N9000W malware finally found: com.skymobi.lockframe.iphone , /system/app/mopolocker.3xnote3_v3.032_20131127_suntel.apk

After some time, I noticed again new unwanted installations

http://sesionesfrikis.blogspot.com.es/2015/01/kinguser-replacement-by-superuser-by.html

I include here some screenshots
There is an "i" inside a circle notification 

And this informs a new app was installed "BubbleShoot"... not by me
Another app was installed at the same time "GoLink"

 A long press in "BubbleShoot" notification finally shows the app involved ... where is malware

App name is "SamsungNote3Locker", package "com.skymobi.lockframe.iphone"
with /system/app/mopolocker.3xnote3_v3.032_20131127_suntel.apk

I removed this package with Titanium backup, and I finally hope malware is removed.
I also checked no more com.skymobi.* packages are present with "pm list packages"

I found this package appears in some websites:
- AVG antivirus http://www.avgthreatlabs.com/android-app-reports/app/com.skymobi.lockframe.iphone/ 
Where it says "Active malware!
During the last 7 days potentially active malware was detected for this android app. (updated Feb 03, 2015 GMT) "

- In this forum, also with M-HORSE N9000W
"Aplicación maliciosa que instala aplicaciones sin hacer nada"
http://www.movilesdualsim.com/tema/aplicacion-maliciosa-que-instala-aplicaciones-sin-hacer-nada.85963/

- In this forum, where it appears "baidu browser" and "share it", some apps I also saw installed ...
http://forums.androidcentral.com/samsung-galaxy-s2/453282-mobile-internet-has-coo123-popup-anyone-know-how-fix.html

Edit: testing Sophos security, it find ExpandPointWall.apk "Potentially unwanted app. Category: Adware" in /storage/sdcard0/.1/ExpandPointWall.apk

Looking for *skymobi* files, I found:

/storage/sdcard0/Android/data/com.skymobi.pay.newsdk/
/storage/sdcard0/skymarket/com.skymobi.mopoplay.appstore/

kinguser replacement by superuser by Koush.... but N9000W still has malware

I wrote in XDA (I am hunktb user)
http://forum.xda-developers.com/showpost.php?p=58491927&postcount=27
"I finally managed to replace kinguser with superuser (opensource, com.koushikdutta.superuser), so I have a clean system.
The phone is still rooted and new superuser app works fine."

http://forum.xda-developers.com/showpost.php?p=58492531&postcount=17

But after that (4 days ago,  no kinguser installed), I still have some malware:
In notification appears an "i" and it informs some app has been installed, for example
com.skymobi.oversea.gamecenter
com.skymobi.mopoplay.appstore
Another notification was about Whatsapp, already installed (but I think it would have been installed if it wasn't)

Internet Security detects malware in RomasterSu_1.1.4_140611_1000.apk used, but nothing installed.
Where is malware?
-I removed Cooee Kauncher (com.cooee.launcherS4)
-I removed kinguser

 With titanium backup I found two more apps I also removed:
-com-cooee.digitalclock (Digital Clock)
-com.cooee.floatwindow (FlasBarService)


I see an app with chinese name, package com.mediatek.factorymode
¿I should look for init script and review something not listed as package?
or ... maybe, new idea, ... if it installs app it could be a fake /malware Google Play???

Googling it
https://blog.gdatasoftware.com/blog/article/android-smartphone-shipped-with-spyware.html

Looking with titanium, Google Play Store 5.1.1 package is "com.android.vending", and it has some updates applied
If I remove updates, initial version is 4.6.17, and it updates again to 5.1.1, it seems from Google ...

I need more time, more ideas ...

adbcontrol

Interesting tool
Used with my broken screen phone
http://marian.schedenig.name/2014/07/03/remote-control-your-android-phone-through-adb/
Just edited config.properties to put adb path
A little bit slow in screen refresh, but it works

ijoy stone 4GB root and adb with ubuntu

I used chinese version iRoot2_2.0.6_141122_1811_1000_r.apk
and it intalled chinese root (com.mgyun.superuser in /system/app/irootsu.apk), but I installed superuser from koush using fdroid and it replaced it ok

adb shell does not work, despite setting usb debugging in config and tablet says "USB debugging enabled" when plugged

Some tests

adb shell
error: device not found
adb devices
List of devices attached

lsusb
Bus 002 Device 014: ID 2207:0010  

dmesg output when plugged

[ 7911.216166] usb 2-1: new high-speed USB device number 16 using ehci-pci
[ 7911.350384] usb 2-1: New USB device found, idVendor=2207, idProduct=0010
[ 7911.350396] usb 2-1: New USB device strings: Mfr=2, Product=3, SerialNumber=4
[ 7911.350403] usb 2-1: Product: Tablet Stone
[ 7911.350410] usb 2-1: Manufacturer: i-Joy
[ 7911.350415] usb 2-1: SerialNumber: D902013112900035A
[ 7911.352183] usb-storage 2-1:1.0: USB Mass Storage device detected
[ 7911.352403] scsi16 : usb-storage 2-1:1.0
[ 7912.353713] scsi 16:0:0:0: Direct-Access     i-Joy                          PQ: 0 ANSI: 2
[ 7912.354288] scsi 16:0:0:1: Direct-Access     i-Joy                          PQ: 0 ANSI: 2
[ 7912.356480] sd 16:0:0:0: Attached scsi generic sg2 type 0
[ 7912.356918] sd 16:0:0:1: Attached scsi generic sg3 type 0
[ 7912.364920] sd 16:0:0:0: [sdb] Attached SCSI removable disk
[ 7912.365533] sd 16:0:0:1: [sdc] Attached SCSI removable disk

Editing "/etc/udev/rules.d/99-android.rules, adding this and restarting does not solve it

SUBSYSTEM=="usb", ATTRS{idVendor}=="2207", ATTRS{idProduct}=="0010", MODE="0666"

sudo /etc/init.d/udev restart

Nothing new adding 0x2207 in .android/adb_usb.ini

But after all this, I decided to reboot ubuntu ... and then it worked

M-HORSE N9000W

Edit: look here http://sesionesfrikis.blogspot.com.es/2015/02/n9000w-malware-finally-found.html

I received this new phone, and everything seems ok
Rooted with RoomMaster SU v2.0.8
http://www.mgyun.com/romastersu

After that, I made titanium backup from previous phone: Whatsapp, Telegram...
and everything ok

With titanium backup app I removed unwanted apps: Facebook Msn, yahoo, ...
Du Speed Booster, APUS Launcher, PlayApp


I see "Cooee launcher S4" and I am not sure if it is malware

I installed Nova Launcher, and Security Lock Screen, but I want to be sure if I can remove this launcher without side effects: in my previous phone there were some situations where previous launcher was started ...
After several days, I see some apps installed automatically... MALWARE!!!
Some of them (I think some of the removed also, like Du Speed Booster or something similar, about battery http://forums.androidcentral.com/general-help-how/365217-random-apps-keep-installing-themselves.html )
ShareIt: cc.taosha.toolbox.shareit (/data/app/cc.taosha.toolbox.shareit-1.apk)
Baidu Browser: com.baidu.browser.inter (/data/app/com.baidu.browser.inter-1.apk)

Avast detects shareit as a trojan, and Kinguser (com.kingroot.kinguser) as potentially unwanted.

There are two possibilities for me: Cooee Launcher S4" or may be king root
I see /system/app/cooee_note3_20131218.apk
Googling it some people suggest to do a factory reset... but it won't work, as it comes by default...
http://answers.informer.com/variations/663134/how-to-uninstall-cooee-launcher-s4/

http://www.techsupportquestions.com/2411/uninstall-launcher-malware-internal-storage-android-phone

 ¿but wich one? CooeLauncher is a system app, and removal seems to be dangerous (after nova install, I can make a backup with Titanium backup, and there is a /system/app mover app in Fdroid, but by making it user app instead system may not work). In the other hand, kinguser is started initially (it can be seen with SD Maid), and so it could make it.
I am going to remove kingroot, and after that check for some time. Kingroot can be installed again with romastersu if I need it...

One of unwanted apps is in chinese, as Romastersu ...
https://play.google.com/store/apps/details?id=cc.taosha.toolbox.shareit

The others
https://play.google.com/store/apps/details?id=com.baidu.browser.inter


One of the worst things: these unwanted apps are not only installed but also downloaded? at any time, I think that consuming bandwidth and bytes... but I am not able to identify anything in android traffic usage, as apps are small.

Update: after one day without kinguser, no more unwanted apps. I decided to install iRoot (iRoot2_2.0.6_141122_1811_1000_r.apk) which also install kinguser, and with app remover I noticed that

root@android:/storage/sdcard0/mgyun/root/app # ls
co.mc.tools.batterybooster_1_542038_ad65a2f81e50808a9aec27affde98caa.apk
com.beagleboys.nfceveryday_4_522889_337d05b29a5e8a160825133213ede2ba.apk
com.beardcocoon.castcountdown.android_6_522890_9a9577e294a10e628320e77888a9d6bb.apk
com.btakoss.flashlightcompass_2_523078_d6299309474702d11f36cdbb24578a0d.apk
com.salyangoz.automessage_6_471851_6d32d80f002752c9ad71ceb96d14dcfe.apk
So chinese root tool includes apks ... and maybe the apks are not downloaded, but installed when kinguser, which starts automaticaly with phone, decides so.
These apk are asociated with the main menu

I made another test, and installed RomasterSu_2.0.9_141226_1816_1000_r.apk (I deleted 2.0.8 version), and it did not put apks in the same folder.
I installed again iRoot2_2.0.6_141122_1811_1000_r.apk and I noticed the same folder is initially empty, so maybe it downloads it later, and it install them ... I can confirm the apps are installed without any prompt / user confirmation.

I should try to change kinguser by another su utility like superSU, but it seems not to be trivial: downloading from google play it does not install properly, it says su binary has to be udpated and it is unable to update it, so superSU finally does not work.

Aswering calls from upper half screen operative...

I have ordered a new phone, but in the meanwhile, I need to answer calls

https://play.google.com/store/apps/details?id=com.sch.answergesturefree

... reducing thresold (negative) value, and drawing just a horizontal line in the upper part of the screen, I can answer calls.

To end calls, I have configured power button in android

Recovering files from android with broken and unresponsive screen

Mi "new phone" (August) is broken: my daughter was playing with it and it felt to the floor, and screen is broken.
It charges, usb works, buttons are working, but I am unable to even unlock screen, so I am unable un activate it as usb storage.

I have adb access, so I need to recover just files from internal memory; contacts and calendar are in gmail, so the info to extract are just some photos. 


Instead of using adb pull / adb push for each file, ... searching I found this

http://qtadb.wordpress.com/download/


After that, I discovered that:
Unlock movements:

input swipe 100 700 600 300

Entering PIN:
input tap 300 500 is "5"
input tap 300 600 is "0"
input tap 100 500 is "4"
input tap 400 600 is "enter"

input keyevent 4 is "return"
input keyevent 82 is "menu"
http://developer.android.com/reference/android/view/KeyEvent.html


With that I have been able to remove screen lock configuration...