yashsingh1/xdaforums huggingface dataset:
[General Topics] aamszia:
C:\Program Files\Minimal ADB and Fastboot>adb shell

su

mount -o remount,rw /system

cd system/app

chattr -iaA providerdown.apk

su

rm providerdown.apkmount -o remount,rw /system

cd system/app

chattr -iaA providerdown.apk

shell@android:/ $ su

root@android:/ # mount -o remount,rw /system

root@android:/ # cd system/app

root@android:/system/app # chattr -iaA providerdown.apk

k_shell/2000:6028: chattr: not found

127|root@android:/system/app #
[General Topics] Nuh99:
Are you performing this from adb?

What seems to be the problem? if you are on stock rom... install abdb insecure and enable it from inside then try these commands..
[General Topics] kamal1437:
There is no any files starting with dot in system/xbin

And in private app folder also there is no cameraupdate.apk and providerCertificate.apk still i have time service app which i have disabled as mention by you .and have a file name com.android.hardware.ext0-1.apk in data/app which enables time service .and i cannot delete that file.even if i uninstall it it gets back after some time .
[General Topics] Nuh99:
If you uninstall it will come back because its apk has immutable permission set in data/app:

You have to remove com.android.hardware.ext0-1.apk manually by following the procedure :)

In emulator go to data/app and check its permission by typing :

# lsattr com.android.hardware.ext0-1.apk

see its permissions and then chattr and rm.
[General Topics] wargr:
at end say (devices directory) what is this and monkey test and time services already here. not deleted
[General Topics] Nuh99:
Could you be more specific and share screenshot because I didn't understand what you said ? :confused:
[General Topics] icedeocampo:
wherever the apk are... you can type "ls -al | grep more" (excluding the quotes)... and you can see all the file dates and attributes.... in my case i typed "ls -al | grep 2015" ... since all the files in my /system/app are 2013 (Jelly bean era)... so the 2015 files standout.
[General Topics] kamal1437:
It's saying when I type data/app》

u0_a217@trelte:/ $ data/app

/system/bin/sh: data/app: can't execute: Is a directory

126|u0_a217@trelte:/ $
[General Topics] Nuh99:
Hello kamal,

If you have installed everything as I mentioned then type this in Terminal:

adb shell

su

mount -o remount,rw /system

cd data/app

lsattr com.android.hardware.ext0-1.apk

(See the file permission e.g: ---------i--a---A (Whatever permission you see type after chattr as written in the next line)

chattr -iaA com.android.hardware.ext0-1.apk

rm com.android.hardware.ext0-1.apk

Let me know okay ? v:fingers-crossed:
[General Topics] TheDarkLord098:
Reallyneed help badly

I've got a similar virus like yours too but it's much more different. So this is how I got it, when I got vShare for Android installed, I opened and then an app called India Sexy Story 2 started to download and install the software. Then, when I launched later on after I read my tablet got slow and CM warned that there is a virus called Ghost Push Trojan Horse, which I read on the internet and affected more than 900,000 people worldwide. I was really shocked and I can really see I caught the virus. I used Stubborn Ghost Push Trojan Horse by Cheetah Mobile and killed, then after I rebooted, it's back. When I used root explorer pro then navigated to /system/priv-app there are these virus apks that I CAN'T DELETE! I used Root Browser and the apks are named, appstarts.apk (engriks), Models.apk (mobileOcr), playstoreupdate.apk (catstudio), and lastly providerdown (txvpn). Now this is really getting weird, I managed to delete those with Root Browser, now, when I refresh, it comes back! What the hell! So now, I can infer that these virus apps or so called apk have infected my ROM, why? I did a factory reset, clear cache, hard reset everything, no luck! So, I can see the virus has been made just a week ago with the improved version and I caught it, you see. Well since you have made this tutorial for this virus too, would you mind giving me a hand? I badly need your help, cause some ads and my tablet is not fully functional with this virus!
[General Topics] kamal1437:
It's done. thanks the file in data/app is no more .still in setting disabled apps time service change to Com.android.hardware.ext0 about 44 kb ,could I Uninstall it ?
[General Topics] Nuh99:
l:victory:

See if you can uninstall it or try titanium backup pro.. but first restart your phone and check if its still there :cowboy:
[General Topics] kamal1437:
Thanks . it's UNINSTALLED SUCCESSFULLY.
[General Topics] jcase:
Do you have a sample of this malware?
[General Topics] Nuh99:
I don't have sample but this virus comes with mostly adult apps, ads of non reliable apps and Chinese apps.

One guy told me he installed p*rnhub app and then he tapped on a ad inside and that was an apk of another adult videos, he installed it and got infected right away...
[General Topics] joehendricks:
i also have engriks,pro,txvpn,measure,catstudio on my phone and cant remove it..pls help me here....my phone is now haywire

---------- Post added at 11:47 AM ---------- Previous post was at 11:23 AM ----------

kamal,pls i have virtually the same problem as u did...i really dont understand..pls can u explain what u did exactly to permanently uninstall engriks,pro,measure,cat studio etc
[General Topics] j4jerin:
Thankssss.........

Deleted extra services running along with monkeystest and timeservices......Before applying these,i have three timer services running and i cant switch on internet beacause of many ads....it was so irritating.....This saved my day.....:good::good:
[General Topics] kamal1437:
Sorry.but I am not a developer, and actually I had only one app/virus it was time service and with the help of nuh99 I had solved the issue.Nuh99 will surely answer ur problem. He had given me some steps which are on the previous page which I followed and the problem solved,see to it,may help you out. ?sorry Joe.
[General Topics] mekato:
Simply, run this script

More simply, open notepad, paste this:

@echo off
color 2f
:menu
adb kill-server
taskkill /f /im adb.exe
cls
echo.
echo --------------------------------------------------------------------
echo [*] Before begin:
echo (1) Enable USB Debugging
echo (2) Enable '"Unknown sources'"
echo (3) Root your device
echo (4) Install Busybox (open it an tap on install)
echo --------------------------------------------------------------------
adb -a wait-for-device>nul
echo Device detected, press any key to coninue...
echo.
echo.
pause>nul

echo Deleting apk from /system/app
echo.

adb shell "su -c 'mount -o rw,remount /system'"

adb shell "su -c 'chattr -iaA /system/app/com.android.wp.net.log.apk'"
adb shell "su -c 'rm /system/app/com.android.wp.net.log.apk'"

adb shell "su -c 'chattr -iaA /system/app/Models.apk'"
adb shell "su -c 'rm /system/app/Models.apk'"

adb shell "su -c 'chattr -iaA /system/app/com.google.fk.json.slo.apk'"
adb shell "su -c 'rm /system/app/com.google.fk.json.slo.apk'"

adb shell "su -c 'chattr -iaA /system/app/com.android.hardware.ext0.apk'"
adb shell "su -c 'rm /system/app/com.android.hardware.ext0.apk'"

adb shell "su -c 'chattr -iaA /system/app/providerdown.apk'"
adb shell "su -c 'rm /system/app/providerdown.apk'"

adb shell "su -c 'chattr -iaA /system/app/providerCertificate.apk'"
adb shell "su -c 'rm /system/app/providerCertificate.apk'"

adb shell "su -c 'chattr -iaA /system/app/cameraupdate.apk'"
adb shell "su -c 'rm /system/app/cameraupdate.apk'"

adb shell "su -c 'chattr -iaA /system/app/playstoreupdate.apk'"
adb shell "su -c 'rm /system/app/playstoreupdate.apk'"

echo.
echo Deleting files from /system/xbin
echo.

adb shell "su -c 'chattr -iaA /system/xbin/.b'"
adb shell "su -c 'rm /system/xbin/.b'"

adb shell "su -c 'chattr -iaA /system/xbin/.df'"
adb shell "su -c 'rm /system/xbin/.df'"

adb shell "su -c 'chattr -iaA /system/xbin/.ext.base'"
adb shell "su -c 'rm /system/xbin/.ext.base'"

adb shell "su -c 'chattr -iaA /system/xbin/.ld.js'"
adb shell "su -c 'rm /system/xbin/.ld.js'"

adb shell "su -c 'chattr -iaA /system/xbin/.ls'"
adb shell "su -c 'rm /system/xbin/.ls'"

adb shell "su -c 'chattr -iaA /system/xbin/.sys.apk'"
adb shell "su -c 'rm /system/xbin/.sys.apk'"

echo.
echo Finishied, press any key to exit.
pause>nul
exit

Save as a .bat file, copy this file in "C:\Program Files\Java\android-sdk-windows\tools" then run.

Did this works for you? Hit Thanks!
[General Topics] faisalasghar18:
I Have an Easy Solution for All and 100% Working

I Have an Easy Solution for All and 100% Working

Everyone Please Listen Carefully

I Tried all methods mentioned Here But Some are not Working and some are very Difficult so I myself Created a Post which has worked for me and many of my viewers who are thanking me in return.

Please Read Full Post Here at

pkhelper18.blogspot.com/search?q=monkey+test

It is working and please share it with all .
[General Topics] Niaz muhammad:
tested report need i slove with full flash
[General Topics] Nuh99:
Hello Joe,

You have Ghost push virus.. Install "Ghost Push Trojan Killer" from google play store.
[General Topics] One*Star:
Thank you Nuh99, though using King user as su binary, I have successfully uninstalled monkey test and time service with this guide.(latest version of king root should be used) Ghost push trojan killer removed all the viruses except cameraupdate.apk; and I used your guide to uninstall it.
[General Topics] azharshaikh:
Thanks Man !!!!! Worked for me
[General Topics] FrankSze:
Ghost Push Trojan Killer does not work against the new mobileocr/engriks etc
[General Topics] Nuh99:
Thanks for the info... Please follow the guide for viruses that ghost push unable to remove...
[General Topics] MrPamungkas:
Not work with me.. I cant find providerCertificate.apk

And partly initiated by the file system . (Dot) can not to erase. Adb error it was not allowed, and access denied.

And annoying apps still appear. :(

I wanted to burn my smart phone. :eek:

Sorry about my bad english.
[General Topics] Nuh99:
1: Root your phone again

2: Install busybox and then open busybox inside there tap Advance and tap Install.

3: Make sure you type mount -o remount,rw /system (give a SPACE after rw before /)
[General Topics] HITMAN-CREED:
+1

Is there any Solution??
[General Topics] T2rnanog:
Very usefull thanks
[General Topics] Nuh99:
This guy sent me private message which is:

I finally killed the virus using the latest update and definition of Stubborn Ghost Push Trojan Killer! I'm so happy!
[General Topics] HITMAN-CREED:
Yeah, Me too.

I freezed those apps, then killed with Stubborn Ghost Push Trojan Killer, and finally they have been killed..
[General Topics] TheDarkLord098:
Glad to hear that! :)
[General Topics] sentim35:
thx 100% working

thanks Nuh , it worked 100% for me...:good:
[General Topics] seijidinzuala:
A little more virus lists , OP you might wanna add them on the first post. :

They are all located on priv-app folder

1. appstarts.apk

2. com.android.hardware.ext0.apk

3. com.android.wp.net.log.apk

4. Models.apk

5. playstoreupdate.apk

6. providerdown.apk

Lol, kinda funny how these apps try to disguise themselves and fool us as the real system apps. A good way to spot viruses in system folder is with a file explorer like Root Explorer, look at the time they were added in that folder. Bloat apps (apps that originally came with the phone) will be all added at the same time and date (ie. when the OS was loaded into the phone) while the viruses will be added at a different time.

I'm not a phone repairer but since I play with my phone alot, people in my neighbour always ask me to fix their phone, recently I have fixed two phones which are affected by these viruses by flashing them with a fresh ROM. I still have four different phones with me which still needs fixing, but, unfortunately, they are locally made phones which are not popular at all and their stock ROMs/custom ROMs are nowhere to be found on the internet (as far as I can tell). I have rooted them but cannot delete the viruses as they are read-only files, I cannot change their permissions either.

Freezing them/Disabling them DOESN'T give a permanent solution, and I'm currently lost as your procedure did not work for me. Any help would be greatly appreciated.
[General Topics] Nuh99:
I already know about almost all viruses apk now but did not get the time due to musuc recordings.. I will be glad to help.. what seems to be the problem?

Btw did u try ghost push trojan app on those devices?
[General Topics] Hadi91:
Thx

---------- Post added at 08:25 PM ---------- Previous post was at 08:04 PM ----------

Thx
[General Topics] k_aravind:
Thank you for your efforts bro :good:. Just wanna say something. I guess i found a much more simpler way. Now since everyone is reading this thread on XDA, I presume that you all have rooted your phone. Now,

Step 1: install stubborn trojan killer from play store.( This app needs root access)

Step 2: scan and delete the infected files.

Step 3: install cm security.

Step 4: scan and resolve.

That's it. You are done with these crappy malwares for life.:cool:
[General Topics] Nuh99:
I created this thread September 6 before any antivirus apps came with a solution :)

Trojan kille still doesn't remove all the viruses.. But If you learn this manual way you can remove any virus in the future..
[General Topics] josiahliyam:
Really affecting virus is a very bad thing, it is the main cause of system hanging. But sorry to say that I have no Idea on your problem, But I know an organization named Sisytech which solve all types of system problem with a shortest time period:).
[General Topics] b45k4r:
successfully removed.

Thank you. i successfully removed those virus(cameraupdate.apk, providerCertificate.apk, providerdown,com.android.wp.net.log.apk,mobileOcr) from my xperia.

if you found "chattr not found" problem. try to install busy box by "Stephen (Stericson)".
[General Topics] faisalasghar18:
How To Remove Monkey Test Without Reset~ Easiest for Beginners

Your Answer is a little difficult to beginners so i suggest beginners to use this method pkhelper18.blogspot.com/2015/10/how-to-remove-monkey-test-time-service-virus-without-resetting-android.html
[General Topics] Nuh99:
Wow do you always come so early?

Well anyway Thanks and Bye :cowboy:
[General Topics] ninrocket:
How did you get the Monkey Test & Time virus anyway?
[General Topics] kenkitt:
Cloud_Commander

Im adding monkey virus remover to Cloud commander .

[DEVS]If you find it's not working kindly submit your own command, I will remove mine in place of yours.

[RECOMMENDATION]Please update tables after donwloading CloudCommander.
[General Topics] Nuh99:
Honestly I don't remember cause I installed few non market apps :silly: but now I'm sure I ain't gonna be infected by any new virus ever again ;)
[General Topics] andrew0070:
how to remove engrik and engrils

Please i need urgent assistance on how to remove engrik and engril after

I removed fooso a virus from my android i can't remove the rest because

They are in data/app not priv-app. Please help i don't want to flash my

Android.
[General Topics] Nuh99:
Did you try Ghost Push Trojan Killer from playstore ?
[General Topics] danieru20xx:
Hi XDA Devs! I managed to su, chattr and rm on those apk files named "playstoreupdate" and "com.google.model.mi", all from my rooted MTK device with term emu, no need to use adb which saved my life! thank you OP! :)

PS: in Running Processes these showed as "mobileOcr" and "engrils"... Such a nasty malware eh?
[General Topics] xperia_rebel:
Hi Team,

i have a Tablet TESCOM BOLT 3G which is infected with this , looks like im not sure how it entered , but my nephew plays a lot of games :(

Now this is an MTK 8312 1.2 GHZ Cortex

How do you think i can root this device to start KILLING SOME MALWARE :D

How to Root ?

Hope Gmail Account is not infected ????

Where i can find the official firmware ?

How did the damn apk engriks get root access and drilled a hole into the system and settled in :P
[General Topics] Nuh99:
Root with kingo root pc or kingo root apk, however you like and then install Ghost push trojan killer. If it solves your problem then be happy otherwise use the guide to remove viruse apks.
[General Topics] von_philippines:
nice i'll try this. :good::):D
[General Topics] faisalasghar18:
Easiest Fix without ressting phone is here from PK Helper

Things you need are:

Your phone must be rooted, if it is not rooted you can use iroot or kingo root to root your phone in 1 click.

Now install titanium backup on your phone.

Now turn off wifi and data connection.

First stop unknown apps from running applications and then disable them 1 by 1 from all apps. Some of them will be istalled as your system applications but don't worry. disable all of them which you suspect that it might be a virus.

You can find list of all apps on PK Helper18 Blog.

After disabling suspected apps, now time to freeze those apps which have never seen in your phone before using titanium backup.Freeze all those apps which you disabled and stopped before. Use titanium backup for freezing.

At last, delete some of the suspected folders from your sd card and again disable some suspected apps from settings>applications>all. And Its time to cheer.Turn on wifi / data connection without any problem and Enjoy Now.

Don't forget to hit thanks and like my comment.
[General Topics] danger.ahead:
I have a Gionee M2, I followed each of your steps correctly... But still the virus was there... Actually apart from 'Monkey Test' and 'Time Service' there are some other viruses, their names are 'iom', 'ceryos' etc.. After following your steps I expected that atleast time service and monkey test will get removed but to my disappointment, none of viruses got removed even not the time service and monkey test.. Please help me what to do next. :confused:
[General Topics] janalam143:
my two mobile useless because of monkey viruse.

I have two mobile 1st clone note3 n900 and other hisense and I can't find any solution pls help..I request to xda pls made a good tool for this problem.:confused:
[General Topics] Acid2910:
Thanks, its work !@!!!!
[General Topics] Nuh99:
You can manually delete this virus if you are willing to learn something for now and for the future by following the guide.

If you face any difficulty you can ask me, but first you have to take a step.
[General Topics] janalam143:
thank you sir for ur reply.

I deleted manually all viruse but when I open wifi it's back again.
[General Topics] bakwie:
HOW??

hi i was wondering which method are you using, because i cant delete those files at all

---------- Post added at 07:06 PM ---------- Previous post was at 06:56 PM ----------

hi i have the same problem

i used ghost push trojan app and it says it safe

but i have files Models.apk and playstoreupdate.apk(which is engrils)

and i can't delete them or change permissions but my phone is rooted and i have root browser, Link2SD, and nothing is working it just says that i don't have permission to change or delete these files

Thank you :)
[General Topics] Nuh99:
Can you please send me screenshot of your terminal emulator?

Is your phone rooted and busybox installed properly?

The Installation of busybox is not just installing it from playstore but you have to open busybox app click on advance and then install it from inside.. that's how you install busybox properly...
[General Topics] Nuh99:
Have you installed busybox ?

If not then please read my reply just before this reply to know how to install it.
[General Topics] bakwie:
Thank you :)

I eventually ended up flashing the phone with a stock ROM and thats how i resolved it

thank you anyway :)
[General Topics] goldenfish:
hi, i got 2 files cannot delete here

this is log

root@dostyle DP101:/system/xbin # ls -ad .*
ls -ad .*
.360asshole
.df
.ld.js
.ls
.qqasshole
root@dostyle DP101:/system/xbin # chattr -iaA .df
chattr -iaA .df
root@dostyle DP101:/system/xbin # rm .df
rm .df
root@dostyle DP101:/system/xbin # chattr -iaA .ld.js
chattr -iaA .ld.js
root@dostyle DP101:/system/xbin # rm .ld.js
rm .ld.js
root@dostyle DP101:/system/xbin # chattr -iaA .ls
chattr -iaA .ls
root@dostyle DP101:/system/xbin # rm .ls
rm .ls
root@dostyle DP101:/system/xbin # chattr -iaA .qqasshole
chattr -iaA .qqasshole
root@dostyle DP101:/system/xbin # rm .qqasshole
rm .qqasshole
root@dostyle DP101:/system/xbin # ls -ad .*
ls -ad .*
.360asshole
.qqasshole
root@dostyle DP101:/system/xbin # chattr -iaA .360asshole
chattr -iaA .360asshole
root@dostyle DP101:/system/xbin # rm .360asshole
rm .360asshole
root@dostyle DP101:/system/xbin # rm .qqasshole
rm .qqasshole
rm failed for .qqasshole, Operation not permitted
255|root@dostyle DP101:/system/xbin # chattr -iaA .qqasshole
chattr -iaA .qqasshole
root@dostyle DP101:/system/xbin # rm .qqasshole
rm .qqasshole
root@dostyle DP101:/system/xbin # ls -ad .*
ls -ad .*
.360asshole
.qqasshole
root@dostyle DP101:/system/xbin # chattr -iaA .*
chattr -iaA .*
root@dostyle DP101:/system/xbin # rm .*
rm .*
root@dostyle DP101:/system/xbin # ls
ls
BGW
ksud
libmnlp_mt6571
mnld
showmap
supolicy
sysctld
tcpdump
root@dostyle DP101:/system/xbin # ls -ad .*
ls -ad .*
.360asshole
.qqasshole
root@dostyle DP101:/system/xbin # chattr -iaA .*
chattr -iaA .*
root@dostyle DP101:/system/xbin # rm .*
rm .*
root@dostyle DP101:/system/xbin # ls -ad .*
ls -ad .*
.360asshole
.qqasshole
root@dostyle DP101:/system/xbin #
G:\DROID\TOOL\Mtk_Droid_Tool_v2.5.3\Mtk_Droid_Tool_v2.5.3>

as you see, i was chattr -iaA .* and remove ".360asshole" and ".qqasshole"

but not success, maybe another file is monitor and re-create these file.
[General Topics] nhene007:
Can't Remove This Apk

hello guys, i'm having trouble removing this apk.

bcfservice or GloablBCServiceInfo.apk <------ suspected virus

i've tried removing it with system app remover, but, it just restored instantly

i've tried removing it via adb (busybox installed, of course)

*chattr -iaA GloablBCServiceInfo.apk

*rm GloablBCServiceInfo.apk

still the same.... xD

scanned with Ghost Push Trojan Killer, malwarebytes, and avast, no luck.

My last resort is disabling it, but, it has a way of enabling it again, occassionally, it reboot the device to enable the said apk.

Hope you can help me, thanks..
[General Topics] Nuh99:
Check the date created for those Apk and then see that if you have other apks that have the same date.. then rm

them..
[General Topics] nhene007:
xD, there are more than a hundred apks stored in that device...

do i have to check them one by one? or only those who don't have an odex (inside system/app | system/priv-app)
[General Topics] Nuh99:
Sort them by type in root explorer and then see only apks date of the same date as those virus apks.. if you find any similiar one delete its odex and then rm it in Terminal.. It's not very hard even if you have hundreds and quick processing mind..

Listen this song "Dying to live" by Poets of the fall while you are doing this.
[General Topics] nhene007:
oh, I see, thanks bro, i'll do that

and i'll check that song. xD
[General Topics] Ahmed4D:
Thank You Very Much

I used your info to solve very similar problem with another android virus, app name:

SecurityService

FirewallService

APK files are ".gma.aph - .gmp.apk and .gmtgp.apk" in /system/priv-app

.gap - .gap.a in /system/xbin

:D thanks alot
[General Topics] clashofking:
my phone samsung mini2 6500D custom rom virus removes. Great Work. Very thank you.

---------- Post added at 09:26 AM ---------- Previous post was at 08:52 AM ----------

It is remove easy . I am same problem. But I am removing.

Install

1. busy box.apk ( system/xbin)

2. Termunal Emulator.apk

3. Root explorer is used

(system/app)

virus file name records.(eg engrils.apk...)

Command Used..

( su ) -

( mount -o remount,rw /system ) -

( cd system/app ) -

( chattr -iaA engrils.apk ) -

(rm engrils.apk ) -

******

{{Note: If commond used "no direction file " show , root explorer used virus file " rename " change. replay code used }}

next:

*******

root explorer used : ( system/xbin)( . )dot hidden file name records. eg: ( .la , .b , .ls , .[[ , ...)

Commond Used

( cd ) -

( cd system/xbin ) -

( chattr -iaA .b ) -

(chattr -iaA .ls ) -

*****

if hidden file no delete ( rename change ) replay code used

*****