Database Develop

Whats going on? Virus, Trojan, PUA? Please help and find a result

Hello, dear XDA users.
Yesterday morning (08/04/2016) I have tested some applications from the PlayStore.
Now I have the following problem: After some time (usually shortly after unlock) pops up a graph. This can only be removed by clicking and starts (originally) the PlayStore. Meanwhile it tries to launch a browser, which you can then cancel. This one I should install (https://play.google.com/store/apps/details?id=com.quick.clean).
Well I tried to track down the malicious software. But the virus scanner offered can not really help here. Supposedly there is a PUA - a Potentially Unwanted App. (Android Ewind (Adware)
First, the file is: Search Service Version 2:00:51 my Oukitel K6000 be infested per Sophos can not remove and it seems in reality an original app from Oukitel to be..
Trend Micro means, it was up to "Calls Blacklist Pro" which I use without problems for years. Here also comes the Note: PUA - AndroidOS_SMsreg.AXBCB.
Can anyone tell what I've captured me as me?
How do I get rid of the back?
What apps can plant something?
Thank you in advance.
Your Dr-Kimble

Ok this can sound nooby but have you checked under settings>apps (all, running and downloaded section) for some apps that you downloaded on that day. Try uninstalling them if they are present. Many apps ask you to make them device administrator and refuse to uninstall. Check under Settings>security>device administrators for apps that shouldn't be given this much privilege (android device manager, greenify etc. are fine but a live wallpaper or a game is not). Check Settings>accessibility. Under services section, uncheck any suspicious apps (you can disable all of them, then enable them one by one to detect which is causing it).
And for the last, if you have developer settings turned on you can check process stats too.
Broadcasted from Zeta Reticuli

I have found and delete: http://forum.xda-developers.com/showpost.php?p=68056047&postcount=105

"Android Tools" stock app ? I keep getting push notifications...

"Android Tools" stock app ? I keep getting push notifications...
I searched a bunch and couldn't find any info on this...
It has the "android icon".... you can not block notifications
I have the phone for over a year, Marshmallow.
Not rooted, or else I could investigate more about it.
This started about a month or so ago.
First push was for some "Solitare" type game or something.
Now everyday almost 12 hours apart (4am-5am) and then in the afternoon...
OR when I plug the phone in to charge (4am-5am) I get a push notification.
The push is for an app TopBuzz.... ("personalized news just for you..").
If you long press and hold, on the notification... it "changes" and says "Android Tools".
Android Tools Version 3.1.1.311
There is no "block notification" toggle.. only "Enable for important..."
I don't know if something hijacked the "Android Tools" app that displays when you do the long press hold on the push notification of "TopBuzz" app install.
If you do click on the notification... the TopBuzz app installs instantaneously... no download.
I removed it.
In my Google account(s) I have, and had, all and any type of "feed" disabled...
The only "sketchy" thing I have done... is I have on my old Lollipop optimus f3 phone.. a great app for exporting text messages. "Export Messages" by Dan Hintz (on Google Play). I works great.. love it (needed for work)
Now... Google says.. incompatible with all my devices.
I got a copy of it at ApkPure... and put it on my VivoXL.. and it works great.. like on the old phone.
I have been using it for 6months.. so.. I don't think it could be the recent push problem.
I ran Malwarebytes... and nothing shows up bad.
Last night... I installed AppBrain Ad Detector... it caught the push notification for TopBuzz.. didn't stop it..
But it does have a "toggle" to stop notifications from the "Android Tools"... so maybe that will work.
Is this "Android Tools" app a stock app... it looks like it is.
Why, if it is... pushing TopBuzz app notifications.
Thanks group.

of course... after I search for a week or so... and finally post a question...
Android Tools app is com.data.acquisition
while Malwarebytes did not flag it as a PUP...
I found something in this post... where there are people talking about something similar in BLU phones...
https://forums.androidcentral.com/ask-question/767820-how-do-you-get-rid-adware.html
half way down the page.. from a Malwarebytes representative is a snippet about an app..
different name but still under the package = com.data.acquisition
author: mbam_mtbr
"indeed a pre-baked system app on some phones manufactured by BLU. It is not unusual for this to happen from time to time on some of these budget devices. The apps in question fire.apk (package name com.data.acquisition) and ....."
So Android Tools looks like it is the same thing...
I am think maybe I can try
adb shell pm hide com.data.acquisition

and once again.. after weeks of searching... I don't know why I am finally see more info on this....
adb or debloater doesn't work... you get the same permissions error.
What I did do was in go to the app "Android Tools" (it is a systems app)
and I did the "uninstall updates"...
And it is gone.
BUT the package com.data.acquisition is now, or actually was
Android Communication Sync
so now I am see more info on the net on Android Communication Sync
from this thread... some interesting observations... for a fellow with a BLU Vivo 5R
https://www.reddit.com/r/Android/comments/6a705k/blu_vivo_5r_came_preinstalled_with_malware/
"I tapped on the notification and it led me to a APK install screen, asking me to allow unknown sources, and in the background the name of the app trying to be installed was "Android Tools". "
So... since I uninstalled updates for the previous "Android Tools"
it has reverted to Android Communication Sync, with the same package com.data.acquisition ....
We will see what happens.
I don't even remember clicking something trying to install Android Tools.
It would really suck if Android Communication Sync if this is another hijack of our phones like
com.adups.fota and com.adups.fota.sysoper

Well it's back late tonight the push notification for TopBuzz....
This reallllly pisses me off..
I put AppBrain Ad Detector in yesterday... hoping maybe I could block it...
But no success.
as mentioned above I had reverted back to the previous update of the app...
It just renames the app Android Communications Sync.
while the obvious problems of you/me not having control over this intrusion is disturbing...
What now with my information is being hijacked....
This is so wrong on so many levels....
I bought the phone from MicroCenter United States, in the store.
Not online.

System App
Android Communication Sync Systems App -> package -> com.data.acquisition
pushes Ad notifications (unstoppable)
pushed the app TopBuzz (notification on locked screen)
this had been going on for weeks, twice a day.
At one point Android Communication Sync updated itself and renamed itself "Android Tools"
I uninstalled updates "Android Tools" yesterday
Reverted back to name -> Android Communication Sync Systems
push notifications for TopBuzz app continued.
I let the app install, which was instantaneous, no download seemed to occur.
It seems it was already lucking on my phone.
I wanted to see if I would now start to receive other app push notifications.
From my readings, I feared I would eventually have to do a factory reset anyway.
To attempt to fix this problem... is the reason I took a chance on installing TopBuzz app.
Overnight I left the TopBuzz app on my phone.
This morning Malwarebytes informed me
malware Adware.Yemobi.a was on my phone.
I deleted TopBuzz this morning.
Rescanned with Malwarebytes.
Adware.Yemobi.a was still on my phone.
Deleting malware attempt
Notice: "Disable system app......
Android Coummunication Sync is a system app cannot be uninstalled..... "
Click Disable... goes to the app screen... cannot be Force Stop.
Now I have malware Adware.Yemobi.a unremovable.
As part of System app Android Communication Sync
I guess it is time for a factory reset.... but I fear the process will start all over again
with the System app
Android Communication Sync Systems App -> package -> com.data.acquisition

Same problem here
I'm having the same problem on my BLU One Life X. Bad news is I already did the factory reset and it came back. Started with TopBuzz notifications but since then has had others as well. Everything is same as you described. I'm not a developer though and don't really understand all the background stuff. Just looking for a solution. My wife's BLU phone is also having the same problem. If you find a solution please post! Thank you for the information you've shared so far.

I am not a developer either... although done some rooting but not this device.. or yours.
Get the app Malwarebytes.. it is a security scan... it's free. And do a scan.
you will probably have the results as I posted on this thread over at the Malwarebytes forum...
https://forums.malwarebytes.com/top...-android-communication-sync-malware-push-ads/
See my second and further posts... and the response from Malwarebytes
When you install Malwarebytes... you will be at the Dashboard.. click the "Menu" the three lines top left...
Under App Manager...
Click Your Apps
Click (on the top) System Apps
look down and see if you have "Android Tools" installed..
OR... "Android Communication Sync"
Actually... "Android Communication Sync" updates to a renamed "Android Tools"
Both are the same... and from what we have figured out the problem.
Malwarebytes will show them as Adware.Yemobi.a
The above System Apps (actually same app) cannot be deleted.
(read my post(s) and the answer from Malwarebytes in the link I posted above, as as they mentioned and you have learned a factory reset does nothing.)
Malwarebytes.. and probably other virus scanners don't consider these as viruses...
BUT call them PUP's "Potentially Unwanted Programs."
I considered what BLU has done, with this Adware, is a complete violation of just about any consumer laws that are out there between buying a product/manufacture and the consumer.
I installed the TopBuzz app, ran a Malwarebytes scan... but they all point to the apps I mentioned here with the Adware issue (PUP).
I deleted the TopBuzz app shortly after the scan.
Approx... after installing TopBuzz app and deleting.. February 20th...
I had been clean from these Adware notifications until today... when... just by coincidence you posted your response.
Today I got a push Adware Notification for some "Pedometer" app.
I clicked it.... nothing seemed to install.
BUT... on my phone... the TopBuzz app... and mentioned "updated" problem App I mention in this post...
AND NOW.... what appears to have been downloaded some file... which I guess is related to the "Pedometer" app I clicked...
ARE in a folder called Mydownload.
I had discovered the TopBuzz App... and the "updated" problem App... in the Mydownload. folder previously.... and thus deleted them.
The "Pedometer" file didn't look like an App file... but I knew it just showed up today.
Deleted it.
I now this is confusing and sucks big time.
Look in Mydownload folder... and delete anything you haven't downloaded.
and look in your other Download folders... and delete anything you didn't download.
While I don't think this is a solution.. at least that crap won't be there anymore.
Does clicking on these Adware Push Notifications like TopBuzz... Pedometer... make them go away ?
Yes... and NO.... as demonstrated that I got the Push Notification Pedometer App today.
TopBuzz app kept coming and coming twice a day....
TopBuzz stopped after I installed and deleted it... weeks ago.
the Pedometer app (today)... well we will see what happens... I clicked it... didn't see a download... but there in Mydownload folder there was a new file... could have already downloaded.. and maybe the actual Push Notification.
I bought my phone from a reputable computer store, brick and mortar, MicroCenter.
This situation really bothers me... and, as it seems it will continue... probably be contacting my States Attorney General, and the Florida State Attorney General (where BLU is headquartered in the U.S.)
Along with notifying MicroCenter to pull all the BLU phones.
I haven't researched this topic since February 20th.... when shortly after... the problem went away.
I thought it was something that I had done... but obviously you have found the same problem.. which started with the TopBuzz App Push Notifications.
Obviously.. I can't recommend installing the TopBuzz App, and then installing it.
And if that will make the notification go away.
If you do.. make sure you delete it in your Mydownload folder, or in an other Download folder.
And the new "Pedometer" App Push Notification today.. if for me it will come back or what is next.... ???? after I clicked the notification and deleted the file in Mydownload folder.
Definitely install Malwarebytes (free trial Pro Version... even after the trial the basic version is still great).
Malwarebytes has a computer version too which I highly recommend and used for years... free or paid version both great.
You could also try this app AppBrain Ad Detector... although it didn't seem to stop
the System App we/I have been talking about.. "Android Communication Sync" or the update to a renamed "Android Tools"
The AppBrain Ad Detector clearly shows the System App mentioned as the culprit.
https://play.google.com/store/apps/details?id=com.appspot.swisscodemonkeys.detector&hl=en
at least it might show something else you can block
Maybe we can both call the BLU company tech support... and complain...

Reporting BLU
I am having the same issues on a BLU Life One X phone.
My issue with these guys has been going on since last summer. They forced an update on my phone and broke most of the functionality. Widgets are broken, most apps do not run, and the memory is 50-70% taken p by the OS/android/UI crap. I have gone through forums, Google support, and BLU support. BLU offered no help or suggestions at all and instead, gave me a price list for new phones. This happened days after my warranty expired.
Now this adware/spyware is infected my phone since Dec 10, 2017. Maybe earlier because I have factory reset my phone a couple times now. I have tried rooting my device but no software I have found can do it. Kingroot, Kingoroot, dr.fone... all failed. The rooting attempts were in response to this adverts/notifocations.
On top of this, my phone randomly has notifications saying "installing ..." and some app I have never heard of, like this pedometer and topbuzz, but once it completes it disappears. I cant find it in my apps, and it never says "Install finished" like regular apps do when they install/update. This is sketchy ****.
I have reported BLU to the anti-fraud center and also to Amazon, where I bought this phone. They have purposefully, and forcefully degraded the performance of my phone then told me to buy a new phone from them, and they are potentially stealing all my data/private information through their sketchy system apps.

found this app on my mom's phone some time ago. adb command "adb shell pm uninstall -k --user 0 com.data.acquisition" worked for me.

adb command?
Soffff10 I don't know what an adb command is or how to run one. Can you post more directions please?

That does it
soffff10 said:
found this app on my mom's phone some time ago. adb command "adb shell pm uninstall -k --user 0 com.data.acquisition" worked for me.
Click to expand...
Click to collapse
FWIW that command did the trick for me. Thanks!!!!!

soffff10 said:
found this app on my mom's phone some time ago. adb command "adb shell pm uninstall -k --user 0 com.data.acquisition" worked for me.
Click to expand...
Click to collapse
FWIW, that command did the trick for me as well.
This all just started. Mine were "Facebook" ads (an app I DON'T have). I am sure this unique to BLU phones (I have BLU Life One X2). "Android Tools" - yeah right.
Very cool this works, was really starting to piss me off.

soffff10 said:
found this app on my mom's phone some time ago. adb command "adb shell pm uninstall -k --user 0 com.data.acquisition" worked for me.
Click to expand...
Click to collapse
@soffff10 Thanks brother. Yes success !
Interesting that I had not found that before in doing my research... I had tried other adb commands but just didn't have the exact command line for success.
Nor was any information exactly pertaining to your command line suggested over at Malwarbytes... when I had posted a question there.
Thank you for supporting the community with your participation, as it will help others.
Have a great day.

YES!
soffff10 said:
found this app on my mom's phone some time ago. adb command "adb shell pm uninstall -k --user 0 com.data.acquisition" worked for me.
Click to expand...
Click to collapse
Worked for me too!!! Thank you so much!!!:good:

Unintentionally disabled air command and screen off memo, help!

I was disabling some packages and I must've disabled something related to those two functions without realizing, the problem is I have no idea the names, because i was getting them from a package list app, and since they're now uninstalled i have no idea about the name. The air command package appears as install, so It must've been something related, does anyone have any clue? I don't want to factory reset the phone

Can't you just reverse the process to enable the packages that you disabled?
I assume you disabled via ADB?
I recently read that doing this does not actually uninstall the app, it disables and can be re-enabled.

Yes, you're correct, but I have no idea what the names of the packages are, is there an app that can show me disabled packages?

Look under Air Commands
https://forum.xda-developers.com/galaxy-note-9/how-to/note-9-debloat-bash-script-t3907659

Already tried, no luck it must be some package that's related to it, idk

how to uninstall substratum overlays?

So I think at this point the only solution too my problem is to perform a factory data reset, but would like some suggestions before I try that.
I got substratum working, and I tried installing a paid theme, but didn't like it so I uninstalled it. After I got the refund I realized that the modifications caused by the overlays stayed, but they are causing problems. Namely, anything in the phone that requires a yes or no response won't give me that option. I attached a screen shot of the problem. It shows I can't uninstall the overlays through the substratum app. I can't authorize adb on my computer either. Nor can I gain access to the settings menu on my phone, as the other screenshot shows.
Any ideas?

Question Banking app ICICI pockets installation issue

I am having trouble login into icici pockets app, it is detecting some kind of screen recording app which is not enable by me.
rom - Xiaomi EU 26.10.22
I have installed magisk and successfully hidden and rename it, have marked the icici pockets application in config deny list, but still the problem is same.
Modules - Shamiko , Universal Safety Net fix, Magiskhide prop config, Zygisk LSposed
I have tried serval HMA method but still the app says disable screen recording app and exit out.
anyone knows what's the error in the rom or in the settings to fix this issue?
i tried disabling all apps display over all permission, even tried uninstalling screen recording app and removing screen password etc but still the issue is same.

Same happens with some Turkish banking apps. Only workable solution right now is installing this emulator and importing your installed apps.
Virtual Android -Android Clone - Apps on Google Play
Build a 2nd operating system on your phone using Virtual Android!
play.google.com

I think it's because of the rear screen.
Custom ROMs have the rear display disabled, so it might a solution.

Bobfish said:
I think it's because of the rear screen.
Custom ROMs have the rear display disabled, so it might a solution.
Click to expand...
Click to collapse
I have tried turning off rear display and even tried by freezing rear display, but still the same

I've installed that app on my Mi 11 Ultra, got the same message, but tapped below that message and I've chosen, that I installed additional apps due to my work. Then I was able to normally open the app. Of course I didn't test, if I can login as I don't have an account.

The error continues. The same problem exists in Akbank, which is a Turkish bank.

aakashasaj said:
I have tried turning off rear display and even tried by freezing rear display, but still the same
Click to expand...
Click to collapse
I have the same issue. I am on EU ROM. My device is not rooted as well.

gsser said:
Same happens with some Turkish banking apps. Only workable solution right now is installing this emulator and importing your installed apps.
Virtual Android -Android Clone - Apps on Google Play
Build a 2nd operating system on your phone using Virtual Android!
play.google.com
Click to expand...
Click to collapse
I tried using Virtual Android as advised by you. How did you get past the error where it tells you remove the process restrictions from developer debugging permission? I tried everything and still wont work. Not sure if I am updating it correctly.

archer797 said:
I tried using Virtual Android as advised by you. How did you get past the error where it tells you remove the process restrictions from developer debugging permission? I tried everything and still wont work. Not sure if I am updating it correctly.
Click to expand...
Click to collapse
can't say anthing since i sold mine.

Update your ICIC bank app if it is not working then note down the version of ICICI bank app and install a previous version from apkmirror.com

Follow this video and will got solution it's same for every bank