• After 15+ years, we've made a big change: Android Forums is now Early Bird Club. Learn more here.

Help Extraordinary Android Virus

charlington

charlington

Well-Known Member
Hi. As I was downloading an Android
game to my Tecno M3 android smart
phone via Google search it got into
my phone as a virus. I have tried
many ways to get rid of it but keep
showing. I have tried various Anti-
Virus like Avast, stubborn Trojan
Killer and others from Google
PlayStore but the virus doesn't go.
Even after factory reset of the phone.
When I deactivate it in the device
administrator under setting and try to
uninstall it manually and via the Anti
Virus I get the message " uninstall
unsuccessful" It's making the phone
very slow. Kindly advise how to get
rid of it.
 
The Avast Antivirus downloaded from Google Play Store Report it this way:

"Pornclub is potentially unwanted program
(Android: Downloader - AP
[PUP])."

in Device Administrator it appears as an App by the name Pornclub.
When I untick it here then try to run the virus or factory reset it still doesn't go away.
Avast antivirus pops up uninstall dialogue box but sadly when I select "uninstall" it bring a message "uninstall unsuccessful"
When I turn the internet on this virus App auto starts downloading other things. The phone is slow even after I disable it.
 
Use a Root browser and go to pornclub.apk in system/app or in system/priv-app, change permissions to rwxrwxrwx let it set a second.. then delete.
Note: I did NOT say "uninstall"..
..Reboot
 
Last edited:
I did as directed but unfortunately, am getting a dialogue box with the title "Error" then the message reads " Changing permissions was not successful. Please note that some file system do not allow permission change." should the virus App be enable by the time I carry out the permission change?
 
Try this:

Press the POWER button to show the shutdown menu, then press-and-hold the Power Off option. If this gives you an option to reboot in Safe Mode do so, then disable Device Administrator access, and try uninstalling from Settings/Apps.
 
I have done what you say in safe mode but the stubborn virus is not going away. it behaves like a system application and when I try to disable it or force stop, it warns me it may misbehave.
 
You get the "may misbehave" warning when you force stop any app, so that's irrelevant and nothing to do with this app in particular. That doesn't stop you doing it.

So, if it's still not going, are you rooted? (You'd need to be to remove the apk using a file explorer). If so have you tried to uninstall it using Titanium Backup?

P. S. Being pedantic, but it's not a virus. It's malware, but it didn't propagate itself (which would make it a virus) but tricked you into installing it.
 
My android phone is NOT ROOTED, however i've right now downloaded the file explorer and Titanium back up (From Google play store) that you've mentioned, but still the malware can't leave the system.
 
No, without root those won't work. I thought you might be rooted as you said you'd tried changing the file permissions, and without root I'd not expect you to be able to see the directory the apk is in. Can you confirm where the file whose permissions you tried to change was?

Equally if you are not rooted it should not be able to install as a system app, in which case factory reset should clear it (but you lose anything that's not backed up). So as long as it's not installed as a system app that is an option, but from other stuff you've posted I'm not 100% certain of that.

So to be clear, even in safe mode you still can't deselect it as a device administrator and uninstall it? And it is still running even in safe mode (force stop was not greyed out)?
 
To answer your question about the location of the file to change permissions, I first downloaded a root browser from Google play store. I opened the root browser went to system > App > temp.apk (which has the malware App). I held it continuously and it gave me options and I did as previously directed in this forum.


Secondly, I personally have never rooted the phone, I don't understand why the malware installed itself as a system App, maybe the malware rooted the phone system, I don't know.



In safe mode under device administrator this malware App is there and it appears unselected (it is not ticked). When I go to "All Apps" via menu>manage App Then select this Malware App, all the buttons that is, Force stop, Disable, clear cache, clear data, clear default and launch are greyed out. There's no uninstall button.


On the side of running App these malware Apps are there, they are 2 identical one shows "1 process and 2" the other shows "1 process and 1service"


Sometimes when I press "enable" button of this malware App it brings the following message:

"Active [Boost] cache
cleaner inaccessibility
to clean your junk files."

When it's running if I press "force stop" this button gets greyed out while the " disable" button changes to enable (not greyed)
 
The malware in my Android phone doesn't behave as you say in the link you've provide, initially I was downloading an apk game from google search. I would really want to get over this malware and never will I ever download outside Google play store.
 
If it has installed as a system app that's very nasty, and explains why you are having trouble uninstalling it without root. Installing as a system app should require root. I can only assume that the app exploited one of the vulnerabilities that "rooting apps" use to root certain devices (those that have the vulnerabilities) to install itself this way.

This means that a factory reset won't clear it.

The obvious solutions are either to root the device, to give yourself the necessary privileges to deal with a malicious system app, or to reflash the OS back to stock (overwriting the ROM which this malware has been inserted into).

I don't have any experience with this phone model, so would have to do some research before I could suggest how to do either. What Android version are you running?
 
Sounds like maybe someone took a page from both stagefright & KR.. How much you wanna bet this is a test (at charlington's expense) for some nasty BS..??
 
Hadron,
I appreciate for the support so far and I would be happy if you could as well suggest how I could root this Android phone model: Tecno M3, running in Android version 4.2.2, Kernel version 3.4.5
I'm not at all familiar with rooting of phones, I wonder if it's something I can do myself over a computer.
 
Hadron said:
The obvious solutions are either to root the device, to give yourself the necessary privileges to deal with a malicious system app, or to reflash the OS back to stock (overwriting the ROM which this malware has been inserted into).
Click to expand...

What Hadron mentioned above^ are the only viable solutions to fix your phone.

A quick google search came up with the same root method (framaroot - well known) from multiple sources for your device. Here's one of the links...

http://itsyouritworld.blogspot.com/2013/09/how-to-root-tecno-m3-easily.html

Good luck


charlington said:
Hadron,
I appreciate for the support so far and I would be happy if you could as well suggest how I could root this Android phone model: Tecno M3, running in Android version 4.2.2, Kernel version 3.4.5
I'm not at all familiar with rooting of phones, I wonder if it's something I can do myself over a computer.
Click to expand...
 
GameTheory,

I did the steps you suggested for rooting the Tecno M3 but when I use the root checker get the following message:

Sorry! Root access is not properly installed on this device.

I keep seeing the error when I repeat the process. How do I get over it?
 
charlington said:
THANK YOU everyone, after rooting my device using iroot then using root browser to change permission, I was able to get rid of the sturbbon malware.
Click to expand...

you can still just delete a system app with root, without changing the permissions I’ve done this many times
 
6th_Hokage said:
you can still just delete a system app with root, without changing the permissions I’ve done this many times
Click to expand...
I recommended changing perms because I've had apps refuse uninstallation due to perms, but erase without problem once the person changed those permissions
 
Hey guys!
I've been having the same problem on my Cubot One. Can anyone please tell me how to remove it? I read all the coments above but im not that good at these kind of things and i need some help.
Thanks in advance
 
Enok said:
Hey guys!
I've been having the same problem on my Cubot One. Can anyone please tell me how to remove it? I read all the coments above but im not that good at these kind of things and i need some help.
Thanks in advance
Click to expand...

which was???? it is not good to just say "same as" some user, we don't go backwards to see what is there, we hit New Posts.
so, what is your problem that needs fixing?
 
AZgl1500 said:
which was???? it is not good to just say "same as" some user, we don't go backwards to see what is there, we hit New Posts.
so, what is your problem that needs fixing?
Click to expand...
Hey. I downloaded an app and accidentally opened an ad there. So i got a viruse called Pornclub. It is installed and i just can't remove it. I tried 360 security and antiviruses but nothing. Also did factory reset but it is still there. Do you know what i can do?
 
You must log in or register to reply here.
Back
Top Bottom