Question I was tricked by recharge.tools website. It downloaded many files to my phone (see pic). How to remove this malware?

[AndroidNewbie2023]

What does all of these mean? Some commands such as "create dir /boot/alternate/" look suspicious. I don't know if it install something to the phone. How do I trace and remove/uninstall all of these? The phone is Samsung Galaxy S20 FE 5G. Please help. Thank you.

 

[B. Diddy]

Welcome to Android Central! What app are you using to view that?

Do you recall what you did to accidentally download those files? Did you tap a link in a popup? In general, malware needs to request your permission to install, so if all that happened was a download, you're probably still safe.

 

[belodion]

I searched and got this. There were no details or information about the site or the tool. At this point, I would have proceeded no further, but in your case you did. Does your screenshot show the result of pressing “Proceed”?

 

[mustang7757]

If you clicked proceed in your screenshot it will ask you to install these apps to finally inject which at this point hasn't downloaded anything so don't go any further

 

[B. Diddy]

Egad, "injected on your TikTok app" sounds incredibly dangerous in all respects.

 

[mustang7757]

Egad, "injected on your TikTok app" sounds incredibly dangerous in all respects.

Wonder if this is any violation for tik Tok?

 

[B. Diddy]

Wonder if this is any violation for tik Tok?

It's pretty clearly a scam that lures the user into thinking they'll be able to get free TikTok coins (which normally cost money): https://www.boosthill.com/what-you-...etworks and,gift your favorite TikTok creator.

If it sounds too good to be true, then it's too good to be true.

 

[fuzzylumpkin]

It's pretty clearly a scam that lures the user into thinking they'll be able to get free TikTok coins (which normally cost money): https://www.boosthill.com/what-you-...etworks and,gift your favorite TikTok creator.

If it sounds too good to be true, then it's too good to be true.

TIL there are TikTok coins lol.

 

[AndroidNewbie2023]

Welcome to Android Central! What app are you using to view that?

Do you recall what you did to accidentally download those files? Did you tap a link in a popup? In general, malware needs to request your permission to install, so if all that happened was a download, you're probably still safe.

Thanks for your reply. I went to the website rechage.tools in Opera browser. I must have clicked something to start the download. However I never clicked on allowing anything to be installed. So I should be safe, right? What a relieve

 

[AndroidNewbie2023]

I searched and got this. There were no details or information about the site or the tool. At this point, I would have proceeded no further, but in your case you did. Does your screenshot show the result of pressing “Proceed”?

View attachment 357477

Thanks for your reply. Yes I was stupid enough to click that Proceed button. A bunch of files got downloaded after that The next screen after downloading was asking me to install a program. That was when I paused. However I wasn't sure how much damaged I've done already. I searched for recently installed app but found none.

 

[AndroidNewbie2023]

If you clicked proceed in your screenshot it will ask you to install these apps to finally inject which at this point hasn't downloaded anything so don't go any further

Thanks for your reply. Yes, I stopped right here because I didn't want to install anything that I didn't know. However the long list of files that got downloaded to my phone concerned me... So if I didn't installed any of these, the phone should be safe, right?

 

[AndroidNewbie2023]

Egad, "injected on your TikTok app" sounds incredibly dangerous in all respects.

I don't know. Perhaps I was too comfortable with blockchain coins. It's common to get free coins from faucets from different network to be injected into the wallet. It's just NOT common to have to install anything. What's why I paused.

 

[AndroidNewbie2023]

It's pretty clearly a scam that lures the user into thinking they'll be able to get free TikTok coins (which normally cost money): https://www.boosthill.com/what-you-need-to-know-about-tiktok-recharge/#:~:text=Like other social networks and,gift your favorite TikTok creator.

If it sounds too good to be true, then it's too good to be true.

Exactly. It was a scam.

 

[mustang7757]

Thanks for your reply. Yes, I stopped right here because I didn't want to install anything that I didn't know. However the long list of files that got downloaded to my phone concerned me... So if I didn't installed any of these, the phone should be safe, right?

No nothing was downloaded, your welcome!

 

[AndroidNewbie2023]

No nothing was downloaded, your welcome!

Oh, so the list of files being downloaded was just a fake display? That's good. Thanks Just curious, how did you know?

 

[mustang7757]

Oh, so the list of files being downloaded was just a fake display? That's good. Thanks Just curious, how did you know?

I downloaded as far as you got nothing loaded

 

[AndroidNewbie2023]

I downloaded as far as you got nothing loaded

What did you download? Thanks.

 

[mustang7757]

What did you download? Thanks.

Sorry not download went to the site recharge tool

 

[B. Diddy]

Oh, so the list of files being downloaded was just a fake display? That's good. Thanks Just curious, how did you know?

Open your file manager app and look in the /Download directory. If you see any of those files there, simply delete them. It's good that you didn't tap any Install option -- as mentioned before, simply downloading files won't cause damage. The malicious package has to be installed, and that requires the user's permission.