Malware Removal

[AC Question]

Hello Folks!

Yesterday, I installed 360 security from google play and ran the scan. It detected a malware called 'Demo stub' and when i gave the fix command, it said that root access is required for this. Now here are my questions:
1, Could it be possible that it was a false detection as in this case?(I have an s4 I bought from T-mobile)
Sophos scan on Android phone shows threat but won'... - SophosTalk community
2, If it a malware, how do i remove this? I would prefer not to gain root access as I will loose my samsung warranty.

Appreciate your help folks

Akhilesh

 

[B. Diddy]

Welcome to Android Central! I don't have a definite answer for you, but the term "Demo Stub" makes it sound like it's a remnant of the original Demo app that was used when the phone was on display. It may be that when the phone is prepared for actual sale, the Demo app is uninstalled, but it still leaves behind a nonfunctioning "stub." It could be similar to what happened to Google Currents. When Google Newsstand came out, there was an update to Currents that stripped it down to a small app that only tells the user to use Newsstand, so it became a kind of stub.

If this is the case, then Norton is likely giving you a false positive.

 

[gojoni]

I received the same notice using 360. Norton does not find the demo stub trojan.

I have used 360 for a while now, and the demo stub trojan popped up yesterday. Interested in following this thread to find out how to deal with it.

 

[LizzyJones13]

I got the same message about the virus and my maleware app can't find it nor lookout or zoner..thinking of just uninstalling 360...anyone else have tjis this issue? Im not willing to root my phone..

 

[duchark]

360 Security reported the same warning on my LG G2 phone yesterday after a scan. I performed a factory reset on my phone and a re-scan using 360 Security initially reported no threats. A little while later it reported the "Demo Stub" trojan was back.

I have done some research and the "Demo Stub" supposedly comes from a company called customermobile.

https://www.trustlook.com/report/1C8C1BA032171861E5C157998082945C/com.customermobile.tmous.preload/

This company creates Demos for Phone retailers and OEMS and has a couple of apps in google Play store.

https://www.trustlook.com/report/1C8C1BA032171861E5C157998082945C/com.customermobile.tmous.preload/

I installed the TMUSDEMO LG Optimus L90 app to see what would happen and Avast Antivirus immediately flagged it as malware.

It appears that warnings may be false positives but I would like to know for certain. I'm hoping someone might be able to offer more information on this thread.

 

[Stephenfold]

Created my account just to join in here. 360 was scanning fine for about a month, then bam, tonight it finds Demo Stub. As I'm rooted, I just had it delete the stub and now we're running fine. Just wanted to share as any information may help!

Edit: I'm also running Sophos, but I don't think it OR 360 are scheduled for auto-scans.

 

[John-Michael Vidaurri]

I have the same thing happen to me. I think is something wrong with 360. The reason i say this is that ive download three different apps to take care of this issue and it doesn't show up on any of them. I call bull.

 

[Huik123]

Yes. I also Have a Samsung galaxy S4 from t mobile.
360 was working like a charm for me also for months until 2 days before it discovered this Demo Stub Trojan and started giving the msg, please give root level access or re-flash your ROM.
I didn't wanted to do either.
So I installed almost all the other Antivirus software just to double check.
I installed Avira, Norton, Mcafee, KasperSky, Comodo, AVG, AVAST, CM Security, Lookout
and none of them was able to find this.
the joke was that comodo found 360 as a malware..
after doing all this I think its not a virus.

but still I am interested in knowing what 360 and other forum members have to say about it

 

[NikitaBananaFanna]

Hi. My husband and I both received this the message of having the "Demo Stub" Malware today after scanning our devices through 360. He seen his first and I went to scan mine and there it was! Neither of us are up to rooting or flashing. I think it's something up with 360 because I have a Samsung GS4 and he has an LG Flex. We run totally different apps... I went as far as to install other Anti Virus/Anti Malware apps and none of them detected any Malware or malicious activity. I uninstalled 360 for now. I plan to give it another try in maybe a month or so to see if the developer has worked out this issue. I'm very surprised to see others having the same problem right around the same time! Makes me think it's definitely a developer issue! If anyone figures something out, please share!

 

[billyrub]

I also noticed it yesterday. I have been running 360 fir about 4 months now as well as Malwarebytes. I have been running Malwarebytes for years on my computers and trust it 110%. I think there may be a problem with 360. I had false reading from 360 a few months back on a factory installed program on my phone and it finally went away after a couple of weeks

 

[djameshedges]

I have started receiving this same message from Kaspersky tablet security running on Galaxy Note 3. Also would rather not root to delete, but now that two different softwares are detecting as theat, am a little more concerned.

 

[heyeveryone]

same thing happened to me this morning,I installed dr web and agv,both said I was fine,went into system apps,disabled a all called demostub still the same warning?

 

[dmr1994]

I had this problem this morning too. Read here that I shouldnt really worry bout it, so I didnt.

8 hours later after not doing anything, 360 security doesnt pick up the trojan demo stubs anymore. Really think it was a false positive guys. Hope im right

 

[ace74106]

I have a galaxy note 3 and started having the same issue with 360 after a few months also. I went into my apps and it shows android demo. Clear the cache and then re-scan with 360 it should show working normal.

 

[ace74106]

Forgive me it shows demo stub in the all apps tab. Clear the cache in demo stub.

 

[heyeveryone]

I just downloaded the stubborn trojan killer app from cm security,and it says I have no viruses? but 360 says I have a trojan,very odd?

 

[gtgillooly]

Note3, same issue. Went to settings, application manager, "all" tab, and found demo stub. Cleared cache, re-ran 360 scan and still get malware demo stub Trojan error. Restarted, and no change. Will continue to watch thread for updates.

 

[pinkbun]

demo stub does exist.. I've gone into "Application manager" and disabled it. I have not rooted my device, so, i have no idea whether or not it can be removed. There seems to be no adverse effect to my device, so I'm also believing it serves no real purpose.

 

[Stephenfold]

As it seems I'm one of the pioneers of giving 360 root and letting it delete Demo Stub (I'm on an s4 by the way) I'd just like to point out I did this on...Whenever my last post in this thread was, and I have yet to see it in another scan, or experience any operational problems with my phone.

 

[Everton Moulton]

What user ace74106 stated was very helpful as I also had the same issue. A few other users also added some helpful info that didn't include rooting device.