Anyone seen this before?

[Adam Forster]

I have a nexus 6, latest 5.1.1 firmware. Recently updated from 5.0 after being rooted. I have few apps or data on the phone since it was a fresh install flashed to the phone.

Occasionally I get a pop up asking me to install Instagram and it wants access to my calls and contacts, I already have Instagram so I knew it was malicious. Did some digging with a file explorer and found a folder in the downloads called silence which contained Instagram.apk and twitter.apk . I deleted this and installed avast. Avast picked up nothing but the silence folder returned this time with link.apk which was attempting to install requesting the same permissions. This request is happening every half hour and I can't seem to get a root cause.

Short of resetting to factory I'm stuck?

 

[Golfdriver97]

Welcome to the forums. Have you tried clearing your browser cache? Is unknown sources off in settings?

 

[Adam Forster]

I've just tried a chrome cache delete will let you know if it resolves this, already wiped system cache via bootloader

Posted via the Android Central App

 

[Adam Forster]

Clearing chrom cache did not resolve the issue

Posted via the Android Central App

 

[Adam Forster]

Still not found a solution?

Posted via the Android Central App

 

[Adam Forster]

This reared its head again but this time in the form of a photos.apk

Posted via the Android Central App

 

[Bruce39]

Would suggest using Malwarebytes. If that doesn't work than run Addons Detector (both can be found on Play Store). Addons Detector is kind of confusing, so when open app go to "help". If neither solves problem, Malwarebytes.org has a forum plus other info; they can help if you can't solve the problem yourself.