10

I found a directory on the SD card of my Nexus 5 called .d1o1m0o7b1i1le that definitely wasn't there last week. It contains a directory called dont_remove, which contains a bunch more directories with random names, each containing folders .image, .thumb, and .video, all empty.

screenshot

I haven't installed anything new that I know of, and this directory just feels sketchy, so I'm concerned that it might be a virus, but I haven't been able to find many other references to it on the internet. XDA has nothing, but Google shows two pastebin results 1 2 that look like process dumps. I have been doing some basic development lately, but I would think there would be more references to it if it were part of Android.

I've just downloaded Avast mobile and scanned everything, but it doesn't seem to have turned up anything other than a few settings.

I'm running the Android L developer preview, rooted, so there's definitely more opportunities for compromise on my device than most.

Anyone know what virus I might have, and if so, how I can get rid of it, or if this is just something normal I should ignore?

Andrew T.
  • 15,988
  • 10
  • 74
  • 123
ecapstone
  • 223
  • 1
  • 2
  • 6

2 Answers2

12

The folder is created by (at least 1) apps developed by DoMobile Lab. As a hint, when you remove all numbers from the folder name, it spells /.domobile.

As a proof, after installing AppLock and running it, there will be /domobile and /.d1o1m0o7b1i1le folders on the SD Card root folder.

I don't think it is a virus, and it might be really important for DoMobile apps to work properly.

Andrew T.
  • 15,988
  • 10
  • 74
  • 123
4

It is a folder that is being created by AppLock after its latest release on 13 Oct 2014. I had this folder on my SD card. I deleted that folder and it came back again. Then, when I deleted AppLock, the folder didn't come back.

I installed AppLock from backup and the folder was still not created. But after updating the app, the folder got created again, so I guess they changed the way their apps worked. So, don't delete it. It's important for the app to work properly.

Andrew T.
  • 15,988
  • 10
  • 74
  • 123
Abdul Qadeer
  • 141
  • 1