Self-installing apps

Question

Hello,

Since last night, I have a huge problem with my Lenovo K30 W mobile phone.
It's new, barely 1 month old and purchased from a well-known online retailer: CDiscount.

Since last night, applications are downloading on their own. I reset the phone, but nothing changes; when I connect to wifi, it all starts again, and dozens of ad pages open up, redirecting me to a market page to download apps.

After a second reset, I reconnected to wifi and left the phone as it was for a good 10 minutes without touching it. It downloaded no less than 10 applications:

- SpaceCleaner
- MusicPro
- AliExpress
- ymm
- ssClenaer
- Chengle
- ppp
- stuuc
- Township
- youimm

2 of these apps were even moved via the phone's SD card: AliExpress and Township.

I uninstalled everything and researched online to find out where this problem came from and how to eradicate it.

I read that ESET mobile security was a good app to remove unwanted items, so after installation, I ran a scan with the antivirus, and it found 18 threats.
But when I tried to remove them, ESET launched a message saying it's a system application and cannot be uninstalled.

OK.

In the meantime, I had activated the Security Audit in ESET, everything was fine, but suddenly a message appeared on the screen: Unfortunately, org.rain.ball.update has stopped.

ESET closes, I restart it, and I see that there is an error in the Security Audit. The unknown sources have been checked. And this is not the first time this has happened; in fact, each time I restart the phone, the "unknown sources" box is checked, so I see why all these apps are downloading.

Actually, I just realized something. When I run the antivirus scan with ESET, my phone was not connected to the internet, and when I reconnected to the internet, the aforementioned message "Unfortunately, org.rain.ball.update has stopped" appeared, and immediately after, ESET notified me that an error occurred in the Security Audit, and I saw that the "unknown sources" box was checked.
So I don't know what this "org.rain.ball.update" is, but it is the cause of the change regarding the "unknown sources" selection. It also appears in ESET's unresolved threats from the antivirus scan.

My question is: can someone help me please? Thank you very much.

lauda2007 · Accepted Answer

Hello,I might be too late for some, but not for others:I had the same problem with "org.rain.ball.update has stopped working" and the same apps - MusicPro, AliExpress, ymm, ssCleaner, etc. that install themselves.I managed to install an antivirus "Kaspersky" by disabling the wifi on the smartphone, then reactivating it.I did a quick scan and managed to remove some spyware or malware.Then I ran a full scan, blocking the "threats" during the scan, and today my phone is working very well.However, I have no idea how I got this crap; I had installed 3 apps, including 2 games.Good luck to everyone who bought the K30-W!

CrazyGeekMan · Answer

Hello,

I suggest installing Malwarebytes anti-malware.
Turn off the Wi-Fi after updating the database, then launch a scan.
Try to clean the threats, take a picture of the threats that won't delete.

Have a nice day.

Maxime87000 · Answer

Hello,

Thank you for your help, it’s becoming extremely frustrating.

I downloaded MalwaresBytes on my phone and from Google Play. Update done. It found 15 items, so here are the screenshots I just took:

https://www.noelshack.com/2017-08-1487941031-screenshot-2017-02-24-13-49-48.png
https://www.noelshack.com/2017-08-1487941032-screenshot-2017-02-24-13-50-07.png
https://www.noelshack.com/2017-08-1487941032-screenshot-2017-02-24-13-50-15.png
https://www.noelshack.com/2017-08-1487941025-screenshot-2017-02-24-13-52-47.png

I tried to uninstall them, but it won’t let me. The last image says "unfailed..."

EDIT: I haven’t touched my phone once (except now) after sending my second message and the screenshots, now I go to settings - security and the "Unknown sources" box is checked again.....

Maxime87000 · Answer

No, none of them want to uninstall.

I tried to uninstall them one by one and it always shows the same as the 4th screenshot.
With ESET, it's the same, it detects the threats, but the phone doesn't want to uninstall them.

The downloaders? I didn't download anything after resetting the phone, just ESET and MalwareBytes.

I have absolutely no idea what's on this phone.... At a frequency, I would say it can vary between 10 and 30 minutes, an error message appears on the phone: Unfortunately org.rain.ball.update has stopped.

And right after the "Unknown sources" box is checked, even though I just unchecked it a little while ago. And I'm not connected to Wi-Fi.

Maxime87000 · Answer

Yes, I have reset the phone to its factory settings, but as you say, these malware persist, and I also find this strange. I mean, I was tricked on a PC a few years ago, and after a reformatting, everything was back to normal, but here, I don't understand anything about this phone...

Rooting is fine, but how do I do that? And it seems to me that there are quite a few risks involved in doing this, plus I think the warranty goes away?

It's going to be complicated anyway, because as soon as I connect to Wi-Fi, the error message "Unfortunately, org.rain.ball.update has stopped" appears, so the unknown sources checkbox keeps getting rechecked, and this nonsense downloads a bunch of stuff. I have to reboot the phone.

Regarding ESET and Malwarebytes, when they tell me they can't delete these files because they are part of the system, it's strange because I have several phones and a tablet at home, and when I go to applications - all... I don't see these files - the threats found in the logs.

So have they embedded themselves in the system?

Maxime87000 · Answer

OK I'm going to try to root it, I just downloaded KingoRoot, and my phone is successfully rooted. What should I do next?

Maxime87000 · Answer

OK, it’s done, it’s just to check if the phone is properly rooted, if I understand correctly?

It is indeed rooted.

So from there, can I delete everything with ESET?

I just ran a complete scan with ESET and Malwarebytes, and I still can’t uninstall them…

Maxime87000 · Answer

I am in the Kingoroot tool, and the second tab contains (with a trash bin icon) "user applications" and "system and applications."

However, I see no trace of the files, compared to the screenshots. The famous folder system/priv-app/... I can't find anywhere.

I even tried with ES Explorer, attempting to access the root of the phone, but I see absolutely nothing.

Maxime87000 · Answer

I finally managed to find these elements in ES Explorer, but permission denied, even though I am rooted and root explorer is enabled in ES Explorer.

Maxime87000 · Answer

Due to some bad handling, my phone only starts in system recovery... I've made things worse... I don't even know which logs I did this with, but as I couldn't delete the apk since I don't have admin rights, I modified the "write - read" config...
After a reboot of the phone, I can no longer access it...

I am currently downloading the official ROM for the Lenovo K30 W.
Do you think that by installing it on an SD card and doing a recovery, it would work again?

However, in KingoRoot, I did not have the Root Defence tool. And there was no tab allowing me to do a scan.

BrunodeMarseille · Answer

I have EXACTLY the same problem with the same phone (purchased from Price Minister)... I've tried everything, NOTHING WORKS (so far) - I don't know if the warranty applies for that...

Maxime87000 · Answer

Hello,

I'm following up on this issue, specifying that I contacted the seller, telling him that my phone simply turned back on one morning in system recovery mode.

I sent it back and got a new one. Phew!

However, barely unpacked, I downloaded ESET and Malwarebytes, and strangely, they found some malware already installed.
So, I think this phone isn't really clean. It's a Chinese version of the phone. Just saying...

There was:
system/app/gully....apk
and
system/priv-app/teleyphone.apk
considered as malware by both of these logs.

I then installed KingoRoot and Root App Delete, and I managed to remove those elements, and since then ESET and Malwarebytes haven't found any threats.

I also recommend uninstalling the phone's default browser and the app center (nothing to do with Play Store), it's with those two that I probably picked up this crap...

I want to thank CrazyGeekMan for his help and advice. Thank you!

lauda2007 · Answer

Hello,
I'm back on this forum because my smartphone is acting up again. Everything was fine until I turned on the WiFi, but when I activate the WiFi, I start seeing apps downloading (Aliexpress, Priceminister) on my smartphone. I have the Kaspersky antivirus that tries to warn me that a threat is detected with a name like UDS:DangerousObject.Multi.generic, which I delete, of course.
Everything is fine for 2 or 3 minutes and then I detect another threat...
I’m fed up with these virus-infected smartphones.
Has anyone found a simple and effective solution?
Thank you

Self-installing apps

13 réponses

Samsung j5 unable to answer

Scam of the suvedene highway

File name too long

No sound with ps3 and hdmi

Wake up from sleep mode in windows 10.

Internet connection problem with my ipad

Free box: remote control broken

Suspicious number text message

I receive calls from unallocated numbers.

Minecraft restore the cursor and the bar.