Android Ad apps that keep reinstalling themselves without my permission

[Android Central Question]

Hello,
I bought in December a Android 6.0 HomTom H16 and i have a lot of issues with self installing Ad Apps.
It started when i installed Mobike and Ofo bike to check their apps. Afterwards one app appeared and kept displaying ads without even being in an app. Just popping when i unblocked the phone and afterwards new ones kept appearing.
I done a lot of testing to make them be blocked from reinstalling on my phone. I blocked app perminsions on my phone, Blocked unknown app installation, i made my phone invisible on my google account, i searched for related app files that might be on my phone and cache and deleted everything related to them. I factory reset the phone, they are not on the Google play store so that u can't make a complaint to be blocked or anything, i researched on the internet,but it seams i couldn't find a solution.
Nothing helped and now they keep reinstalling daily. when i unlock my phone they are there again. and they just pop up ads without my permission and sometimes they block my screen because they seem very badly made so i need to restart my phone.
They are infiltrating the phone and they have titles that are hard to differentiate them from system apps.

The apps that appear on my device are : "Zdemo" , "System Input", "Coordinator", "Quotecite".
The conclusion that i came is that they read my IMEI and now they are using it to connect to my phone and reinstall them on its own. I don't understand how that is possible and why does my phone give my IMEI without permision.

Unfortunately my research was inconclusive and couldn't find solutions.
They seem to increase in numbers unfortunately. Started with 1 and now they are 4.

Thank you,
Bogdan Petrea

 

[BogdanIP]

BogdanIP
How badly was android 6 as a OS ? because i think a lot of problems are from it self and not from the phones.

 

[Mooncatt]

If this was a cheap no-name brand device, I wouldn't rule out it being part of the OS itself. Android by default doesn't have ads, but manufactures are able to modify it to suit their wishes. I know Amazon offers phones that have ads built in, similar to your issue, but the trade-off is those phones are sold at a discount from the regular ad free versions. It's also not unheard of for shady manufacturers to have malware on their devices.

One thing to try is look in your app manager, select to show system apps, and look for DT Ignite/Mobile Services Manager. This app allows carriers to install other apps and bloatware onto your phone. Typically they are games and other such obvious apps, but I guess it's possible to also install adware apps as well. If you have this app under either name, it should be disabled. Even if it doesn't fix this specific issue, it's a good idea to disable it anyway.

 

[Mooncatt]

BogdanIP
How badly was android 6 as a OS ? because i think a lot of problems are from it self and not from the phones.

I already somewhat addressed this in my reply, but I wanted to clarify since you commented while I was writing.

OS versions are very device specific. Generally you have to update via a direct download from the carrier or manufacturer, so you can't just install a random updated version. If your device is seeing an update available, then chances are it won't fix your problem. It doesn't delete existing apps. If you deleted the suspect app and it's something the manufacturer or carrier added, then the update is likely to have it as well.

One other thing you can try to narrow this down is to restart the device in Safe Mode. This prevents third party apps from running. If the ads stop, then you'll know it's not a system app and you can try hunting it down to uninstall it. You could also go the nuclear route and factory reset your phone. If it still happens in Safe Mode, then it's most likely something baked in by the manufacturer or carrier, in which case there is little you'll be able to do to stop it.

Btw, welcome to the forums and good luck with it.

 

[Maruda]

Hello everyone,

Do you know any antivirus that would automatcally and without requesting permission eliminate detected malware?

I have the same problem as described by Roman.
What I am constantly getting are "Coordinator", "Quotecite" and "Moostel".
I run a tablet/Android 6.0 as an info kiosk which unfortunately has to update itself every hour or so from the Net, so I keep pumping bugs down, and then the antivirus is yelling.... and so on, and so forth.

I did my research on the subject and was surprised how few references I found.

Now I am working on "detaching" my kiosk from the Net but that's not really a solution. Rather a failure.

For now what would help is an antivirus which would uninstall these bugs without any on-screen notice and/or removal permission request.

I tried a few (Avast, Sophos, Kaspersky, AVG, etc) but they all flash while asking for removing permission.

Hence my question: do you know of any that would do the removal fully automatically?

Thanks!

 

[lucky_mountain]

I have the same problem with an Android 6 phone from RCA. I bought the phone in December of 2017. The information from the "About phone" section:
Android version: 6.0
Android security patch level: August 5, 2017
Baseband version: MOLY.WR8.W1449.MD.WG.MP.V59.P16, 2017/08/06 02:01
Kernel version: 3.18.19 / lizonglin@along-build #2 / Fri Aug 18 10:08:45 CST 2017
Build number: T51_RLTP6066_20170818
Custom build version: T51_RLTP6066_20170818

In my case, the two most common apps that keep installing themselves are "System Input Method" and "zdemo".

The Kaspersky antivirus does not detect these apps as malware (nor does it find any other problems on the phone). I didn't try any other antiviruses.

One important thing that I would like to add to the description of this malware behavior in the original post is that I noticed that these apps install themselves only when the internet is turned on on the phone. So my current workaround is not to keep the phone with the internet access for a long time; I turn the internet on only for a short time when I need something and then turn it back off.

That leads me to suggest that one can somehow monitor the network activity to find what exactly triggers this malware installation. But this is too complicated for me. I am writing this in case anybody with the same issue wants to spend their efforts on this.

I would be willing to report this malware to an antivirus company, if it doesn't require a lot of efforts on my part, if it doesn't reveal my personal data, and if somebody points me in the right direction of how to do it. I mean, I found this discussion, for example:
https://security.stackexchange.com/questions/62212/how-do-i-report-new-malware
But then I am not sure what exactly to send there. I would imagine that it should be the apk files of these malware apps. But from what I read you need a root access to extract the apk files (or other not easy ways). I am sorry, but this is too complicated.

Anyway, I think I am going to buy a new phone in a few months.

Take care.

 

[Mooncatt]

In my case, the two most common apps that keep installing themselves are "System Input Method" and "zdemo".

I couldn't find anything on System Input Method, but I did find this thread suggesting zdemo is possibly tied to a third party launcher (Too soon to confirm, though).

https://forum.xda-developers.com/general/help/nougat-zdemo-app-malware-t3854722

 

[methodman89]

Try Blokada from the playstore. It's worth a try.

 

[Pete101101919]

Had same problem more than likely a worm or Trojan virus they can disguise themselves as anything on your phone it could be in your camera settings or any application s on your device everytime the as pops up on your phone they get a percentage of money from Google for you watching that ad it's like ad sense if you are familiar with that its good for making easy money quick if you can set up a website highly recommend using AdSense

 

[Pete101101919]

Don't watch porn on your device that's why use are all getting viruses and Facebook is the biggest virus on the planet