however before its removal from playstore the virus had infected around 5000 smartphones. some websites refer to it as ghosthost virus. Still some non playstore apps carry this virus with them. once you install such apps, the virus will first root ur fone, and then grant itself superuser permissions without u even knowing it. Then it will install itself into system folder so dat it appears to be a system app. Whenever u r connected to internet it will download adware and install them in system folder. Its a very powerful virus, it also hides itself by running a script. Once it is in system folder u wont be able to delete it because it imitates the file names of the system files.
[Security Discussion] imahsen:
There's a huge list of infected apps hosted by Google playstore. So I think it's not easy to keep our devices secure from virus infection.
[Security Discussion] romat1993:
AVG can be as correct the problem
[Security Discussion] zelendel:
This is a known issue with these types of devices. They have these ads built into the system apks.
[Security Discussion] Chokinfo:
Hi !

Thanks for that solutions !

I have a question : where could I find malwarebytes for android ?

Best regard.
[Security Discussion] alokmey3:
Adware and infected htc desire 526 g plus

Guys I am in a pickle! :silly:

I want to wipe my HTC desire 526 plus clean of malware that is causing it to download unwanted apps without consent. The malware seems capable of modifying the inherent permissions and bypassing all security features.

I am unable to gain root access by kingoroot alone. adware is not letting me update the Superuser app and being nasty on purpose.

It can gain permission to automatically start wifi, gain pemission to install 'Unknown Apps' and sends location and data with impunity. The ads are everywhere.:crying:

I have tried stock backup but it still reinstalls all the malware and the same cycle begins again. What I want is a freash stock rom/nand backup for this menace. Surprisingly I still cant find one link on the world wide web. Please Help me find it.

I am unable to gain root access by kingoroot alone. adware is not letting me update the Superuser app and being nasty on purpose.
[Security Discussion] zelendel:
Kingo root is the reason you are in this jam as it is. I don't think HTC ever released anything for this device so your best bet is to contact HTC.
[Security Discussion] philjps:
ENERGYSER400 MTK 6572 virus help android 4.4.2

Bonjour, hy

For me it's exactly the same on my phone.... i have the snowfoxer folder with a lot of malicious apk on it and i don't know how to delete or erase the virus .... without wifi and google play ..... how i can flash the firmwire please

!
[Security Discussion] KernelCorn:
Find the forum that supports your device

model/carrier and post there. You'll likely find your answers there. If not someone will help you.
[Security Discussion] alokmey3:
HTC desire 526G+ bricked

I have deleted my priv-app folder and now I am stuck in boot loop, or just the HTC logo.

cant boot into recovery or bootloader (I tried). Tell me if you know something:confused:
[G 2014 Q&A, Help & Troubleshooting] vite0150:
Hi guys,

Anyone knows where can i found the moto g 2nd gen, white, global version at $179? On amazon its like $220, on best buy isn't in stock...

Any ideas?
[General Questions and Answers] gliitch:
Hi

I have soft-bricked my Moto G 4G, as the title says. I decided to use the nandroid backup from my working Moto G 4G & flashed it to the one which has now since bricked. (kinda lazy XD)

Its also locked too -_- So i can flash signed motorolla img's but unsigned do not work. I have tried to find official 4.4.4 images but I've had no luck in flashing them. So now i get constant error messages when trying to flash the same system images, or boot.img to the system.

I have access to Fastboot & only Fastboot. The issues i have are:

When booting into fasboot i get:

Fastboot Reason: UTAG "bootmode" configured as fastboot.

When trying to unlock the bootloader, however i can get the unlock token by doing "fastboot oem get_unlock_data then paste that on the motorolla site.

But as soon as i type in fastboot oem unlock i get the following message:

fastboot <bootloader> oem unlock disabled!

I also get:

Invalid PIV signed system image

hab check failed for system

I can flash the following successfully:

gpt.bin

motoboot.img

logo logo.bin

fsg.mbn

NON-HLOS.bin

Because I've flashed the other system's rom to this phone, ALL the information under "Barcodes" is identical to that of my working phone. Even the fastboot code thats identical too. So even when i request a unlock token, sure it works, but the site thinks that its a call from my working phone so it gives out the incorrect unlock code, so thats why i think the unlock is disabled. Either way this is a really irritating situation, which i am having trouble trying to solve.

I wonder if I'm going to have to flash a blank flash to get it back to working state. :(

Hopefully if i can get the bootloader unlocked, id be back in business. :fingers-crossed:

Any help would be greatly appreciated.

Thanks
[General Questions and Answers] kanjigirl:
I'm not a programmer - I just did my first root of my Galaxy S4 Blaze last month so please bear with me. I posted this under XDA Assist but that was the wrong place...

Yesterday I flashed a version of CM 11 that I had been using for a month with no problems because of some weird things happening with the newer CM 11 nightly I got a couple of days ago. This is what I'm now using again:

cwm-11-20150119-NIGHTLY-t769.zip

When I reinstalled Link2SD after flashing this ROM, I set it to Ext4 as it was before and I got this error:

"Mount Script Error - mount script cannot be created. Can't create handler inside thread that has not called Looper.prepare(0)."

Link2SD was working fine before I wiped the phone and reflashed the older CM 11. I tried uninstalling Link2SD, rebooting, reinstalling and then trying the other formats (Ext 2, 3) with the same result.

Not knowing what else to do I backed up my card and used Mini Partition Wizard to delete and recreate the partitions (FAT32 and Ext4) . Exact same error in Link2SD.

I tried making both partitions FAT32, same error.

I have no idea what else to try here. Can someone help me, please?
[General Questions and Answers] LS.xD:
Perform a full wipe, including all storages, clean install rom, clean install Link2SD. Try not using any backups and you should be fine.
[General Questions and Answers] kanjigirl:
This is what I was thinking - so it's some kind of little glitch, not related to the card? By cleaning storages do you mean clearing all the caches?
[General Questions and Answers] LS.xD:
I mean format system, data, cache, dalvik and the sd card in custom recovery before flashing your new system :D
[General Questions and Answers] kanjigirl:
Before I saw this answer I did this:

In CWM recovery I wiped to factory settings, cleared the cache, cleared Dalvik cache, installed the zip of CM 11 and Gapps. When I rebooted I installed Link2SD and got the same error.

I missed a few steps in your process so will try it again now...
[General Questions and Answers] kanjigirl:
Did it again with the additional steps of formatting the /system and /data folders - no change, same error in Link2SD.

I got in touch with the developer and he sent me a fresh beta APK version, I installed that, and it worked immediately. So, problem solved. Thanks for your help, at least I know the correct process for flashing a ROM now.
[Android General] blueren:
Please take a look at the screenshot. Each time I try to access xda via chrome, this sort of message pops up. There is no option but to press ok, which opens up another ad page and some random flash light apk starts downloading. This is quite frustrating. How do I get rid of this?

Thanks
[Android General] shinji257:
Looks like you got adware as I don't think the xda website does that. Try getting malwarebytes for android (or other similar legit app) and see if it can find what is doing that.
[Asus Zenfone 4] joel george alex:
Finally,the wait is over, found a CUSTOM ROM for Asus Zenfone 4 A400CG

thanks to the developer Anwar Movic,Tuan Torres and zenphoneviet.com

To install the aosp rom

1) Backup data using Titanium Backup

2)Download the rom here

2)Restart on Droidboot and factory reset, then plug the cable into the back in Droidboot

3)On the PC, extract boot.img and system.img into adb folder

4)Go adb folder, hold down Shift + Right-click -> Open command window here

5) type fastboot flash boot boot.img

fastboot flash system system.img

found bugs

*No self-scanning directories

*No self wave (find craft)

*Camera blurred

*Bluetooth forced to stop when paired

*Some forced to stop Google apps

hit thanks if you liked :good::good::good::good::good::good:
[Asus Zenfone 4] joel george alex:
screenshots

https://fbcdn-sphotos-f-a.akamaihd.net/hphotos-ak-xpa1/v/t1.0-9/s206x206/10891837_384352245069326_8895022668177902861_n.jpg?oh=c8d9d1b07546bd77d72d0dd51927ce1f&oe=5583C28C&__gda__=1434752362_7ccc1fd142e86914f2747577b528a544

https://fbcdn-sphotos-d-a.akamaihd.net/hphotos-ak-xap1/v/t1.0-9/s206x206/522135_384352231735994_2889919058120350430_n.jpg?oh=a4d9c293f60ceb2295069e598a8169b4&oe=55840E7E&__gda__=1431070651_0c6b2bceefa6c78c0a98ec3e02ebd7fc

https://scontent-sjc.xx.fbcdn.net/hphotos-xap1/v/t1.0-9/s206x206/10888465_384352215069329_1388157218258722994_n.jpg?oh=38b23dc1ff2b3a825be4eeaeef8e987e&oe=5548C37D

https://scontent-sjc.xx.fbcdn.net/hphotos-xpa1/v/t1.0-9/p320x320/10885472_384352205069330_2372847021787298005_n.jpg?oh=e220c64abe44d2d1481f968420d2d1bd&oe=555219AA
[Asus Zenfone 4] jiyoohji:
great job mate!
[Asus Zenfone 4] joel george alex:
crying

i am too much disappointed that no one is hitting thanks :crying::crying::crying::crying::crying::crying::crying::crying:

why guys? :confused::confused::confused::confused::confused::confused::confused:
[Asus Zenfone 4] jiyoohji:
up up up! :good: :D
[Asus Zenfone 4] joel george alex:
:)

i dont meant that, i:p:p:p:p

what i want is to click on the thanks button at the right corner of every post :o:o:o:o:o:o
[Asus Zenfone 4] arun483:
are the bugs fixed yet????
[Asus Zenfone 4] joel george alex:
FOR FIXING BUGS

camera blured

1) Open Build.prop find the line " ro.product.model = AOSP on a400cg "

2) Change into ro.product.model = ASUS_T00I and Reboot

bluetooth fix

1)open build.prop

2)edit like this in the image here
[Asus Zenfone 4] joel george alex:
VERSION2

FIXED gps,gapp system.img.gz link
[Asus Zenfone 4] arun483:
Is it possible to decompile system.img? I wanted to port CM
[Asus Zenfone 4] joel george alex:
Cm_11 for asus zenfone 5 for developers only

donno for sure ,you could use android kitchen for decompiling

http://xdaforums.com/showthread.php?t=633246

found cm11 for zenfone 5 for developers(booting problems ,may be you could fix it)

CM_11 FOR ASUS ZENFONE 5 LINK HERE
[Asus Zenfone 4] arun483:
I thought we could only port roms on same chipset/processor. Zenfone 4 use Intel Atom Z2520 whereas ZenFone 5 uses Intel Atom Z2580. Are you sure it would be safe to port rom from a different processor?
[Asus Zenfone 4] jiyoohji:
sir how can flash this?can you give me some instructions?
[Asus Zenfone 4] joel george alex:
first please dont call me sir,(im not a developer)

full credit goes to x anwar wjr

instructions:

1)download intel drivers and install it click here

2)download adb here and extract it and place it in a folder click here

3)download the system.img.gz on previous post and place it in the adb folder

4)replace the boot.img in the adb folder with your phone's boot.img

5)go into fast boot mode (switch off and power+vol up) ,run cmd.exe and and move to adb folder in it, type this

fastboot erase cache

fastboot erase userdata

fastboot erase system

fastboot reboot-bootloader

fastboot flash system system.img.gz

fastboot flash boot boot.img

fastboot reboot-bootloader

this factory reset your phone with erasing system, so before doing get stock system.img.gz for your phone ,do it at your own risk

i am not responsible for anything
[Asus Zenfone 4] joel george alex:
you know better than me,i just gave you the link.lot of changes are needed to port from different chipset
[Asus Zenfone 4] joel george alex:
hitting thanks will be appreciated:(:(:(:(:(:(:(:(
[Asus Zenfone 4] jiyoohji:
ok thanks! should i flash the v1 first?

by the way i just saw this on the other forums.just sharing.
[Asus Zenfone 4] Severus_:
it hasn't support dual sim yet, I tested and found that it needs stock support dual sim, aosp rom does not
[Asus Zenfone 4] joel george alex:
YOU CAN DO IT AS YOU WISH:cowboy::cowboy:
[Galaxy Note Pro 12.2 Q&A, Help & Troubleshooting] arkhantos:
I have a Intermitent darker bar on note pro screen, tried screen flicker fix and didn't work

Need help, any ideas?

Thanks guys!
[Galaxy Note Pro 12.2 Q&A, Help & Troubleshooting] muzzy996:
Which fix are you referring to? The developer options one?
[Galaxy Note Pro 12.2 Q&A, Help & Troubleshooting] arkhantos:
Yes, however had to take the tablet to Samsung because it was a hardware problem, aparently the frame was causing the screen cable to come loose some times witch was causing the problem!

But thanks anyway!
[JAMin, XDA Neo, S200 General] haveric:
I have Bluetooth samsung SBH170 can get it to handsfree for phone but cant get Music to work anyone else know anything about this is there a bluetooth upgrade??

Cheers
[General Questions and Answers] genius.lizard2:
Can We Disable Or Transparent This Big bad White Address Bar infront of Map?

i can't use google maps in my note 4 after Updating to 9.x.x with this bar in front of map! in landscape mod

any help?
[General Questions and Answers] genius.lizard2:
No Comment At All?!!!!
[LG G2 Mini] kalavrezos:
Hi guys, when I connect on the internet my phone is "lagging" sometimes. Is this a known problem and is there any solution? Thanks in advance

sent from my G2 mini D620r using my nose
[LG G2 Mini] Krisz741:
What apps do you have installed?Are you rooted?Do you have xposed?
[LG G2 Mini] kalavrezos:
It's rooted and I use Xposed. I use chrome, clean master, fb +messenger, viber, skype, a weather app, youtube (the apps I use every day). You can see the modules I use attached.

sent from my G2 mini D620r using my nose
[Android Themes] yassinedrissi:
to be deleted
[Galaxy Note 3 Q&A, Help & Troubleshooting] blanco360:
Ok guys, could really do with your help here.

I have an unrooted n9005, which recently had an earpiece fault.

I took it to my local repair store, who took it and said come back in an hour.

After I went back, I found that someone had installed mobomarket on it.

The owner of the shop said it wasn't him, but I can see from the unlock log that it happened for sure whilst with him.

Ok, so I figured what harm could that really do, but then thought to check further.

On rebooting to the odin download screen (vol home and power), the Knox status is now 0x1.

This means they rooted it right? Or is it possible to trip another way?

However, it now isn't rooted (testing using su in terminal) and the firmware status on the odin download screen shows as "official".

My question therefore is, is it possible to root the phone, install malware then unroot it, leaving the malware still active?

Or does the fact the download status show "official" instead of "custom" mean this isn't possible?

This is kinda important as if there is a possibility the phone is compromised, I need to call the police but obviously don't want to do this if the guy is innocent.

(I could for example accept that he used the phone without permission to play something or whatever, and whilst not ethical, I don't need to worry about having to wipe this phone)

Thanks guys, your input would be much appreciated as I intend to go back to him tomorrow.
[Galaxy Note 3 Q&A, Help & Troubleshooting] blanco360:
View attachment 3178539

For reference.
[Galaxy Note 3 Q&A, Help & Troubleshooting] blanco360:
The shop denied they did anything to it.

The real issue is can it be infected or does the boot loader have some sort of checksum protection? That's all I really care about for now...
[Galaxy Note 3 Q&A, Help & Troubleshooting] GeneralMeow:
Just remove any funny apps you found.

If in doubt, just perform a factory reset.
[Galaxy Note 3 Q&A, Help & Troubleshooting] blanco360:
It's more important I know if my data could have been compromised. For example Google chrome accounts etc...
[Galaxy Note 3 Q&A, Help & Troubleshooting] ShadowLea:
Safest bet is to always assume the worst. Change all your passwords.

If you have proof, I would also report it. Either to a consumer union if you have one, or to the police. Such practises are usually forbidden by law.

This is why I never trust independent repair shops. (It also really doesn't help that the ones here never speak Dutch or English, and are always run by immigrants)
[Galaxy Note 3 Q&A, Help & Troubleshooting] blanco360:
I've now found an app called mobo daemon on the phone too. Sigh.

So just to confirm, to do a secure wipe, I use odin and reflash the whole Rom?

I need to erase the internal sdcard too? (So basically lose everything on the phone? )
[Galaxy Note 3 Q&A, Help & Troubleshooting] Ironstrix:
Do you have a bill or something like that? Did he tell you what he have done?

Tripping knox lowers the value of the device and some knox related features are now unusable.

Maybe the shop used Mobo to backup your data.. that means contacts, accounts and so on.. you can trust him or not.. i would tend to distrust him ;)
[Galaxy Note 3 Q&A, Help & Troubleshooting] blanco360:
He said he didn't run anything on the phone, just checked the ribbon for the speaker.

Swore he didn't do anything else.

Now maybe he didn't, but someone looked through ask my gallery, and installed this app.

It's a crappy situation.

So I guess the phone isn't safe.
[Galaxy Note 3 Q&A, Help & Troubleshooting] blanco360:
Can someone confirm, if the phone is rooted, the system status will change to "custom"?

And if flashed back (So root removed) this would clear any malware?
[Galaxy Note 3 Q&A, Help & Troubleshooting] Nirak:
I'm on 4.4.2 and rooted, but system status is official (my knox is 0x0). Used towelroot then (it's been a while since i rooted).

I'm not a wizz, but tripping knox usualy happens while rooting, when unrooted afterwards you cannot acces/see anything they might have installed/put in the root of your device.

I would do a full wipe including sd card, just back up the things you absolutely want to keep like pics etc, and follow advice in #6, just to be safe.
[Galaxy Note 3 Q&A, Help & Troubleshooting] Rosli59564:
If the shop guy reflash official firmware after rooted the phone it will show official again.

You could flash twrp, wipe everything then reflash official firmware if that's going to make you feel more secure
[Galaxy Note 3 Q&A, Help & Troubleshooting] blanco360:
Went back there today to ask to see the security cameras. Shop has 5 - 3 point around the area, 2 focus directly on the desk (where the phone was supposedly the whole time).

Surprise surprise, all the cameras worked except those 2. Went to the stall (it's in a mall market) as they have one that points at the store. Again, camera not working.

I've got the phone back now (and rooted it) to have a look around on there, but honestly I'm not sure what I would be looking for.

Now though, my Download screen status says "Custom" (I assume because it's rooted)

Now am I missing the point here, but if it said "Official" before - this means it had to be a clean flash? (in which case it's impossible for any malware to be on it?) - or can it still be infected? And why would they flash it back anyway? Maybe get off all the password data then remove root to hide tracks?

Thing is, I am trying to download the official ROM to reflash, but I'm on a 128kbps connection and it's going to take days..... :(
[Galaxy Note 3 Q&A, Help & Troubleshooting] blanco360:
Righty - been through everything and going by the "Unlock log" - here is what seems to have happened:

15:17 - Phone handed into store.

15:22 - They start playing around with the gallery

15:25 - Go into settings and enable USB debug mode

Phone now shows no use (so I guess this is when it is being rooted) until:

15:47 - When suddenly Mobodaemon is installed onto the device

And then no access until:

16:22 - Which I assume is the time it took Mobodeamon to copy across everything and perhaps flash back?

Then no access until I get back at 16:57

So from this, I'm guessing they did a complete backup of the phone using Mobodaemon - so have access to every saved password on the device. So now I'm going through my Google Chrome listing to see which are the most important ones I need changed.

Actually one thing that puzzles me, is they didn't have very long to download the official firmware to reflash it. Mine is the HK model which is 1.5GB, even the fastest Thai connection has issues with over 300K/s.... curious!
[Galaxy Note 3 Q&A, Help & Troubleshooting] Nirak:
They probably already had the official firmware ready to flash, assuming they perform this kinda 'repairs' more often.
[Galaxy Note 3 Q&A, Help & Troubleshooting] bazzanator:
http://mobo-daemon1.android.informer.com

Doing a quick search on Google i could see that the app is used to wirelessy manage your contacts etc etc but for someone to use the app the phone and pc need to be connected to same WiFi network.

What did you have the phone in for repair?
[Galaxy Note 3 Q&A, Help & Troubleshooting] blanco360:
Yeah, or just plug it in via USB.

My plan now is this.

Copy all of my photos and music and data from the phone to my PC.

Use Titanium Backup to backup just the settings of some apps which i dont wnna lose (not the apps themselves, as I assume they could be compromised)

Install the TWRP as suggested and choose "Wipe" - which means the whole phone will be cleared right? Including the internal SD.

Re-flash the official image - install the apps from the app store. Root the phone again, re-import the settings using Titanium backup.

Then turn on phone encryption (this can be done on a rooted phone?) and set a proper password.

And I should be all good right?
[Galaxy Note 3 Q&A, Help & Troubleshooting] cryostasis25:
^ and dont forget to change passwords for email, bank infos and such.
[Galaxy Note 3 Q&A, Help & Troubleshooting] bazzanator:
VERY good point!
[Galaxy Note 3 Q&A, Help & Troubleshooting] Ironstrix:
Its theoretical possible to compromise the partitions of your note which won't be touched by wiping and/or flashing a new rom..

but honestly, it's enough ;)
[Galaxy Note 3 Q&A, Help & Troubleshooting] blanco360:
Grr, don't say that :P

Ok all done, but one thing I can't work out. I've turned on encryption but not external sd encryption.

Am I right in thinking this will still encrypt the internal sdcard though? (Which is what I want, but exsdcard left unencrypted)
[Galaxy Note 3 Q&A, Help & Troubleshooting] ddogishere:
?? Yep ?
[Galaxy Note 3 Q&A, Help & Troubleshooting] blanco360:
Great, thanks for all the help guys.

One last question, so now everything is encrypted it means my data is safe from theft, but unless I'm missing something, the following situation is still possible:

Hand in phone for repair, store boots into twrp, mount their own external sd card with their tools on it. Over write the system startup to load malware on boot, wait for me to load up, then they still have access..

Or is that not possible?