yashsingh1/xdaforums huggingface dataset:
[General Topics] PAPalinskie:
Newly discovered EXPLOIT:

new exploit replaces system apps. these exploits are from pornclub exploit vulnerability issue due to automatically installing in user and system. you can only remove the exploit by re-flashing your full rom and if you are lucky, without wiping userdata if the exploit level is in system. to prevent this, i recommended that you install an app that can manage to fix system core and some holes that some exploits using it.
[General Topics] Nuh99:
Will you please elaborate what's new about this?

Log or whatever...
[General Topics] vlad8495:
I also have a sky vega that blinks and there is always a go shopping app appearing on it. It always restarts even the battery is fully charged. Keeps the WiFi turning on even if you turn it off.
[General Topics] PAPalinskie:
these kind of exploit are just like worms that replacing apks from system/app or system/priv-app and replacing very aggressive ad-ware apks in these locations that forces the device to download anything from the web when you open your network and displays ads aggressively even you dont have network. as the diagnosis for some of devices that iv'e fixed recently, system apps that have been replaced by ad-ware apk files cannot be recovered and totally, the android system was infected by ad-ware exploits, unless you have a nandroid backup or a full rom package from your manufacturer/developer that can fix your android system with/without wiping user partition.
[General Topics] nass08:
I'm having trouble removing this 4 virus.

after fallowing the instruction, it was successful., but after restart its keep going back.

please help me.
[General Topics] Nuh99:
Can you please tell me about infected apks in details ?
[General Topics] makarelo:
Can't remove .gap file from system/bin.

I tried all of these methods, used the monkey removal software (monyet gila), tried to delete manually but after reboot it comes back.

What I managed to do is to contain the virus, it isn't aggressive as it used to be, it's only constantly trying to open google store.

App Names:

- Phone Service - com.android.base.jinti:daemon

- Local Alarm . com.iduo.tual with three services running:

UClass

SClass

TuaService

I also tried all antiviruses and Stubborn trojan killer but had no success.
[General Topics] Nuh99:
Freeze the apps and services with titanium backup pro and then try to remove them.
[General Topics] makarelo:
Froze it in Titanium Backup and deinstalled, few seconds later it's back.

No other suspicious apps running at all. Then I froze the app and as soon as it was uninstalled i rebooted the phone, and did a factory reset.

After the reset, it came back up. Local alarm got downloaded by some other app and now it's spamming other apps install.

What I noticed on startup, app called org.snow.down.update was running and it's the app which probably downloaded Local Alarm.

Couple of screenshots:

http://imgur.com/a/vPsAO

Output of 'pm list packages -f':

http://pastebin.com/NhDccihX
[General Topics] Nuh99:
Did you try to remove org.snow.down.update ?

Anyway I'm gonna upload Monkey Test Virus Checker and Monkey Test Virus Remover apk tomorrow...

I assume you struggled with Windows OS Monkey Test Remover and it didn't help.. If this virus is a part of monkey test the apk will remove it.. Meanwhile you try out removing org.snow.down.update & Let me know!
[General Topics] makarelo:
Yes, I have removed org.snow.down.update and a vast number of other apps before removing Local Alarm, but Local Alarm and Phone Service keep installing themselves.
[General Topics] makarelo:
Today I got an email from ISP that one of my computers has been infected with a botnet (tinba botnet?) and the date corresponds to the date I got this mobile phone. Be sure shutdown / unplug the battery if you're infected.
[General Topics] TheDarkLord098:
Thanks for letting him know for me :) wasn't be able to be active for quite a while
[General Topics] tulasi574:
rm action failed

i tried all u said but rm action was failed and giving error message as read only file system.

I am attaching screenshot link too

[IMG="screen shot"]https://drive.google.com/open?id=0B7HpCxr9CHe5YlRuVjRkbXpxZWs[/IMG]

Please help me i want to get rid of those malware's.
[General Topics] joshuas_79:
well. I finally have been able to remove those files (now I'm testing the tablet to confirm it's clean)

I wasn't able to use command chattr because it wasn't on my /system/bin folder. If you have the same problem, install the app called: "Busybox on the rails", then open it and press "install" ( I think you have to do it twice). After that, you'll be able to use command chattr and rm without issues.

Ex XDA user called Samuaz helped me to find it out.
[General Topics] syafiq812:
sir it cant remove.. cameraupdate.apk cannot be deleted because read-only
[General Topics] killfrenzy05:
Basically, it cannot be remove easily even on factory reset or uninstall in the setting. According to Norton, this is a malware that can consume enough space and drain your battery. The best way is to flash firmware or stock rom . This also help to freeze this app. Read more http://www.androidcribs.com/2015/08/tutalternative-way-to-remove-monkey.html
[General Topics] optimumpro:
If the apps come back after factory reset and you have original manufacturer provided firmware, then those programs are part of Android and not viruses. Monkey test is a known Android test application that is used for debugging purposes. Camera update is a little app that checks manufacturer's site for update. Time service is an app that takes care of your device having correct time and provided by such manufacturers as Qualcomm and others. Contrary to claims made by the OP, neither Norton nor other anti-virus web site talks about these apps as viruses. There is one or 2 posts on Norton community and they look like written by the same person who posted here. So, no official confirmation that any of those programs is a virus. There is absolutely no proof they do anything illegitimate. If you don't like them, just freeze them in Titanium or any other similar app.

To the OP: please stop spamming the board with this nonsense.

P.S. Both Norton and Mcafee are known for numerous false positives. Also, there is a little known secret about those: they can never prevent new viruses: first the virus has to spread/infect, then it becomes known and then it is finally added to their database...
[General Topics] Nuh99:
Oh I see

:eek:
[General Topics] Nuh99:
Goodluck with that :good:
[General Topics] Nuh99:
Good advice dear. Thanks for being a sidekick on this journey of thrones :D

Love and respect :good:
[General Topics] syafiq812:
Thank you very very much nuh99.. god Thank you very very much nuh99.. god bless you.. this method is working without flashing
[General Topics] syafiq812:
:good: :good:
[General Topics] joelzed:
I did all as said but the problem still persists as I reboot android is upgrading and monkey test and time service are there in my app list pls help
[General Topics] Axislan:
I have same problem about time services and Monkey test, but when i enter a command for remove cameraupdate.apk it said

rm failed for cameraupdate.apk, Operation not permitted

and I have One more Monkey test (com.android.wp.net.log.apk)

when i removing this apk then same failed command :-

rm failed for com.android.wp.net.log.apk, Operation not permitted

what i should do.This viruses hanging my mobile.

My mobile's android version is 4.2.2
[General Topics] Nuh99:
Did u install busybox from inside the busybox app? If no then do it.. if problem still persist try installing busybox on rail and install it twice as it mentioned in a reply by Joshua on 3rd page.
[General Topics] Nuh99:
I'm sure you must have missed something, Either busybox installation or SuperSu. So Plz review positive replies on this post or review negative replies and flash your phone.
[General Topics] EliardoM:
very good this tutorial helped.
[General Topics] One*Star:
Install titanium backup pro, tap backup/restore, select monkey test and time service provider and tap freeze. NB: your phone should be rooted.
[General Topics] Nuh99:
Sorry to interrupt but this guide is not about FREEZING monkey test and time service.

Please make another thread? Thank you!
[General Topics] One*Star:
When the viruses are frozen, they don't operate, you can also uninstall them in the titanium backup pro by tapping on them and pressing uninstall.
[General Topics] Nuh99:
No you can't this one :)

Please make your own thread and see how many people are able to uninstall it like you mentioned.

NONE so don't make a thread and never write what you don't know about.
[General Topics] One*Star:
I did the same and it worked well for me, why would I post something I don't know? try and see for yourself before commenting.

---------- Post added at 10:11 AM ---------- Previous post was at 09:54 AM ----------

Titanium backup pro stops the virus from operating and I think that's what most people want. After freezing, you can scan your phone with an antivirus and you will find out that it's free from malware.
[General Topics] waseemahmed345:
i have an issue to delete dot files in xbin folder.

Error: Chattr: setting flags on .b: Read-only file system
[General Topics] Nuh99:
Goodbye One*Star ^_^
[General Topics] Nuh99:
Hello waseemahmed with telenor code.. did u find and deleted the corrupt apks? if yes then try reinstall busybox... or busybox on rails..
[General Topics] One*Star:
Why are you upset about me trying to share what worked for me? It maybe helpful to them. Visit androidcribs.com and read about it; there are many ways to kill a cat.
[General Topics] One*Star:
I'm sorry for trying to assist guys in your thread, I just wanted to share the little I know. My aim here, is to learn and share to others, hope you will forgive me.
[General Topics] Nuh99:
It's not that I'm angry on you or something if you feel that way I'm more sorry than you are. All I meant to say that it's not possible if it solved your problem I wonder how cause this virus is very tricky and I also learned from here and various forums and when I finally removed it from my tablet then I wrote this guide. I tried your method when MT & TS first hit my device. It just froze both services with no uninstall or even if you are able to uninstall them they raise their head again. Titanium is very good solution for freezing but It also doesn't help removing it completely and if I had a perfect ROM for my device I wouldn't bother finding the solution. So please forgive me if any of my words hurt you in anyway.

Thanks and Love.

-Nuh
[General Topics] reuben27:
hi mines lenovo vibex kitkat...

n i hav same virus monkey test n time service...

i hav reched step 5.terminal...n when i type adb shell it says

error device not found

so what 2 do..???
[General Topics] najrazlug:
Plz Chek Fail to delte .b and etc files

http://xdaforums.com/general/general/chattr-seeting-flag-permission-denied-t3202818
[General Topics] Chun Vanda:
Easy way to stop timeservice and monkeytest on andriod best result:

1/ go to setting

2/ go to App manager => all =>find timeservices and monkeytests.

3/ disable it all.

4/ enjoy your android working fluently.

More info: +855318409000 or chunvanda@gmail.com.
[General Topics] reuben27:
bt every tym it restarts it comes again..
[General Topics] Nuh99:
Open busybox app in your device and install busybox from inside and make sure you have SuperSu before you give commands.
[General Topics] Den130:
i can't install any version of busybox from "busybox installer app" it said :Busybox installation failed .. wt to do ? :(

plzzz help
[General Topics] Yasminatarik:
Time service and monkey test

This is really useful if you guys follow these steps you're gonna get rid of this virus for sure!

Thanks for this huge help<3
[General Topics] freeandroid:
im install busybox root with supersu but when type this commend chattr -iaA providerCertificate.apk this say: setting flags on provider.....apk read-only file system
[General Topics] Nuh99:
Thank you!

You have been the sharpest girl ever :)
[General Topics] Nuh99:
Dear friend - Root your phone again with kingoroot and then Superuser to Supersu. Install busybox and then try.. Make sure you have usb debugging enabled and busybox installed properly.

Also check your Xbin folder, Priv-app or app folder files permission by typing lsattr.

some devices have different permission write down those permission on and Chattr them.
[General Topics] Igor Alter:
Igor Alter

Thank you, Nuh99!

You are legend!

I have spend days, trying to get rid of this annoying malware.

Just wanted to add something FYI:

You most likely have been infected to SnapPea (Windows/Android) software:

Google for:

If while deleting *.apk files you get "read only" message and file cannot be deleted - you have to remount your /system partition be mounted as a read/write partition.

What you need to do is:

# mount -o remount,rw /system
[General Topics] Den130:
thank you very much Nuh99 u saved my phone
[General Topics] macon157:
help me

i did as u said, when i typed

...

chattr -iaA providerCertificate.apk [enter]

notice: chattr: Read-only file system while setting flag on providerCertificate.apk

rm providerCertificate.apk

notice: rm failed for providerCertificate.apk, Read-only file system

...

and i can get rit of those malware

it also happen with cameraupdate, .b, .ext.base, .sys.apk
[General Topics] Nuh99:
Kindly follow this :
[General Topics] Axy_Nekoi:
Thanks!!

After so many attemps, on try and error, finally i can get rid of those annoying malware. Thank you so much for helping us!! :D
[General Topics] shalinsurana:
virus partially gone

thank you for this method bro.

i had like 2 monkey tests and 4 time service disabled.

now i still have one time service left and i dont know what is that time service named (eg: other time services were like com.android. etc.)

and i also have a problem that whenever i reboot my phone hola launcher and 2 more apps keep getting installed automatically everytime and some new apps also get installed when i am using my net.

please help.

you can contact me on my email-id : sneakbasher@gmail.com
[General Topics] Nuh99:
Hello

Im glad it helped you.

What OS you have kitkat or jelly bean?

If KK send me screenshot of all apps from system/Priv-app

If JB then system/apps on my fb link given in my profile.

Note: In root explorer sort files by type to align all apks in order for screenshots.

Thank you :)
[General Topics] shalinsurana:
screenshot of system app

i am using 4.2.2 jellybean

the link to the screenshots is http://xdaforums.com/album.php?u=6961795

thanks.
[General Topics] Nuh99:
I assume this virus attacked you on 23rd August.

Well these are the files you need to remove from apps:

Models.apk

Launcher0920bx6jPec.apk

Launcher0923LJ7ThCa.apk

Be very aware of Small or Capital letters while typing these apk names or they wont be removed.

If it solves your problem let me know and if it doesn't then also delete these files but first make a backup of these files in your computer or elsewhere.

providerdown.apk

SecurityCertificate.apk

SettingProvider.apk

(REMINDER : SpeLLinG)

Happy hunting :)
[General Topics] Dkvyas007:
Do we require our device to be rooted to use "su" command?

--------------

Hello ..i m a newbie to android..pl clarify me that Do we require our device to be rooted to use "su" command?
[General Topics] Nuh99:
Yes sir Yes! you have to root your device to use SuperSu.
[General Topics] BoxerGames:
same here
[General Topics] freeandroid:
Thank you my friend.

finally deleted!!

after this line "su"

i use this " mount -o remount,rw /system"

and other lines and its work for me.
[General Topics] thisisgulshan:
Monkey Test & Time Service Removal Explained in Detail

Refer :

onlinesurprises(dot)com

Enjoy ...:o
[General Topics] Nuh99:
Very good effort but it would be great if you give credits where its due ?

Anyway there is an apk coming soon that will uninstall MT & TS with one tap.

I am also going to name out every app from apps or priv-app folder and dot files from xbin folder.

Thank you!
[General Topics] thisisgulshan:
Check onlinesurprises(dot)com post for the detailed solution with the meaning of each command which need to enter on Terminal Emulator
[General Topics] thisisgulshan:
Refer this also

onlinesurprises(dot)com/2015/09/remove-monkey-test-time-service-virus-without-flashing/
[General Topics] Nuh99:
You want to be famous?

Do something original.
[General Topics] thisisgulshan:
Monkey Test & Time Service Fix without flashing

Below are few of the website links which have exactly same solution as you have given:

abdroid4g(dot)blogspot(dot)sg/2015/09/fix-for-monkey-test-time-service-virus_6(dot)html

smartphone(dot)erudisi(dot)com/cara-mengatasi-malware-monkey-test-dan-time-service/

www(dot)openeduusa(dot)com/2015/09/06/fix-for-monkey-test-time-service-virus-without-flashing/

Now you knows better who has copied from where.

Apart from that, you mentioned "I'm not a developer and That's it!"

I will tell you that I am a Programmer and I know the meaning of each and every command entered on Terminal Emulator. That's why I explained the meaning of each command in my post onlinesurprises(dot)com/2015/09/remove-monkey-test-time-service-virus-without-flashing/). Because I believe that users should know what and why they are doing rather then blindly following the steps that are just specific to a particular version of android and infected apps.

And yes I took help from this post to fix my phone but I did it in my way.

Thanks
[General Topics] Nuh99:
Hello programmer,

Well the things you have posted on your site are exactly the same words as mine. I guess you were too much busy in programming that you forgot how to write. Who wrote this reply for you that you just pasted here?

and mr programmer why did you need help from my post to fix your phone when you had those three links that I just came to know about...

(BTW two of those links are juts a copy paste from my guide by some unknown want to be known guys or whatever. I have seen so many guys faking it like they wrote the whole procedure, anyway if you are a programmer and you understand any kind of language you can compare this reply and my whole guide and you will get the idea :)

Now please make your own thread and please stop pasting your link here... I fixed more than 600 devices now... and I'm still not a programmer and the way you are keep posting your link here that is kinda making you look hungry to be noticed.. I have noticed you and you are famous..

Farewell....
[General Topics] didhiy:
I don't believe this problem too just like you... Hard to believe that an OEM rom suddenly have some new apks in system app folder.

Unfortunately all the posts being wrote in this thread were true, it happened to my friend's phone. His phone is Lenovo a369i. I think there was a bug in mtk devices that make them can be easily exploited and infected by some malware apps.
[General Topics] bouyett:
Do i need computer to carryout the operation
[General Topics] Nuh99:
No you don't.. but you can also do it with computer through adb but that's another topic..
[General Topics] gandolf007:
hi everyone

dear Nuh99 , thank you for your tips !!

a question ?: how to rm directory in my storage till starting with a dot (eg: .ext.base)!!!?

i cant delete that, and i cant format my storage in settings menu !

log :

busybox installed .

do you know any commands for remove folder on my storage to remove this malware

tanx alot
[General Topics] One*Star:
Nuh99 has really helped android user suffering from monkey test and time service malware.
[General Topics] Nuh99:
Thanks for your reply and not giving up :good:
[General Topics] One*Star:
Welcome.

---------- Post added at 02:09 AM ---------- Previous post was at 01:51 AM ----------

I want to try this guide with king user, what do you think of it?
[General Topics] Nuh99:
I have tried myself many times but kingroot superuser does not fully root the system.. it's for basic rooting or you can say safe rooting.. It didn't let me install busybox which is essential... but you can try and please let me know if you succeed. :fingers-crossed:
[General Topics] One*Star:
I was able to install busybox after rooting with the latest version of kingroot. When I get clockworkmod recovery, I will do a nandroid backup and use this guide to completely remove these viruses.
[General Topics] khamees_xi:
C:\Users\khame\Desktop\Minimal ADB and Fastboot>adb shell

shell@android:/ $ su

su

root@android:/ # adb shell

adb shell

* daemon not running. starting it now on port 5038 *

* daemon started successfully *

error: device not found

1|root@android:/ # mount -o remount,rw /system

mount -o remount,rw /system

root@android:/ # cd system/app

cd system/app

root@android:/system/app # chattr -iaA providerdown.apk

chattr -iaA providerdown.apk

root@android:/system/app # rm providerdown.apk

rm providerdown.apk

root@android:/system/app # chattr -iaA com.android.wp.net.log.apk

chattr -iaA com.android.wp.net.log.apk

root@android:/system/app # rm com.android.wp.net.log.apk

rm com.android.wp.net.log.apk

root@android:/system/app # chattr -iaA com.android.Markserver.apk

chattr -iaA com.android.Markserver.apk

chattr: stat com.android.Markserver.apk: No such file or directory

root@android:/system/app # chattr -iaA com.android.Markserv.apk

chattr -iaA com.android.Markserv.apk

chattr: stat com.android.Markserv.apk: No such file or directory

root@android:/system/app # chattr -iaA com.android.hardware.ext.0.apk

chattr -iaA com.android.hardware.ext.0.apk

chattr: stat com.android.hardware.ext.0.apk: No such file or directory

root@android:/system/app # chattr -iaA com.android.hardware.ext0.apk

chattr -iaA com.android.hardware.ext0.apk

root@android:/system/app # rm com.android.hardware.ext0.apk

rm com.android.hardware.ext0.apk

root@android:/system/app # chattr -iaA com.android.psync.apk

chattr -iaA com.android.psync.apk

root@android:/system/app # rm com.android.psync.apk

rm com.android.psync.apk

root@android:/system/app # chattr -iaA com.android.psetting.apk

chattr -iaA com.android.psetting.apk

root@android:/system/app # rm com.android.psetting.apk

rm com.android.psetting.apk

root@android:/system/app # chattr -iaA com.google.model.mi.apk

chattr -iaA com.google.model.mi.apk

root@android:/system/app # rm com.google.model.mi.apk

rm com.google.model.mi.apk

root@android:/system/app # chattr -iaA com.google.fk.json.slo.apk

chattr -iaA com.google.fk.json.slo.apk

root@android:/system/app # rm com.google.fk.json.slo.apk

rm com.google.fk.json.slo.apk

root@android:/system/app # chattr -iaA com.android.pumo.apk

chattr -iaA com.android.pumo.apk

root@android:/system/app # rm com.android.pumo.apk

rm com.android.pumo.apk

root@android:/system/app # chattr -iaA BatteryControl.apk

chattr -iaA BatteryControl.apk

root@android:/system/app # rm BatteryControl.apk

rm BatteryControl.apk

root@android:/system/app # chattr -iaA com.android.aoml.apk

chattr -iaA com.android.aoml.apk

root@android:/system/app # rm com.android.aoml.apk

rm com.android.aoml.apk
[General Topics] Riowald:
Thanks!

Thank you Nuh99! :good::good::good:

I followed everything you said and the removal worked perfectly on my Xiaomi Mi4S. :laugh:

One thing I just wanted to add though was that TimeService on my device was in a different package, com.android.provider.down2. Removing providerdown.apk (via chattr & rm) in system/app did the trick though. Just mentioning this in case TimeService changed for anyone else.
[General Topics] Nuh99:
Thank you for reporting back brother.

When I started this thread I only knew few packages, Every device has its own packages. The whole guide is an idea how to get rid of it and you know IDEA lives forever... Glad it helped you... Love

-Nuh