yashsingh1/xdaforums huggingface dataset:
[Device Reviews and Information] kdekaluga:
Hi! That's my solution from 4pda.ru :) Thanx for translating and posting it here so other users can remove the trojan. BTW, for advanced users - adb root works because Chinese guys have left the "ro.debuggable" property in 1 in default.props and this is an advantage in this case - you don't need to root your phone for the most tasks, adb root is enough. The tutorial is not as hard as you might think on the first look. Just try it and you'll see.

Some other thoughts - you are completely right, CallerIdSearch.apk is shipped with the latest official firmware S160225, you can find the following string in installed-files.txt:

5212644 /system/priv-app/CallerIdSearch/CallerIdSearch.apk

(5212644 is the file size). There was no this file on the previous version. So, if you are going to re-flash, use the previous firmware only. It has been reported that installing the latest firware now already leads to a couple of apks downloaded and installed on your phone while it adjusts itself on the first boot.

If you look deeper, our official firmware is odexed (i.e. the odex files are compiled specially for our phone and are outside of the system apks) whereas this CallerIdSearch.apk is deodexed (i.e. the odex file is universal and is located inside the apk) which means that it's likely that it was not produced by Leagoo, but by some third-party company and then shipped to Leagoo in the ready-to-use apk form. This also means that other Chinese phones may have it too (it is confirmed by now that some of them do have it).

---------- Post added at 09:15 PM ---------- Previous post was at 09:03 PM ----------

I don't want to upset you, but it seems that even freezing CallerIdSearch.apk does not solve the problem - it is still started after the phone reboot and performs its dirty tasks. It seems that it does:

- changes security option "Allow untrusted sources" to "Yes" (I'm not sure how this option is called in English since I'm using Russian language)

- connects to some server in the Internet and get further instructions from there. This explains why it may seem that is does not do anything right now - there is no remote command for any action at this time.

- downloads some malware apks and installs them without any notice. I've read on 4pda.ru that some guy got a game installed which then tried so send sms "pay ****" to some short number. So, this may cost you money.

Thus, the sooner you remove it the better.
[Device Reviews and Information] psychegr:
Yes that is your solution that helped me with the virus.

But, there is always a "but". As you say freezing this apk wont do much so i am thinking that there must be something else that starts it again, like a service. So even if i deleted this apk i still got asked to install another apk, "Superb Cleaner", after unlocking the phone. So that got me suspicious and i started looking for a suspicious service and i found one. It was named like "com.android.whatsapp.service" or something like that. I have the WhatApp application in my phone but it already has a WhatApp service running which has the "WhatApp" name. So what is that "com.android....." service? It was like small in size and the version was something like 0.0.16. I stopped and uninstall that service also. Now with fingers crossed i am waiting if something else goes on.

About the SMS thing. Yes it sends SMS continously and it has some stuff written in there. I have kept all 3 of them for my research.

It definetely is not a Leagoo only virus. It has infected other devices also. So lets not blame Leagoo for that. I am sure that they try to figure out what is going on, as we do here.

kdekaluga can you give some more info that you have about the virus? We must find a way to completely remove it from our devices.

Regards
[Device Reviews and Information] kdekaluga:
com.android.whatsapp.xxx - is another malware application. I have avg antivirus and it detected this app when CallerIdSearch.apk tried to install it. But it's an ordinary app, you can just go to apps settings and uninstall it from there. And it is initially installed by CallerIdSearch (I have very clear proof of this), so CallerIdSearch is the main reason. I've downloaded the entire /system folder to my PC and scanned it with the ESET Smart Security - it found two threats - one in CallerIdSearch.apk and another in MakeupOuteda.apk. The latter is a photo enhancement application that can be run from camera app or something about it. More detailed research showed that the threat is not the makeupouteda.apk itself, it's another apk that is packed into the main one to the plugins folder. I've just cut that infected apk from the main one and then put makeupouteda back to the /system/app folder (didn't sign anything - if it does not work, I don't care).

Also I found some suspicious app that identifies itself as com.andr

io

d.securitycore (in the app list). It had a lot of privileges including "change system security settings". I didn't like it and removed it too (but virustotal found 0/56 threats in that app and it was in the phone since the very first (or the very second) firmware). The text inside this app showed something about updating something but I didn't find what it really does (the built-in OTA firware update still seems to work). I do not recommend to remove it but you may pay attention to this app.

So, what I suggest to do:

1. Go to security settings and disable untrusted sources (or whatever name it has).

2. Go to the list of installed third-party apps and check every single one - whether you installed it or not. If you don't, remove it.

3. Go to the auto-start management and make sure no other suspicious app is allowed to auto-start.

---------- Post added at 01:19 AM ---------- Previous post was at 12:57 AM ----------

Another suspicious file in Leagoo Elite 1 is /system/bin/unint8int

It seems to be re-created on the each boot (by root) and contains (among other data which seems to be related to some sql db) the following url:

http://oyag.lhzbdvm.com:8082/padm

If you try to open this url in browser, it says that connection was reset by the remote host. If you try to telnet this address, the connection is established but when you enter any symbol (press a key) the connection is reset.

Unfortunately I have no idea what it could be, what it's doing in the /system/bin folder and why it's re-created on the each boot.
[Device Reviews and Information] azizouh:
Hello all,

My phone isn't rooted. Malwarebyte identified BeautyMakeup and Search Service as suspicious.

Both disabled seems to solve the issue. Unknown apps installation is still not allowed after several reboots.
[Device Reviews and Information] h352197:
Thanks to all for your research! I'd like to add my results, well that I can not contribute much more

My frequency of adds has got drastically reduced, not more than once a day or less, but the problem is still here.

There may be more than one version of the malware, or perhaps not beeing rooted has some influence.

- I can not find the CallerIDSearch.apk but some other service is changing the "Allow untrusted sources" and installs its junk.

- Found a new, additional, apk "com.android... ....patch.5" being part of the junk

- Not found (yet?) SMS/MMS sent: permissions control activated with "always ask", nor in the invoice from the phone company

- Found two strange apk whose names is a long (seemingly random) string, but with 0 bytes length. Can not delete them.
[Device Reviews and Information] attilaflagellodidio:
[MENTION=7412023]Tech-8816[/MENTION]: Hi. No, for me this was nor sufficient. Android.helper.patch3, patch5 and Superb cleaner reinstalled after first reboot, then untrusted apps switch again on ON....
[Device Reviews and Information] kdekaluga:
This apk(s) are downloaded by CallerIDSearch.apk in the first place. Then these apks can download other apks, etc. You can remove "normal" apks yourself from the settings -> applications, but there will be no difference until you remove the system apk that started it in the first place.

You cannot find CallerIDSearch.apk - why? Did you already remove it? Or you just cannot find it? Do you have the latest firmware?
[Device Reviews and Information] h352197:
Hi kdekaluga, you were right!

I found at last the CallerIDSearch.apk. using a different file browser.

Now I need to get familiar with adb (the steps seem well detailed, thks psychegr!) or with rooting the phone :confused:

Does rooting still permit OTA future updates? I've heard, or read, both answers :( and never did it before, but there's always a first time ...
[Device Reviews and Information] kladde:
How is CM with rooted elite if anyone have this?
[Device Reviews and Information] elben:
I run DEBLOATER from the computer and I disabled CallerIdSearch.

Our Elite 1 does not support BLOCK mode, only disable.

I will come back in a few days to see if it's really disabled.
[Device Reviews and Information] kdekaluga:
No, OTA checks for firmware "originality", you won't be able to upgrade after rooting. But I am not sure whether you will be able using OTA after removing the virus anyway - since you change system partition, it may not work.

Also, do you really need OTA after this virus issue? I won't believe leagoo a byte anymore and will install any new firmware only when some time passes and only after having checked it with AV myself.
[Device Reviews and Information] h352197:
That's a clear answer.

I think I'll go for root, it seems to have more advantages than drawbacks.
[Device Reviews and Information] kladde:
I'm so mad with this popup ads. I get this now every time I unlock phone or open some app. It is so annoying.

I tried to find here how to root the phone but i could not find this post. Please help.
[Device Reviews and Information] djgspee:
Hello. I have these same problem with ads in my Elite 1. The worst thing is that i can't root this phone with any root app and i can't do it manually (because no skill :/ ) someone have some ideas? Please help.
[Device Reviews and Information] Lanfear28:
Flash back to firmware S1019, on needrom you can find this firmware and the flashtool.
[Device Reviews and Information] kladde:
Easy for you to say for someone that has no skills about rooting. Any help here please.
[Device Reviews and Information] Lanfear28:
This is not rooting but flashing back to a previous firmware. Remember all data will be lost when using SP Flash Tool. First download the latest version of SP Flashtool and the firmware S1019s7yler from needrom. Follow the guide: How to flash Mediatek stock roms with SP Flash Tool. If it is too complicated stay on firmware S160225 and wait for an update from Leagoo.
[Device Reviews and Information] kladde:
Talking about leagoo update and here it is. But still this adds are showing.
[Device Reviews and Information] psychegr:
Is there a new update?
[Device Reviews and Information] kladde:
I just got s160419
[Device Reviews and Information] psychegr:
You are correct. I have just checked and it seems that i can update even though i have my phone rooted. Have you checked for virus?
[Device Reviews and Information] psychegr:
Forgot the OTA screenshot!
[Device Reviews and Information] kladde:
I did that now. It found 4 virus. Hope this helps.
[Device Reviews and Information] psychegr:
Can you post more details? Maybe we can disinfect it and do the update.

I will try to get the OTA update file on my pc.
[Device Reviews and Information] h352197:
I was fighting with KingRoot (not working apparently for Elite 1) when I read your post, checked and "voilà", the OTA appeared.

Installs was easy and now the CallerIDSearch folder is empty (it still exists). I had the other junk already removed and has not showed up.

Two new apps found that I have disabled: Leagoo Share and Beauty Snap

Tried restarting a couple of times and no traces of the adds or the invading apps, and the setting for Install from Untrusted Sources remains off.

Previously even if I had all the junk apps uninstalled and the apk's removed (not CallerIDSearch, of course) in every restart they got downladed, the adds started to appear.
[Device Reviews and Information] djgspee:
I updated to s160419 yesterday and... Adware was deleted... Nice ^^ but I still need root and still I can't make root (via KingRoot)...

(sorry for my English anyway)
[Device Reviews and Information] azizouh:
Adaware BeautyMakup removed but another SnapMakup added.

disable it then a reboot will re-activate it.

That update seems to be more suspicious than previous.

---------- Post added at 01:58 PM ---------- Previous post was at 01:51 PM ----------

This works perfectly without root "Malwarebyte identified BeautyMakeup and Search Service as suspicious.

Both disabled seems to solve the issue. Unknown apps installation is still not allowed after several reboots"
[Device Reviews and Information] jacob83:
the last update non root support by twrp www 4shared com_folder_j9eJDaq5__online.html

---------- Post added at 04:08 PM ---------- Previous post was at 04:05 PM ----------

Empty space = .

_ = / (except the last)
[Device Reviews and Information] iurra838:
Worth to buy this phone ? please answer me...
[Device Reviews and Information] Michael J.F.:
What about the latest firmware from May 2016? => S160506 (leagooftp .com .my/Elite%20Series/Elite%201/X5601_OTD_MYLEAGOO_E1_V0.7.6_S160506.rar)

Do you find any Adware/Malware on the Elite 1 after using this software?
[Device Reviews and Information] CUPA16:
Elite 1 reception problem

Heloo..

I am from SLOVENIA (EU

I buy this phone from Everbuying for EU market.... and works great (working soft..before s160225). On this page is warning...

This Android/Windows device is designed to function specifically with the current Android/Windows OS installed on it. Any alterations such as upgrades, modding with custom ROMs, rooting or flashing the Android device with other firmware will automatically void the device's warranty.

When wireles update arive (s160225), I update (I forget for warning), and I have now problems with reception....

Before update, I have both bars for reception allways on 4 or 5 bars (full signal almost everywhere ), and I noticed, that with the UPDATE (with WIFI and wireless update on the phone) few weks back, strenght of signal is now on the half, and even somethimes goes on 1 bar or lose signal for few moments (Dual SIM)

OK. I look how is now with reception in diferent locations and towns (I travel every day about 200 Km), and I can better explain how it looks.

In the midle of city I have 3G and 2G bars on half (phone works), when I go to near end of city and maybe 1 Km out of city….. the bars go to zero and is imposible to call.

Normaly when I travel from first small city to second there is always normal signal and reception, but now is imposible to take call (bars are on zero – no signal). And in the midle of city inside some buildings I lose signal and I have just E sign.

I check both SIMs in diferent phones and signal is always full.

Is it posible that the fone from everbuying.net ready for EU market have some settings in software diferent for reception then later official update ? or maybe the fone have some kind of hardware failure?
[Device Reviews and Information] ace of seven:
Bootloop problem, sp flash tools cant work..

Hi there, i got problem with my device. After rooting got no problem at all.

A few days later i saw link here and click on it. Guess what happen? My device reboot itself every 1 hour.

Try become smart (but maybe just acting smart..) try to go for recovery mode and... turn to chinese language. I think it will be the long way... yes it is. Seem not understand chinese, I just press whatever key to reboot it.

Then i try to flash using spflash tool, but still not working. Dunno where is the right way or i'm using the wrong way.

Now still trying to flash it.. maybe will take a days...

Anyone can guide me the correct way here.. really appreciate.

-tired to think with a bunch of working load at my head...

:confused:

#sorry for broken english..
[Device Reviews and Information] Ninjamoz:
is there any link with last rom?
[Device Reviews and Information] daVirus5:
http://www.leagoo.com.my/support/downloads/
[Device Reviews and Information] Marco992:
Hello, Leagoo gave me today the latest firmware for ELITE 1 ---> https://drive.google.com/file/d/0B51BGY36iV27MElESlJhRFppaUE/view?usp=sharing

This version is ---> X5601_OTD_ELITE_5365U_V1.6.3_S160602

You can use SP flash tool to flash it. Can somebody test it and report here if there are important changes?

I have requested the changelog, but they not replied.

Anybody have received this update by FOTA?
[Device Reviews and Information] Marco992:
I have read the values of camera sensors on a file in the folder "/proc"... My rear camera is -> IMX214, and front camera is -> IMX219
[Device Reviews and Information] Kai Aiiv:
Hi everyone!

With the latest update of the Leagoo Elite 1, I got a trojan called LEAGOO Share (I found it using Malwarebytes). Now, it's like the replace the previous problems with new ones. The fact is that this app witch I mentioned earlier is impossible to uninstall. Do you guys know how can I delete it? Maybe using the steps that someone used with the previous problems? Thanks
[Device Reviews and Information] Matt_85:
[MENTION=7558395]Kai Aiiv[/MENTION] you can uninstall anything with root ;) i'm using titanium backup to do so but there are dozens of other ways ^^

i installed leagoo_Elite 1_OS1.1.1_S160602 posted here ,but i noticed the phone stays awake most of the time with no deep sleep (0s) too!

tried to solve the issue with wakelock detector but with no luck…

i think there is something worng in the rom and i'm wondering if in the malaysian version they succeeded in fixing it ,

what are the differences between 1.1.1_S160602 and X5601_OTD_ELITE_5365U_V1.4.3_S1211(fullROMforSPFT) or X5601_OTD_ELITE_5365U_V1.3.1_S1019-s7yler for example?

is the OS1.1.1_S160602 the most upgraded?

there's also a cumulative patch firmware 1.6.1 S160419 i really don't know how to read these versions ! if i'm only focused on dates then S160602 is the most recent but then version numbers?
[Device Reviews and Information] Marco992:
I have asked to Leagoo if there is the android 6.0 for Elite 1...

I have compared S160419 and S160602 by opening the system.img of both firmwares and I can say that drivers not changed, they have edited many stock applications, but to be honest i don't see any changes when I use it.

The last version i think is S160602 but it is not available for FOTA upate contrary to what Leagoo support say.
[Device Reviews and Information] Matt_85:
how about X5601_OTD_ELITE_5365U_V1.4.3_S1211 or cumulative patch firmware 1.6.1 S160419 ?

haven't tried them , but i've noticed in S160602 a slight improvement in battery duration although the phone stays awake all the time , no deep sleep :confused:

and, yes no FOTA upgrade to the S160602 version i've used SPFT to upgrade
[Device Reviews and Information] Marco992:
I have noticed an improvement of touchscreen from the old to newest version.
[Device Reviews and Information] klopeck:
Hello, greetings from Spain.

I just bought this phone and I have followed these steps

1. I installed the rom leagoo_Elite 1_OS1.1.1_S160602.

2. I installed TWRP

3. Turn on the phone and quickly configure.

4. Nandroid backup with TWRP.

5. Root with kingoroot root and I delete two malicious applications (detected with malwarebytes). Use root explorer to delete them.

Only one problem.

I can not keep the root, when restarting the mobile stays in Leagoo logo or screen unlock sim but does not go from there. The only solution is unroot mobile. I've also tried with the TWRP, with SuperSU v.246 and v.2.74 and in all cases the same error.

Is there any way to make root work with this rom?

Thank you and sorry for my bad English.
[Device Reviews and Information] Matt_85:
i've the same rom vaersion i dont'have the problem to maintain root across reboots, although we can't use supersu, but kingroot works well;

i've only installed the apk , let it acquire root and just leave it there, i've not installed any custom recovery ;)
[Device Reviews and Information] Marco992:
anyone tried malaysian firmware version?
[Device Reviews and Information] Matt_85:
after some days that i've installed the rom leagoo_Elite 1_OS1.1.1_S160602. , phone is going to deep sleep, , don't know why , but i'm happy! :D
[Device Reviews and Information] klopeck:
Ummmm custom recovery is the problem?

Email from leagoo

*

"For your information, we does not encourage our users to root our device as the warranty will be consider void if the device was rooted. Our respective departments are currently working on a update for Android 6.0 Marshmallow in Elite 1, we will announce it on our respective channels if it is available.

Thank you and have a nice day."
[Device Reviews and Information] Marco992:
The fingerprint of my elite 1 stopped to work. This is the second time in 2 week. I have tried everything, flashing again the firmware, wipe data... Anyone has idea how to solve this problem?
[Device Reviews and Information] Marco992:
Hello, have you solved fingerprint problem?
[Device Reviews and Information] jacob83:
if the recovery is the problem I'm not sure, but the route is not accepted by the system, after installing root transfer application only to the folder / system / priv-app / and it works fine

---------- Post added at 07:22 PM ---------- Previous post was at 07:00 PM ----------

In my case buy a terminal with fingerprint reader defective, the problem presented was at the time of storing the fingerprint seemed to work right but in everyday use did not recognize my fingerprint, as updates will not solve the problem as I returned to the store and buy a new one that works perfect
[Device Reviews and Information] Chyrox78:
A Noob Need Help With TWRP

Hi everyone :D first I want to apologize if I made a lot of mistakes I'm French ^^.

<Useless Part> I'm very happy that they are a threat about the elite 1 because in my first search when I wasn't sure to buy this phone I didn't find this it :3. I have an Elite 1 rooted with the Kingo root windows software. I went into the same problem like the home button that freeze the whole phone I solve it by deleting random thing like the battery thing idk why x) and for the annoying trojan that I delete by deleting all the suspecting app ^^ <Useless Part/>

<Important Part> But this time I have a problem that I can't solve by myself > I want to install Twrp but I can't find any information on how to install it I have read all of your message (It was very long) and I try different thing from different site but none of my try work. And the Chinese recovery that is installed doesn't help me x) <Important Part/>

Thanks you very much for reading this If you have the solution of just a part please help me;, (
[Device Reviews and Information] Marco992:
I have received a new FOTA this morning... release date: 01/07/2016. Any other received this updated?
[Device Reviews and Information] Marco992:
the new version is: 1.6.9

I have found a bug on this new version: when you press on HOME button to switch app, UI crashes.
[Device Reviews and Information] h352197:
Hi

I've been suffering this since I bought the phone, not new in this version :confused:

Apart of this it seems stable after a few days. Just I have got to freeze again the Beauty Snap app
[Device Reviews and Information] Marco992:
I have wrote this problem on their facebook, please do the same so they will solve this problem. The UI crash when you long press the HOME button. Apart of this, you right, it is stable.
[Device Reviews and Information] Raavo:
Camer

My rear camera is missing. Only front camera working well. Phone is not rooted. Also i do not find camera app from application sheet. Its not disabled sheet also. Is it hardware issue?

Sry from my bad english :cowboy:
[Device Reviews and Information] xmh+xda:
Hi Chyrox,

Quick answer: Installing TWRP2 is same process as installing a full ROM using SP Flash Tool. But prior to this, if you don't want to bootloop, you'll have to go in the "Google Settings" app, "Security" item and uncheck "Scan device for security threats".

It works for me on S160602 with the TWRP2 image from post #85. Some more advice here on needrom