aggressive adware irremovable apk on android - android

A few days ago I received complaints from several customers who told me that "adware is installed automatically on your device Krono NET K5". I made invesigar and found a few apk on / system / app that had different permissions to the usual "rw-r - r--". I could erase the few simple steps in a shell:
adb shell "su -c 'mount -o rw, remount /'"
adb shell "su -c 'rm /system/app/156.apk'"
adb shell "su -c 'rm /system/app/Launcher0607wxDjbOa.apk'"
adb shell "su -c 'rm /system/app/Sync.apk'"
adb shell "su -c 'rm /system/app/SettingProvider.apk'"
(Note that a suspect name as there is a apk using the system call SettingsProvider.apk with letter s)
So far everything worked properly, however there is a apk which is the main cause of all adware and causing the discharge cone apk other battery savers, system cleaners, among others. This application is:
"/system/app/providerdown.apk" Permits "rwsr-sr-x"
I tried to remove it by the above method, I tried to change the permissions to remove it and it has not worked. I tried to install a recovery to eliminate apk thence Aroma File Manager (CWM, TWRP) MTK but this device does not support any custom recovery for devices MTK.
Any idea? Thanks in advance (sorry for my bad english)

I have same problem. You will have to be rooted for this, but i guess you have root because of that code you wrote, and the fact that app somehow gains root access and installs itself in system. Only thing I did to make things easier is:
Download Avast to your phone.
Download Clean Master to your phone and with Clean master make backup of your avast apk.
Go to your stock recovery. I used an app from google store to boot to recovery but any way is good.
Clean cache and do a factory reset.
Boot the device.
DO NOT CONNECT DEVICE TO ANY NETWORK.
Just skip all the stuff like login to your google account and other settings.
Find your Avast apk in the sd card and install it.
Turn on firewall and block all acces to TimeService-that is the name that apk uses when seen from android system.
Go to android system and disable time service. It is probably version 1.1.6
You will still have malware in your device but it wont make mess anymore.
I would like the permanent solution too.

Related

Apk is disappearing after moving to system parition

I'm trying to install my apk on system partition. I've rooted device and here are the steps I'm following,
adb install -d -r <apk_name>
Now apk gets installed in /data/app/<apk_name>/
Move all contents present from /data/app/<apk_name> to /system/priv-app/<apk_name>
Clear the contents within /data/app/<apk_name> and reboot the device
Post reboot not able to find my apk under adb shell pm list packages | grep <apk_name>
I'm trying to read and write value to secure setting which is asking my app to be in system partition. When I'm trying to move I'm facing this issue. I could not find something suspicious from logs while installing the apk.
Tried all possible solutions listed here (Android 5.0/Lollipop: Force rescan of /system/priv-app) but none didn't help.
Any help to debug this issue would be really helpful.

Adb backup does not work

I need help from you guys, because I don't know what I did wrong with adb backup.
I want to backup my Samsung Galaxy S3 LTE (GT-I9305) without root. I googled it and found Full Android Backup with SDK Manager. I installed all i need for this like Java Development Kit 8 version 66 (JDK 8u66 x64) and Android Studio which contains SDK Manager. Then they sad i should download the Google USB Driver. I downloaded it but nothing happened. I thought it should work now and then I went to C:\Users\MYNAME\AppData\Local\Android\sdk\platform-tools and left-clicked adb whilst holding Shift. Then I clicked "Open command window here". After this I typed in "adb devices" and it said:
List of devices attached
3204cfaaf8611199 device
Then I typed in:
adb backup -apk -shared -all -f C:\Users\NAME\backup.ab
It said
Now unlock your device and confirm the backup operation.
I did this and my Smartphone opened "Full Backup" and then I was able to set a password for the backup. I don`t need a password and I just clicked "Back up my data" Then it went back to my homescreen and said "Starting backup..." as a toast message and immediately after this it said "Backup finished" and created a backup file with 40 bytes. I don't know what I should do now.
Rather than trying to find an old version of adb, it's easier to add quotes to the arguments to adb backup :
adb backup "-apk -shared -all -f C:\Users\NAME\backup.ab"
The line, which correctly invokes adb, needs to look like this at my side:
adb backup "-apk -obb -shared -all -system" -f phone-20180522-120000.adb
This line is for Linux, but should do for Windows and OS-X as well. For Linux (and probably OS-X), you can use a script like following, which automatically assigns a timestamp to the file:
adb backup "-apk -obb -shared -all -system" -f "${PHONE:-phone}-`date +%Y%m%d-%H%M%S`.adb`"
Important After doing a backup, verify your data! At my side, sometimes some corruption of the file shows up (and I doubt it is my computer, as I only observe such errors with adb).
Here is a check instruction I use:
set -o pipefail
for a in *.adb;
do
echo "$a";
dd if="$a" bs=24 skip=1 | zlib-flate -uncompress | tar tf - >/dev/null;
echo "ret=$?";
done
It should show ret=0, but it doen't.
If you see inflate: data: invalid code lengths set your archive is corrupted and - very likely - unusable for restore!
If you see tar: Unexpected EOF in archive your backup probably is usable (all backups end this way, I do not know why).
Even if you see just ret=0 there might be undiscovered errors which still prevent a restore.
There is definitively missing an adb verify command, to verify correctness of a backup!
FYI
I post this update, as all other answers were helpful, but not exact to the last detail. (When used with full quotes, a backup was done, but called backup.ab)
Here is my environment:
OS: Ubuntu 16.04
Phone: Android 7.0
ADB: 1.0.32
The full procedure was (just in case somebody stumbles upon this not knowing what is needed):
Zeroth: Install adb (on Ubuntu: sudo apt-get install android-tools-adb)
First: Enable USB debugging mode on the phone.
Second: Attach phone to USB of the computer with an USB data cable (a charge only cable is not enough)
Note that the Ubuntu Phone Manager might show up and ask you for the phone's PIN. You do not need that, close this if it happens.
Third: run adb devices - you should see something like XXXXXXXXXXXX unauthorized
After some time on your phone a message shows up which asks for USB debugging permission
Allow this once. For security reasons, you should not automatically trust the computer, as the fingerprint can be easily faked.
Note that if something is obstructing a single pixel of this confirmation window (like some accessibility feature button) you cannot tap on the OK. First move the obstructing window.
Forth: Now again run adb devices - you should see something like XXXXXXXXXXXX device
If more than one line shows up, you attached more than one phone to the computer. The easy way is to unplug all those you do not want to backup. (The complex way is to set the environment variable ANDROID_SERIAL=XXXXXXXXXXXX.)
Now run adb backup as shown above. Change the file to your needs.
This brings up a window which asks for backup permission.
Do not close the backup window while the backup is taken. When I tried this, the backup stopped and the resulting archive was broken.
You can give a password to encrypt your backup. I do not have any information on how secure the password is. But it is very likely, that you cannot restore the backup taken in case you ever forget this password.
I have no idea on how to restore such a backup to other phones. I even never tried the restore, so I cannot help here, too.
Notes:
adb help shows all possible options to adb backup
Close all open applications on your phone before the backup. I do not know if this is needed, but it certainly cannot hurt.
Leave the phone alone while the backup runs. I do not know if this is needed, but it certainly cannot hurt.
Do not be impatient. Leave the backup plenty of time. At my side I see a progress of about 100 MB/Minute (YMMV). So the backup takes about half an hour for my phone (2.5 GB).
Apparently adb backup does not completely backup everything!
I had a look into the backup (cd X && dd if=../XXXX.adb bs=24 skip=1 | zlib-flate -uncompress | tar xf -) and did not find all installed applications.
What I was able to find was (note that this list is incomplete):
Internal emulated SD-Card: shared/0
External SD-Card: shared/1
Apps: apps/ - many apps (like Google Authenticator) were missing
Calendar: apps/com.android.providers.calendar/db/calendar.db (probably)
What I was not able to find (note that this list is incomplete):
Alarms. (I was probably not able to detect the right app)
Full external SD-card (there is more on this card than what is shown below share/1. For example the apps, which are moved-to-SD.)
Conclusions:
Sometimes adb backup might create corrupt backups, which can go unnoticed. So either check your backup or do frequent backups and pretend to be lucky enough such that not all backups go corrupt.
With adb backup you get a backup of most of your precious data, like camera images and so on. It might be a bit difficult to unpack it, though.
adb backup is not enough to do a complete backup of your phone.
adb backup is not enough to backup your SD-card such, that if it breaks, you are able to replace it by a new one with the contents restored. This is very sad!
PS: The typo "Forth" is not an accidental one.
PPS: zlib-flate can be found in package qpdf on Ubuntu 18.04
This just worked using Ubuntu 15.10 ("wily") to backup a Galaxy SM-G900V running Android version 6.0.1.
Installed using:
sudo apt-get install android-tools-adb
Then I ran the following from the command line (without 'sudo'):
adb backup -apk -shared -all -f backup.adb
Result:
user#hostname:~/droid$ ls -lah
total 1.2GB
drwxrwxr-x 2 user user 4.0BK Mar 6 18:43 .
drwxr-xr-x 52 user user 4.0KB Mar 6 17:40 ..
-rw-r----- 1 user user 1.2GB Mar 6 18:29 backup.ab
Thank you "NG". I was beginning to think my phone was borked.
Forgot to add: Running adb version: Android Debug Bridge version 1.0.31
Seem not all apps can be backed up. Android apparently allow apps to disable backup :(
https://developer.android.com/guide/topics/manifest/application-element.html (search for allowbackup)
The problem is the adb version of your PC. Using adb version 1.0.31 the backup/restore will be sucessfull.
More info on: https://android.stackexchange.com/questions/83080/adb-backup-creates-0-byte-file-prompts-for-current-backup-password-even-though
and How to downgrade my SDK Version?
If your device has an adb version prior to 1.0.31, then you must use an adb version of 1.0.31 on PC. Versions of adb 1.0.32+ broken the backwards compatibility. Source: Issue 208337
Just incase anyone is still having trouble - In windows, I found putting the quotes around only the directory, for example "C:\Users\NAME\backup.ab" worked.
I found this solution :
adb backup -apk -shared -all -f "<path-where-the-backup-will-be-created>.ab"
And to restore :
adb restore "<path-where-the-backup-is>.ab"

Uninstalling bloatware application using adb

Hello all,
I want to remove applications that were on my phone since the beginning but I don't use them. I have Sony Xperia P and one of the apps I want to get rid of is joyn, which uses about 20% of battery although I don't use it and I also tried disabling all of its parts in settings/applications (with no luck).
I rooted my phone and tried to use adb to uninstall the app but the attempt always fails.
What I did:
C:\adb -s YT9100UAAX shell
shell#android:/ $ su
The first time on the phone, I needed to allow access to super user in SuperSU application and from now on the ABD shell is in the list of elevated applications in SuperSU.
root#android:/ # pm uninstall com.rechild.advancedtaskkiller
Success
Regular application uninstallation works fine, but when I try to uninstall something else I get:
root#android:/ # pm uninstall com.orangelabs.rcs
Failure
root#android:/ # pm uninstall com.vodafone.vodafone360updates
Failure
What am I doing wrong?
Thanks for the help
Based on corsair992's advice I downloaded Titanium Backup and I was able to uninstall everything I wanted (incl. the bloatware). Didn't know this app was so powerful!
Thx a lot corsair992

Android: adbd cannot run as root in production builds

I have an Android-based phone (2.3.6) with unlocked root privileges.
Since i'd like to have access to my phone through my computer, today i've installed QtAdb and Android SDK.
If i open a command prompt and i do
adb shell su
i get
#
And so I am able to copy, remove, push files on my phone (on the phone i get a notification using the app "SuperSU".)
But if i launch QtAdb - under Windows 7 - i get the following error: "adbd cannot run as root in production builds". I miss something? There's something wrong with QtAdb?
The problem is that, even though your phone is rooted, the 'adbd' server on the phone does not use root permissions. You can try to bypass these checks or install a different adbd on your phone or install a custom kernel/distribution that includes a patched adbd.
Or, a much easier solution is to use 'adbd insecure' from chainfire which will patch your adbd on the fly. It's not permanent, so you have to run it before starting up the adb server (or else set it to run every boot). You can get the app from the google play store for a couple bucks:
https://play.google.com/store/apps/details?id=eu.chainfire.adbd&hl=en
Or you can get it for free, the author has posted a free version on xda-developers:
http://forum.xda-developers.com/showthread.php?t=1687590
Install it to your device (copy it to the device and open the apk file with a file manager), run adb insecure on the device, and finally kill the adb server on your computer:
% adb kill-server
And then restart the server and it should already be root.
For those who rooted the Android device with Magisk, you can install adb_root from https://github.com/evdenis/adb_root. Then adb root can run smoothly.
Use adb shell; su;
I still have not found any other solution for android 12 rooted with magisk. adb_root does not work with android 12. adbd insecure does not work for me and throws error could not patch adbd.
if anyone is still having issues, heres how i fixed it
you have to start the shell with the phone and go into the magisk app and in the superuser tab (bottom) you have to enable root access for the shell and it works!
You have to grant the Superuser right to the shell app (com.anroid.shell).
In my case, I use Magisk to root my phone Nexsus 6P (Oreo 8.1). So I can grant Superuser right in the Magisk Manager app, whih is in the left upper option menu.

Unable to uninstall SoundHound application from android

I am having serious problems with the SoundHound application, from my HTC Desire S unit.
I should be able to remove it in the standard way, by entering "Applications > Manage Applications", finding SoundHound and uninstalling it. But alas, I have no options. All buttons are disabled. If the application is launched, I have the option of "Force stop" and "Clear data" available.
In the Android Market I am only able to "Update (manual)" - and if I do so, I then only have the options of "Open" and "Uninstall updates"
Then I figured it would be possible through adb, using the package-name found through adb shell to be com.melodis.midomiMusicIdentifier.freemium - and then do an uninstall on that.
lobner#:~$ ./adb uninstall com.melodis.midomiMusicIdentifier.freemium
Failure
I think the above attempts may fail, because the .apk file is located in the /system/app folder on my device.
And I seem to be unable to mount the folder, which may be due to the unit not being rooted.
lobner#:~$ ./adb shell mount system/app
Usage: mount [-r] [-w] [-o options] [-t type] device directory
And I can not just remove it, it seems
lobner#:~$ ./adb shell rm system/app/SoundHound_Freemium.apk
rm failed for system/app/SoundHound_Freemium.apk, Read-only file system
Does anyone have any ideas, how to (force)remove an app from a non-rooted phone?
I think the above attempts may fail, because the .apk file is located in the /system/app folder on my device.
This means the app is part of your firmware and cannot be removed, short of rooting your phone. Ice Cream Sandwich will support disabling such apps, though not removing them.

Categories

Resources