An Old Android Virus is Reinstalling Itself Even After Factory Resets

'A particularly persistent malware infection has been spreading amongst Android phones -- and removing it only seems to bring it back with a vengeance. From a report: The Trojan xHelper, which Malwarebytes first wrote about last year, is reportedly re-spawning on devices where it's already been removed. If virus-removal software doesn't take care of a nasty infection, a hard reset will usually do the trick. But users report that even a full factory reset of an infected device doesn't wipe xHelper out completely. Within an hour the malware is usually back and ready to wreak havoc.' -- source: https://it.slashdot.org/story/20/02/13/1745252 The above news article has a link on how to remove it. Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

On Fri, 14 Feb 2020 17:14:13 +1300, Peter Reutemann wrote:
The above news article has a link on how to remove it.
Which is not very reassuring <https://blog.malwarebytes.com/android/2020/02/new-variant-of-android-trojan-xHelper-reinfects-with-help-from-google-play/>: Here’s the confusing part: Nowhere on the device does it appear that Trojan.Dropper.xHelper.VRW is installed. It is our belief that it installed, ran, and uninstalled again within seconds to evade detection—all by something triggered from Google PLAY. The “how” behind this is still unknown.
participants (2)
-
Lawrence D'Oliveiro
-
Peter Reutemann