[Android Q&A, Help & Troubleshooting] hello76yu:
Hi , I m tracing a suspicious malware in my phone.

I found there are 2 Async Task in System_server process, who connected to malware website.

following is output of ps command, 4418 and 4422 are the task i m tracing.

Is there anyway to findout which App or where is the code in my phone created these 2 tasks ?

adb shell ps -t 807

USER PID PPID VSIZE RSS WCHAN PC NAME

system 807 239 1199572 123172 SyS_epoll_ 00000000 S system_server

system 814 807 1199572 123172 do_sigtime 00000000 S Signal Catcher

system 815 807 1199572 123172 futex_wait 00000000 S ReferenceQueueD

system 816 807 1199572 123172 futex_wait 00000000 S FinalizerDaemon

system 817 807 1199572 123172 futex_wait 00000000 S FinalizerWatchd

system 819 807 1199572 123172 futex_wait 00000000 S HeapTaskDaemon

system 821 807 1199572 123172 futex_wait 00000000 S PlugThread

system 823 807 1199572 123172 binder_thr 00000000 S Binder_1

system 824 807 1199572 123172 binder_thr 00000000 S Binder_2

system 838 807 1199572 123172 futex_wait 00000000 S .ProcessManager

system 840 807 1199572 123172 binder_thr 00000000 S Binder_3

system 841 807 1199572 123172 SyS_epoll_ 00000000 S android.bg

system 842 807 1199572 123172 SyS_epoll_ 00000000 S ActivityManager

system 843 807 1199572 123172 SyS_epoll_ 00000000 S android.ui

system 844 807 1199572 123172 SyS_epoll_ 00000000 S ActivityManager

system 845 807 1199572 123172 SyS_epoll_ 00000000 S android.fg

system 846 807 1199572 123172 inotify_re 00000000 S FileObserver

system 847 807 1199572 123172 SyS_epoll_ 00000000 S android.io

system 848 807 1199572 123172 SyS_epoll_ 00000000 S android.display

system 849 807 1199572 123172 futex_wait 00000000 S CpuTracker

system 850 807 1199572 123172 SyS_epoll_ 00000000 S AnrMonitorThrea

system 851 807 1199572 123172 SyS_epoll_ 00000000 S PowerManagerSer

system 852 807 1199572 123172 pm_get_wak 00000000 S system_server

system 853 807 1199572 123172 hrtimer_na 00000000 S system_server

system 854 807 1199572 123172 futex_wait 00000000 S BatteryStats_wa

system 855 807 1199572 123172 SyS_epoll_ 00000000 S RecoveryManager

system 856 807 1199572 123172 SyS_epoll_ 00000000 S PackageManager

system 864 807 1199572 123172 SyS_epoll_ 00000000 S PackageInstalle

system 865 807 1199572 123172 SyS_epoll_ 00000000 S SensorEventAckR

system 866 807 1199572 123172 poll_sched 00000000 S SensorService

system 867 807 1199572 123172 SyS_epoll_ 00000000 S CameraService_p

system 868 807 1199572 123172 SyS_epoll_ 00000000 S S.HandlerThread

system 869 807 1199572 123172 alarm_wait 00000000 S AlarmManager

system 870 807 1199572 123172 SyS_epoll_ 00000000 S InputDispatcher

system 871 807 1199572 123172 SyS_epoll_ 00000000 S InputReader

system 872 807 1199572 123172 SyS_epoll_ 00000000 S MountService

system 873 807 1199572 123172 unix_strea 00000000 S VoldConnector

system 874 807 1199572 123172 unix_strea 00000000 S CryptdConnector

system 875 807 1199572 123172 unix_strea 00000000 S NetdConnector

system 876 807 1199572 123172 SyS_epoll_ 00000000 S NetworkStats

system 877 807 1199572 123172 SyS_epoll_ 00000000 S NetworkPolicy

system 878 807 1199572 123172 SyS_epoll_ 00000000 S WifiP2pService

system 879 807 1199572 123172 SyS_epoll_ 00000000 S WifiStateMachin

system 880 807 1199572 123172 SyS_epoll_ 00000000 S WifiSMForObserv

system 881 807 1199572 123172 SyS_epoll_ 00000000 S WifiService

system 882 807 1199572 123172 SyS_epoll_ 00000000 S ConnectivitySer

system 883 807 1199572 123172 SyS_epoll_ 00000000 S roid.pacmanager

system 884 807 1199572 123172 SyS_epoll_ 00000000 S NsdService

system 885 807 1199572 123172 unix_strea 00000000 S mDnsConnector

system 886 807 1199572 123172 SyS_epoll_ 00000000 S ranker

system 887 807 1199572 123172 SyS_epoll_ 00000000 S notification-sq

system 888 807 1199572 123172 SyS_epoll_ 00000000 S AudioService

system 889 807 1199572 123172 SyS_epoll_ 00000000 S AudioProfileSer

system 890 807 1199572 123172 poll_sched 00000000 S UEventObserver

system 892 807 1199572 123172 SyS_epoll_ 00000000 S PerfServiceMana

system 897 807 1199572 123172 SyS_epoll_ 00000000 S WifiManager

system 898 807 1199572 123172 SyS_epoll_ 00000000 S WifiWatchdogSta

system 899 807 1199572 123172 SyS_epoll_ 00000000 S WifiScanningSer

system 900 807 1199572 123172 SyS_epoll_ 00000000 S WifiRttService

system 901 807 1199572 123172 SyS_epoll_ 00000000 S backup

system 902 807 1199572 123172 futex_wait 00000000 S PhotonicModulat

system 903 807 1199572 123172 SyS_epoll_ 00000000 S AMPlus

system 904 807 1199572 123172 futex_wait 00000000 S LazyTaskWriterT

system 906 807 1199572 123172 __skb_recv 00000000 S Thread-72

system 1243 807 1199572 123172 poll_sched 00000000 S Thread-73

system 1294 807 1199572 123172 poll_sched 00000000 S WifiMonitor

system 1296 807 1199572 123172 SyS_epoll_ 00000000 S SyncHandler-0

system 1308 807 1199572 123172 SyS_epoll_ 00000000 S WifiScanner

system 1339 807 1199572 123172 futex_wait 00000000 S watchdog

system 1342 807 1199572 123172 futex_wait 00000000 S SoundPool

system 1343 807 1199572 123172 futex_wait 00000000 S SoundPoolThread

system 1345 807 1199572 123172 futex_wait 00000000 S FileSourceProxy

system 1364 807 1199572 123172 SyS_epoll_ 00000000 S [NlpUtils]

system 1367 807 1199572 123172 __skb_recv 00000000 S Thread-82

system 1369 807 1199572 123172 __skb_recv 00000000 S MtkAgpsSocket

system 1375 807 1199572 123172 binder_thr 00000000 S Binder_4

system 1378 807 1199572 123172 SyS_epoll_ 00000000 S MtkAgpsHandler

system 1387 807 1199572 123172 SyS_epoll_ 00000000 S NetworkTimeUpda

system 1393 807 1199572 123172 SyS_epoll_ 00000000 S NetworkTimeUpda

system 1394 807 1199572 123172 SyS_epoll_ 00000000 S GPS NATIVE THRE

system 1447 807 1199572 123172 binder_thr 00000000 S Binder_5

system 1465 807 1199572 123172 binder_thr 00000000 S Binder_6

system 1466 807 1199572 123172 binder_thr 00000000 S Binder_7

system 1467 807 1199572 123172 binder_thr 00000000 S Binder_8

system 1515 807 1199572 123172 SyS_epoll_ 00000000 S AsyncQueryWorke

system 1727 807 1199572 123172 unix_strea 00000000 S UsbDebuggingMan

system 1728 807 1199572 123172 futex_wait 00000000 S AsyncTask #1

system 1954 807 1199572 123172 SyS_epoll_ 00000000 S NetworkMonitorN

system 1957 807 1199572 123172 __skb_recv 00000000 S Thread-110

system 1958 807 1199572 123172 SyS_epoll_ 00000000 S DhcpClient

system 1959 807 1199572 123172 SyS_epoll_ 00000000 S DhcpStateMachin

system 1960 807 1199572 123172 __skb_recv 00000000 S Thread-113

system 1995 807 1199572 123172 futex_wait 00000000 S AsyncTask #2

system 2029 807 1199572 123172 futex_wait 00000000 S Okio Watchdog

system 2060 807 1199572 123172 futex_wait 00000000 S Timer-1

system 2087 807 1199572 123172 _mali_osk_ 00000000 S PowerManagerSer

system 2088 807 1199572 123172 do_sigtime 00000000 S PowerManagerSer

system 2089 807 1199572 123172 futex_wait 00000000 S PowerManagerSer

system 2157 807 1199572 123172 futex_wait 00000000 S AsyncTask #3

system 2178 807 1199572 123172 futex_wait 00000000 S pool-1-thread-1

system 2189 807 1199572 123172 binder_thr 00000000 S Binder_9

system 2409 807 1199572 123172 binder_thr 00000000 S Binder_A

system 2557 807 1199572 123172 binder_thr 00000000 S Binder_B

system 2781 807 1199572 123172 binder_thr 00000000 S Binder_C

system 2919 807 1199572 123172 binder_thr 00000000 S Binder_D

system 2955 807 1199572 123172 binder_thr 00000000 S Binder_E

system 2957 807 1199572 123172 binder_thr 00000000 S Binder_F

system 2958 807 1199572 123172 binder_thr 00000000 S Binder_10

system 4417 807 1199572 123172 futex_wait 00000000 S PlugManager

system 4418 807 1199572 123172 futex_wait 00000000 S AsyncTask #4

system 4422 807 1199572 123172 futex_wait 00000000 S AsyncTask #5

here is some records in log related to 4418

02-28 11:13:03.831 807 4418 D MPlugin : createInstance(): Begin = 130769

02-28 11:13:03.832 807 4418 D MPlugin : create Instance (two parameters) with : com.mediatek.common.telephony.IOnlyOwnerSimSupport

02-28 11:13:03.835 807 4418 D MPlugin : Clazz exists on mapping table : false

02-28 11:13:03.836 807 4418 E MPlugin : Unsupported class: com.mediatek.common.telephony.IOnlyOwnerSimSupport

02-28 11:13:03.836 807 4418 D MPlugin : createInstance(): End = 130774

02-28 11:13:03.842 807 4418 D ConnectivityService: getActiveNetworkInfo networkInfo = [type: WIFI[], state: CONNECTED/CONNECTED, reason: (unspecified), extra: "test", roaming: false, failover: false, isAvailable: true]

Thanks