FORUMS

Vortex Beat 8 has adware apps that keep installing themselves

14 posts
Thanks Meter: 2
 
By fragmentalstew, Junior Member on 23rd December 2019, 03:08 AM
Post Reply Email Thread
I have a Vortex Beat 8. It's a cheap Chinese phone and doesn't have its own forum here. I have adware apps that keep installing themselves, and I think that some process built into the rom, from the factory, is causing it. Does anyone have any tips on what I can do to stop this process?

The biggest problem, with the adware, is that I'm using the phone as a security camera using the Alfred app, and once the ad pops up on the phone, the camera shuts off. I can't turn off the wifi, because I need it enabled for Alfred.

I've factory reset the phone, and disabled or uninstalled all the apps I thought looked suspicious, and yet somehow, occasionally, it will reinstall the apps. Every time I clear, uninstall and disable things, I think I've finally got the problem permanently solved, but then out of nowhere the apps are suddenly back. The last time, the phone lasted several weeks before reinstalling the apps. The previous time, it lasted about a day or two.

I believe at least one of the systemapps I disabled somehow reenabled itself, so that may be the culprit. It's called "Wireless Update". There is also a potentially suspicious system app called "Update Service Core", but I can't disable or uninstall that. I've been using "Data usage" to try to see which apps have been active, but it's hard to tell, but it's not clear form the user interface when the activity took place.

Some of the Adware apps are called "Shortcuts" and "Movies-TV". As far as I can tell they're fairly simple apps that use Android System WebView or something similar to display a website, and then popup ads occasionally.

I tried several virus/adware apps and none of them have been able to detect anything.

At some point there was an update from the manufacturer, and afterwards the problem became worse. In hindsight, I should have rejected it. As far as I know, there are no alternative roms, on the internet, for this device.
28th December 2019, 08:48 PM |#2  
OP Junior Member
Thanks Meter: 2
 
More
I factory reset again and this time I disabled:
Adtime
News and rewards
(System)
Duraspeed
Mobile services
wireless update
Internet

Shortly afterward, the adware app/game Red Block installed itself.
I uninstalled Red Block and installed a firewall app called NoRoot Firewall. Through the firewall I gave internet access to Alfred, Google Play, and some other Google related things. Update Service Core was requesting access and I denied it. Here's hoping that denying Update Service Core was enough to stop this madness.
25th March 2020, 09:09 PM |#3  
OP Junior Member
Thanks Meter: 2
 
More
I'm still struggling with this. I followed the directions at https://forums.malwarebytes.com/topi...ons-for-adups/ to uninstall adups for the current user. You can also find more info here:
https://blog.malwarebytes.com/androi...vable-malware/

I used
Code:
adb shell pm list packages -f
to get the full list of packages and uninstalled adups and also a lock screen using:
Code:
adb shell pm uninstall -k --user 0 com.adups.fota
adb shell pm uninstall -k --user 0 com.adups.fota.sysoper
adb shell pm uninstall -k --user 0 io.appservice.lockappblack
However, the lock app uninstalled itself later as well as:
Movies-TV
Red Block
Shortcuts

and a new one called:
CraigsList

I had the firewall disabled at the time thinking that I had finally solved the problem. I don't know if the firewall being enabled could have prevented the reinstallation. Sometimes it crashes, and that might coincide with the apps being reinstalled. Also, the lock app renamed itself to io.appservice.lockappblack6. I also noticed that the built-in browser is called "Liberty-Browser", which makes me wonder if it's related to the lock app which has an apk called "lockAppLiberty.apk".

I noticed an app in my pm list that I didn't noticed last time: package:/system/priv-app/Ignite-Sliide_3.1.025-1405_releaseProduction/Ignite-Sliide_3.1.025-1405_releaseProduction.apk=com.dti.sliide It's not in the normal apps list and it looks sketchy af. I think it's DT Ignite, which is a known bloatware app that installs bloatware/adware without your permission. I've uninstalled DT Ignite, as well as the lock screen using the adb method above. I also uninstalled the other apps via normal means.

Here's hoping it sticks this time.
Post Reply Subscribe to Thread

Guest Quick Reply (no urls or BBcode)
Message:
Previous Thread Next Thread
Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes