automatically downloading .APK - while locked

[sheberley]

Hi all,

I've just unlocked my phone and I noticed that in the download area there is a downloaded item called kumye864.apk.

I didn't request anything to be downloaded, I did a google search and found nothing.

I have a password on my phone so I know that no-one is playing around with me.

Does anyone know what this is and any suggestions on how it seeming downloaded itself.
What is a good anti-virus/malware for the phone, incase I have something else on the phone that downloaded it.


I did a virustotal scan on it, and it's come up as the SMSSend Nasty
https://www.virustotal.com/en/file/...277768e97751ab286173c26f/analysis/1367927627/


Model: GT-l9100 - samsung galaxy s II
Android Version 4.0.4 - provider won't allow me to upgrade
base Version l9100XXLQ6
Kernal 3.0.15-l9199XWLPT
Phone not rooted
Nothing in Device administrators
and unknown sources is not ticked

 

[Hadron]

Although you did warn us that it's malware, it might be best not to provide the file here!

Do you know when the download occurred? It might be that a web page you visited downloaded it in the background. If you look at the file creation time you might get a clue as to what downloaded it.

 

[Slug]

Does anyone know what this is and any suggestions on how it seeming downloaded itself.

I've pulled it apart and examined the contents. It's outwardly an app to access "adult" movies via a subscription service (

 

[sheberley]

Thanks Slug,Hadron

I was just trying to remove it when I noticed it was gone. Thank you for your pulling-apart wizardary,

I wasn't using my phone and firefox wasn't open. alas this mystery remains unsolved, and most likely always remain that way.

Thanks again, as I heading off to the Play store

 

[Slug]

Thanks

You're welcome.

I was just trying to remove it when I noticed it was gone.

You should have the "My Files" app installed on your S2. Use it to check the /downloads folder on both internal storage and your external microSD card (if you have one) and double-check it's not still there.

Whatever you do DON'T install it, as the payload appears to be a premium-rate SMS dialler that quickly racks up a hefty bill.

 

[sheberley]

deleted file from phone, history cleared and AVG installed (found nothing *YAY*)

Found that it was firefox going to a dodgy website.

Thanks again for the AVG advice