Android malware that is impossible to remove?!

New malware for Android OS has appeared that cannot be removed and the only solution is a new device! Whether? Is there anything worse than having to throw away a phone that costs who knows how much? I did a little research on that situation and I will summarize it here.

So why is this malware so dangerous? According to Lookout Security, this malware root device is installed as a system application. It then places ads from which hackers make money, and in addition, they have full control over the device and data, and then install other infected applications. To make matters worse, malware comes in some popular apps (e.g. Facebook) and is invisible, the user doesn’t even know it’s running because the infected app is running normally.

Wait, how does a Facebook app have malware? Normally, not the original version from the Play Store but a copy that can be found at other unofficial stores. And it's not just a Facebook app but many others, like Google Now, NYTimes, Okta, Snapchat, Twitter, WhatsApp ... etc.

So, first of all, the user must install the application from an unofficial source. It is then installed as the original version and works perfectly. Then the phone starts to rumble…

One reader of this blog, Nikola Todorovic, came across this malware and was willing to share the experience:

In the initial phase, the phone just restarted on its own after a certain period, after a few days, some applications started to appear. The apps that appeared were a flashlight, super Mario, booster, apex launcher, some news, and 5-6 apps that are shortcuts to porn sites. Today there were about 6-7 applications installed, which installed themselves via mobile internet, and then when I took the phone and connected it to wifi an avalanche started, and there were about twenty applications. Also, ads by connect to wifi have started to appear more often, mostly pornographic ads.

After this most would try Factory Reset, however…

First I tried a factory reset, which did not affect the virus at all, 5-to 6 of the same applications reappeared and were not previously installed by the owner to consider them the cause. Immediately after the factory reset, when I turn on the phone, the virus starts working and shows me how is applications crash before I even log in to my Google account, choose the language, and everything else that goes after the reset.

So, it is clear that little can be done. How then to solve the problem? Do you really need to throw away your phone and get a new one?!

The answer is: HAHAHA of course NO!

As soon as I read what this malware does, I had two solutions in mind at the moment: the first solution is to delete all applications with the Root uninstaller. But a much faster and cleaner solution is, of course, a new system! And since the installation of a new system (ROM) on an Android device is not that complicated, the problem was solved in 5 minutes.

And this decision is confirmed by Nikola:

And in the end, I just downloaded the stock firmware, reinstalled the system and everything worked normally!

So you don’t have to throw away the phone, of course. If you do not know how to install a new system, contact someone who knows or service.

For those who want to know a little more…

This malware, Shedun, Shuanet, and ShiftyBug, use publicly available root -rooting methods, such as Memexploit, Framaroot, and ExynosAbuse. Together, they have infected over 20,000 popular applications and are available in many unofficial online stores. It is not yet known for sure what the connection is between them, but the research revealed that 71 to 82 percent of some malicious codes match. Personally, I expect an application to appear that will detect the early stages of this malware and help remove them. Until then, as soon as you read this part of the text I believe you know something more about Android, you can just install a new ROM and the problem is solved.