Attempted multiple solutions for malwares like androidSystem, timeService and monkeyTest, but to no avail

Question

My Micromax A106 is affected by viruses called timeService, monkeyTest, androidSystem and some unknown ones.

These viruses started automatically even though I uninstalls, disabled and stopped them. Because of them, performance of mobile is very poor, not responding properly for my action.

I didn't even install any app. My mobile have only 16 apps.

When I switch off and then switch on the mobile, the apps like Privacy guard, 9 apps, cool browser, easy touch (1), easy touch (2), hot video, and some more unwanted apps are installed automatically.

I'm unable to uninstall them. If I uninstall them, they automatically get installed without my knowledge.

SOLUTIONS TRIED:

1. I tried by installing all the antivirus apps available in Google Play like Norton, Avast, AVG, Kaspersky, Trojan remover and more. Nothing happened.

2. Formatted Internal and External SD cards.

3. Factory reset the device.

4. Enabled the security options to not to install from unknown sources.

I tried most of the solutions available on web. Nothing works for me.

Anyone help me to resolve and relieve me from this issue.

Answer 1

I followed carefully every step and got rid of the issue. It will be very helpful to those having this issue.

All the credits goes to Nuh99 who posted the thread (with solution): FIX for Monkey Test & Time Service Virus. (Without Flashing) on XDA Forum.

Follow the instructions:

1. Install following apps in your mobile from Google Play Store

   1. Busybox Installer by JRummy Apps Inc.
   2. Terminal Emulator by Jack Palevich
   3. Root Explorer Pro by Speed Software

2. If you have root access in your Android mobile, then no problem. Proceed with further steps. Otherwise make your mobile to have root access by following these steps :

   1. Download "Kingo Root" in your system (i.e. laptop/desktop).
   2. Then connect your mobile by enabling "USB Debugging" option (turn on USb Debugging by going to Settings → Developer options → USB debugging).
   3. Then click "ROOT" in Kingo root. That's it.

3. Turn off Wi-Fi/3G/4G, and then go to Settings → Apps → All → disable time service and monkey test. If already frozen via titanium backup or other app, skip this.

4. Open Root explorer, go to system/xbin and see if there is any file starting with a dot (e.g. .ext.base). Also note that every (.) file has different permission then the rest of other files. So just remember those files with dots because those are the one that you're going to remove in Terminal emulator.

5. Go back to system and then go to Priv-app folder and look for these two files cameraupdate.apk and providerCertificate.apk and notice that permission of these two files are different than the rest of APKs, so these two are the base of MonkeyTest and TimeSservice virus and needs to be deleted.

6. In Terminal emulator app in your mobile you have to run the following commands. If you feel difficulty in running those commands, use ADB from your system. If you are having ADB in your system (i.e. laptop/desktop), run adb.exe.

   (I am using Android Studio. So, I run the adb.exe from User/AppData/Local/Android/sdk/platform-tools/adb.exe). Otherwise use it by downloading and installing.

7. Open Terminal Emulator, or if you have access to your device via ADB from a computer.

8. Follow these commands one by one:

   adb devices # Type this line if you're using ADB Windows
   adb shell
   su
   mount -o remount,rw /system
   cd system/priv-app
   chattr -iaA providerCertificate.apk
   rm providerCertificate.apk
   chattr -aA cameraupdate.apk
   rm cameraupdate.apk
   cd ..
   cd system/xbin
   chattr -iaA .b
   rm .b
   chattr -iaA .ext.base
   rm .ext.base
   chattr -iaA .sys.apk
   rm .sys.apk
   

   NOTE:

   1. If you are using an older version than KitKat you need not to type priv-app. Just type cd system/app
   2. If "chattr -aA ...." shows error, try it like this "chattr -iaA ...."

9. Please make sure you type the file name correctly just as providerCertificate, 'C' is capital otherwise permission wont change.

10. If you find any other files similar to monkeytest try to remove everything.

11. Exit Emulator/ADB by giving exit command.

12. Check it in your device if monkey test is present. Answer is "No".