Picked up a virus that self-installs apps on my phone

Question

I thought that it's not possible for any virus-like app to self-install apps on a mobile phone. But this is happening in the case of my friend. And I have no idea how to help him.

Namely, he has a Huawei G630 mobile phone. He wanted to download an MP3 song using the default Browser (not Chrome, but default one) and got a message like "you need to update the system before being able to listen this song". This was probably a trick to force him to install a virus-like app.

After that, each day at midnight, new apps start to get installed by itself. This is a screenshot of 4 apps installed on his phone.

^{Screenshot (click image for larger variant)}

I searched for Lutu and could not find it on the Play Store.

I also tried to find this 3rd app that does this, but in vain. I uninstalled a few suspicious apps and killed some services, but this did not help.

I also thought that this is a kind of an add-on in the default Browser (like I have it in Chrome), but I could not find add-ons in this app.

Any idea how to solve this issue?

NOTE: His Huawei is rooted so could the app be installed in the root section? This could explain why I cannot delete it as it's presented as a system app.

The app would install itself as system app even if the phone wasn't rooted. You should flash a new ROM. — SarpSTA, Mar 02 '16 at 11:23
You should disable third party apps, and setup the Playstore to require a passcode for each new install. That way the virus should not be able to install new apps — Pit, Mar 02 '16 at 12:21
@SarpSTA Can you share more info about that statement? I have not heard about apps that can install as system apps in a virus way. Thanks — AnDroDroo, Mar 02 '16 at 12:48
@AnDroDroo if you are not sure it is set that way it should not hurt to check ;-) — Pit, Mar 02 '16 at 12:49
@Pit I planned that but I cannot do it now :). My friend is in another town now :). — AnDroDroo, Mar 02 '16 at 12:50
@Pit the fact the apps are not been found at Google Play rules out the Playstore app being part of the game. I rather support SarpSTA's opinion here: the app made itself a system app, by which it got access to the INSTALL_PACKAGES permission and is able to, well, install apps. That's the most plausible explanation. As SarpSTA's recommendation to "flash a new ROM" (or rather "a clean ROM") is the most likely cure, going along with a factory-reset to make sure nothing of the culprit remains. And definitely: "need to update the system to play the song" was a lure. — Izzy, Mar 02 '16 at 13:07
@AnDroDroo This Malware Can Secretly Auto-Install any Android App to Your Phone / Hackers reveal Android malware that is IMPOSSIBLE to remove / find more articles; related: Malicious Android Apps installed remotely on my device — Izzy, Mar 02 '16 at 13:11
if it's rooted, try uninstall suspicious system app via Titanium Backup or Lucky Patcher. And install AdAway then change your launcher. — AMZMA, Mar 02 '16 at 13:49
Izzy and Sarp are right: Your only hope is a clean/new ROM, or grab a list of stock apps online and comb through /system/app and see what should be there, whats been dropped in by your friend/google, and what is dodgy. — Dan Brown, Mar 02 '16 at 16:15
Are they proper apps? Or are they just shortcuts on the homescreen? I had a malicious app that made this kind of shortcuts before. If that's the case, just find it and delete it. — Theturtguy, Jun 18 '16 at 17:30

Picked up a virus that self-installs apps on my phone

0 Answers0