OK thanks to a discovery by SenseiSimple it turns out activity by Sprintandroidextension.apk is what is triggering all the false high CIQ scores with Voodoo detector. K0nane any idea why activity there would cause that? Without that file, the score is consistently 70 and there are voicemail problems and inability to update Profile and PRL, even an occasional MMS error.
SprintAndroidExtension is what provides for Profile/PRL updating, among a few other things. It is not, however, what "triggers" high scores. The scores aren't false positives, they just don't mean you're infected - they report what they find, if you scroll down you'll see it all.
The remaining pieces of CIQ, not including those in the kernel, are libiq_client.so, the BootCompletedReceiver class, and items in AndroidManifest.xml of framework-res.apk. AndroidManifest.xml in framework-res.apk cannot be edited without resigning framework-res.apk (and in turn, almost all of the rest of system, which is not at all optimal, as all themes/etc. would have to be specially made for one ROM). The calls there start the process android.iqd as an empty shell for BootCompletedReceiver, which itself is an empty shell. It listens for a "booted" trigger sent by what would appear to be SprintAndroidExtension (but it's not, I've checked many times - that very framework portion may be generating it, as it's just a signal and nothing more), upon which BootCompletedReceiver, before noCIQ, would start the CIQ service. Of course, with noCIQ, all it does is... nothing. The process hangs around, but as noted many times before, it has absolutely no purpose. It's empty.
libiq_client.so is, as I've also noted several times before, statically linked into the system libraries and cannot be removed. Specifically, libopencore_player.so and libstagefright.so are linked to it. This is harmless, as libiq_client.so does absolutely nothing without the framework-side pieces, but a pain if one wants to remove it. These libraries can't easily be swapped in from other phones. Of available SGS devices, none have suitable substitutes: the Fascinate has VZW-forced DRM libraries built into theirs, and the GSM variants are all similar to the I9000, whose updates also don't work very well. Swaps from JVQ, JVS, JVT, and JVZ work - JVT generally the best - but not completely. Shutdown will hang forever as a function in OpenCORE panics. By logs, it appeared it could have been a mismatch in libutils or libc, but it was not (I swapped those, too). It may be possible to swap even more (beyond all OpenCORE and Stagefright) libraries to get things working, but if you ask me, it's not worth it. The change would be purely cosmetic.
Of course, there are the kernel pieces, but we know about those.
