FIX for Monkey Test & Time Service Virus (Without Flashing)

[Nuh99]

Hello everyone,
This method I'm going to write is tried on my own Lenovo A7600-H Kitkat 4.4.2 tablet, which I did not flash because I'm not sure about stock roms available on the net. If I had found a reliable rom I wouldn't be able learn this

To remove this virus you need to install busybox, Terminal emulator, Root explorer pro and you must have Supersu not superuser which is installed by Kingoroot. If you have rooted your device with kingoroot, so you need to change that.

Here is how to change that:
Google this: how to get ride and replace kinguser with supersu app (Follow first zidroid link)

I'm not able to submit links so im going to write the exact apps with developer names to download from Playstore.

Busybox Installer by JRummy Apps Inc.
Terminal Emulator by Jack Palevich
Root Explorer Pro by Speed Software

Once you have installed everything here is what to do in steps:
[Note: USB DEBUGGING MUST BE ENABLED Turn on Usb Debugging by going to settings> developer options> Usb debugging]

1) Turn off wifi/3G/4G, and then go to settings> apps> all> disable time service and monkey test. (If already frozen via titanium backup or other app) skip this.

2) Open Root explorer go to system/xbin and see if there is any file starting with a dot (eg: .ext.base) also note that every (.) file has diff permission then the rest of other files. So just remember those files with dots because those are the one that you're going to remove in terminal emulator.

3) Go back to system and then go to Priv-app folder and look for these two files
[1] cameraupdate.apk [2] providerCertificate.apk and also notice permission of these two files are different then the rest of Apks so these two are the base of MT TS virus and needs to be deleted.

4) Open Terminal Emulator OR if you have access to your device via adb from a computer.

5) WHAT TO TYPE IN TERMINAL EMULATOR or ADB (CMD Windows)

adb devices (Type this line if you're using adb Windows)
adb shell
su
mount -o remount,rw /system
cd system/priv-app
chattr -iaA providerCertificate.apk
rm providerCertificate.apk
chattr -aA cameraupdate.apk
rm cameraupdate.apk
cd ..
cd system/xbin
chattr -iaA .b
rm .b
chattr -iaA .ext.base
rm .ext.base
chattr -iaA .sys.apk
rm .sys.apk
[NOTE: If you are using older version than KK you need not to type priv-app just type cd system/app]

6) Please make sure you type the file name correctly just as providerCertificate C is capital otherwise permission wont change.

7) Exit Emulator/ADB

8) Go to settings> apps> all> send me the screenshot if you have Monkey test or Time Service there

9) I'm 100% sure if you've followed everything as I mentioned you are good as new and you don't need to flash.

10) I'm not a developer and That's it!

 

[drdkundu]

Money test and time service virus removal

In karbonn A 30
x-bin has these files :
.b
.ext.base
.sys.apk
root/system has no priv-app but app file, it has two files:
SettingProvider.apk
cameraupdate.apk

I have given command cd system/app
followed by
chattr -iaA SettingProvider.apk
....Error...
chattr-iaA not found
WHAT TO DO ?

 

[Nuh99]

In karbonn A 30
x-bin has these files :
.b
.ext.base
.sys.apk
root/system has no priv-app but app file, it has two files:
SettingProvider.apk
cameraupdate.apk

I have given command cd system/app
followed by
chattr -iaA SettingProvider.apk
....Error...
chattr-iaA not found
WHAT TO DO ?

If you don't have a priv-app folder than you are not on Kitkat and you have to delete files from system/app folder.
Well anyway you have to delete cameraupdate.apk and providerCertificate.apk
and you are deleting SettingProvider.apk which I never said you have to.
Please look closely

 

[drdkundu]

If you don't have a priv-app folder than you are not on Kitkat and you have to delete files from system/app folder.
Well anyway you have to delete cameraupdate.apk and providerCertificate.apk
and you are deleting SettingProvider.apk which I never said you have to.
Please look closely

Dearest,
It is 4.0.4 ics , in app folder there is no providerCertificate.apk but SettingProvider.apk which is newer (as per date also AVG prompted it as malware and tried to uninstall but failed) than the original SettingProvider.apk ,i tried to insert screenshots,but prevented by forum thanks if you may share with me your email address i may be able to post
command : chatter... gives error message, is there different procedure for ics ?
Secondly,
I have searched out that karbonn A 30 is a rebranded version of vsun I 1S ,and original rom based on kitkat is available on their site, is it safe to flash vsun rom on it or shall I go for abacada rom available on xda?

 

[Nuh99]

Dearest,
It is 4.0.4 ics , in app folder there is no providerCertificate.apk but SettingProvider.apk which is newer (as per date also AVG prompted it as malware and tried to uninstall but failed) than the original SettingProvider.apk ,i tried to insert screenshots,but prevented by forum thanks if you may share with me your email address i may be able to post
command : chatter... gives error message, is there different procedure for ics ?
Secondly,
I have searched out that karbonn A 30 is a rebranded version of vsun I 1S ,and original rom based on kitkat is available on their site, is it safe to flash vsun rom on it or shall I go for abacada rom available on xda?

Send me screenshot or personally talk to me on www(.)facebook(.)com/99nuh
Btw you are unable to remove providersettings.apk because you might be typing wrong attributes for it.
To see its attribute cd system/app [enter]
then type lsattr to look for attributes of providersettings.apk
and then use those attributes with - and rm that file.

And If you want to flash your phone/tablet go with your brand official rom.

 

[drdkundu]

screenshots

Send me screenshot or personally talk to me on www(.)facebook(.)com/99nuh
Btw you are unable to remove providersettings.apk because you might be typing wrong attributes for it.
To see its attribute cd system/app [enter]
then type lsattr to look for attributes of providersettings.apk
and then use those attributes with - and rm that file.

And If you want to flash your phone/tablet go with your brand official rom.

Screenshots below:
please add http.. before
//photos(dot)google(dot)com/photo/AF1QipNuigMsljp-1jsPLPqo_QuG_27vDUHS-DzSZZi-
//photos(dot)google(dot)com/photo/AF1QipMUmGdmU7TyETRaomzJzzKSuFYOiW7e53urGT6P
//photos(dot)google(dot)com/photo/AF1QipMRD8sJA0j84yHIzYSohk4KDggUTw2iTcGKZ7mU
//photos(dot)google(dot)com/photo/AF1QipNZQ7TTbDGrDNSMKMAtCt5I7P8_1QFQMyVRi6-_

 

[Nuh99]

Screenshots below:
please add http.. before
//photos(dot)google(dot)com/photo/AF1QipNuigMsljp-1jsPLPqo_QuG_27vDUHS-DzSZZi-
//photos(dot)google(dot)com/photo/AF1QipMUmGdmU7TyETRaomzJzzKSuFYOiW7e53urGT6P
//photos(dot)google(dot)com/photo/AF1QipMRD8sJA0j84yHIzYSohk4KDggUTw2iTcGKZ7mU
//photos(dot)google(dot)com/photo/AF1QipNZQ7TTbDGrDNSMKMAtCt5I7P8_1QFQMyVRi6-_

They are not opening. Error!
Kindly send me @ my fb.

 

[agzpur]

Thanks, its work, no more monkey test and Time service on my android.
before: my Malwarebytes detect there are virus cameraupdate.apk;MusicProvider.apk;
LiveWallpaper.apk;SistemCertificate.apk and providerCertificate.apk .so i delete all on system/app. all can delete except cameraupdate.apk

I try your way but i have different case on my ColorOS android 4.2.2
Using App Master(EasyApps Studio) i find that :
monkey test refer to sytem/app/cameraupdate.apk
but time service refer to data/app/com.android.hardware.ext0-1.apk
so i add
cd data/app
chattr -iaA com.android.hardware.ext0-1.apk
rm com.android.hardware.ext0-1.apk
with Root explorer browse root directory and sd card search cameraupdate.apk and com.android.hardware.ext0-1.apk after find check list all then delete.
No need clear cache just delete
/data/dalvik-cache/system@app@cameraupdate.apk@classes.dex
/data/dalvik-cache/data@app@com.android.hardware.ext0-1.apk @classes.dex
This work
Thanks

Note:
if you find ...Error... chattr -iaA not found
WHAT TO DO ? its mean you only install app not yet istall busybox
after install Busybox Installer by JRummy Apps Inc. from play store open app
on tab installer, select busybox ver1.2 select intall location /system/xbin/ then touch Install

 

[Nuh99]

Thanks, its work, no more monkey test and Time service on my android.
before: my Malwarebytes detect there are virus cameraupdate.apk;MusicProvider.apk;
LiveWallpaper.apk;SistemCertificate.apk and providerCertificate.apk .so i delete all on system/app. all can delete except cameraupdate.apk

I try your way but i have different case on my ColorOS android 4.2.2
Using App Master(EasyApps Studio) i find that :
monkey test refer to cameraupdate.apk
but time service refer to com.android.hardware.ext0-1.apk
so i add
cd data/app
chattr -iaA com.android.hardware.ext0-1.apk
rm com.android.hardware.ext0-1.apk
with Root explorer browse root directory and sd card search cameraupdate.apk and com.android.hardware.ext0-1.apk after find check list all then delete.
No need clear cache just delete
/data/dalvik-cache/system@app@cameraupdate.apk@classes.dex
/data/dalvik-cache/data@app@com.android.hardware.ext0-1.apk @classes.dex
This work
Thanks

Yes you don't need cache clear but doing it on a safe side is better.
If this post helped you please give a thumbs up!

 

[dsamivai]

i can't change the permission on root explorer.

Hello everyone,
This method I'm going to write is tried on my own Lenovo A7600-H Kitkat 4.4.2 tablet, which I did not flash because I'm not sure about stock roms available on the net. If I had found a reliable rom I wouldn't be able learn this

To remove this virus you need to install busybox, Terminal emulator, Root explorer pro and you must have Supersu not superuser which is installed by Kingoroot. If you have rooted your device with kingoroot, so you need to change that.

Here is how to change that:
Google this: how to get ride and replace kinguser with supersu app (Follow first zidroid link)

I'm not able to submit links so im going to write the exact apps with developer names to download from Playstore.

Busybox Installer by JRummy Apps Inc.
Terminal Emulator by Jack Palevich
Root Explorer Pro by Speed Software

Once you have installed everything here is what to do in steps:

1) Turn off wifi/3G/4G Open settings> apps> all> disable time service and monkey test. (If already frozen via titanium backup or other app) skip this.

2) Open Root explorer go to system/xbin and see if there is any file starting with a dot (eg: .ext.base) also note that every (.) file has diff permission then the rest of other files. So just remember those files with dots because those are the one that you're going to remove in terminal emulator.

3) Go back to system and then go to Priv-app folder and look for these two files
[1] cameraupdate.apk [2] providerCertificate.apk and also notice permission of these two files are different then the rest of Apks so these two are the base of MT TS virus and needs to be deleted.

4) Open Terminal Emulator OR if you have access to your device via adb from a computer.

5) WHAT TO TYPE IN TERMINAL EMULATOR or ADB (CMD Windows)

adb devices (Type this line if you're using adb Windows)
adb shell
su
cd system/priv-app
chattr -iaA providerCertificate.apk
rm providerCertificate.apk
chattr -aA cameraupdate.apk
rm cameraupdate.apk
cd ..
cd system/xbin
chattr -iaA .b
rm .b
chattr -iaA .ext.base
rm .ext.base
chattr -iaA .sys.apk
rm .sys.apk

6) Please see if your device xbin has more files with dots because these are three files I had so if there are more you need to remove them with the same command I mentioned above (e.g:cd system/xbin [Enter] chattr -iaA .New.file & then rm .New.file and make sure you type the file name correctly just as providerCertificate C is capital otherwise permission wont change.

7) Exit Emulator/ADB shutdown your device go to recovery clear cache and restart.

8) Go to settings> apps> all> send me the screenshot if you have Monkey test or Time Service there

9) I'm 100% sure if you've followed everything as I mentioned you are good as new and you don't need to flash.

10) I'm not a developer and That's it!

i can't change the permission on root explorer. can you help me to fix it..it says failed to change permission because your sdcard..........something..

plz help me

 

[Nuh99]

i can't change the permission on root explorer. can you help me to fix it..it says failed to change permission because your sdcard..........something..

plz help me

You can't change it with Root Explorer you have to change permissions with Terminal Emulator by the entering the commands I've mentioned in my guide.

 

[jdy11]

You can't change it with Root Explorer you have to change permissions with Terminal Emulator by the entering the commands I've mentioned in my guide.

Hi, Im a user of 8.31 O+ phone. Ive downloaded all the 3 apps youve mentioned. But after installing busybox (the app) I cant install any version of it.. thats why everytime I'll type the commands in emulator indicated above, it says error...

please help... thank you

 

[joshuas_79]

Hello everyone,
This method I'm going to write is tried on my own Lenovo A7600-H Kitkat 4.4.2 tablet, which I did not flash because I'm not sure about stock roms available on the net. If I had found a reliable rom I wouldn't be able learn this

To remove this virus you need to install busybox, Terminal emulator, Root explorer pro and you must have Supersu not superuser which is installed by Kingoroot. If you have rooted your device with kingoroot, so you need to change that.

Here is how to change that:
Google this: how to get ride and replace kinguser with supersu app (Follow first zidroid link)

I'm not able to submit links so im going to write the exact apps with developer names to download from Playstore.

Busybox Installer by JRummy Apps Inc.
Terminal Emulator by Jack Palevich
Root Explorer Pro by Speed Software

Once you have installed everything here is what to do in steps:
[Note: USB DEBUGGING MUST BE ENABLED Turn on Usb Debugging by going to settings> developer options> Usb debugging]

1) Turn off wifi/3G/4G, and then go to settings> apps> all> disable time service and monkey test. (If already frozen via titanium backup or other app) skip this.

2) Open Root explorer go to system/xbin and see if there is any file starting with a dot (eg: .ext.base) also note that every (.) file has diff permission then the rest of other files. So just remember those files with dots because those are the one that you're going to remove in terminal emulator.

3) Go back to system and then go to Priv-app folder and look for these two files
[1] cameraupdate.apk [2] providerCertificate.apk and also notice permission of these two files are different then the rest of Apks so these two are the base of MT TS virus and needs to be deleted.

4) Open Terminal Emulator OR if you have access to your device via adb from a computer.

5) WHAT TO TYPE IN TERMINAL EMULATOR or ADB (CMD Windows)

adb devices (Type this line if you're using adb Windows)
adb shell
su
cd system/priv-app
chattr -iaA providerCertificate.apk
rm providerCertificate.apk
chattr -aA cameraupdate.apk
rm cameraupdate.apk
cd ..
cd system/xbin
chattr -iaA .b
rm .b
chattr -iaA .ext.base
rm .ext.base
chattr -iaA .sys.apk
rm .sys.apk
[NOTE: If you are using older version than KK you need not to type priv-app just type cd system/app]

6) Please see if your device xbin has more files with dots because these are three files I had so if there are more you need to remove them with the same command I mentioned above (e.g:cd system/xbin [Enter] chattr -iaA .New.file & then rm .New.file and make sure you type the file name correctly just as providerCertificate C is capital otherwise permission wont change.

7) Exit Emulator/ADB shutdown your device go to recovery clear cache and restart.

8) Go to settings> apps> all> send me the screenshot if you have Monkey test or Time Service there

9) I'm 100% sure if you've followed everything as I mentioned you are good as new and you don't need to flash.

10) I'm not a developer and That's it!

I get also the message : chattr: not found

I tried from adb and terminal

Any idea?

 

[optimumpro]

I'm not a developer and That's it!

Forgive me, but your statement quoted above is the only one that makes sense here. You were booted from Security Discussion thread and you move here.

You confuse people, give nonsensical advice and don't seem to know what you are talking about. First of all the chattr command is not supposed to work on Android ext4, so, no wonder people can't remove files this way. And anyway, your prolong instructions are not worth the "paper" they are written on. Even if someone would succeed following them, there is no guarantee they remove the virus. The proper way is to completely reformat your phone including internal SD and external SD, which you do in recovery by formatting System, Cache, Dalvik cache, Data and both sd cards. Period. And for the future, don't install any third party apps unless you compile them from source by yourself or someone you trust.

 

[Nuh99]

OK

 

[Nuh99]

I get also the message : chattr: not found

I tried from adb and terminal

Any idea?

If you are having this error it means you have installed busybox app not busy box.
To do this open busybox app in your device, select busybox ver1.2, select intall location /system/xbin/ and tap install.
Then try the procedure

 

[joshuas_79]

Forgive me, but your statement quoted above is the only one that makes sense here. You were booted from Security Discussion thread and you move here.

You confuse people, give nonsensical advice and don't seem to know what you are talking about. First of all the chattr command is not supposed to work on Android ext4, so, no wonder people can't remove files this way. And anyway, your prolong instructions are not worth the "paper" they are written on. Even if someone would succeed following them, there is no guarantee they remove the virus. The proper way is to completely reformat your phone including internal SD and external SD, which you do in recovery by formatting System, Cache, Dalvik cache, Data and both sd cards. Period. And for the future, don't install any third party apps unless you compile them from source by yourself or someone you trust.

but my problem is that I can't find firmware for my tablet: engel tb0725ips

 

[optimumpro]

but my problem is that I can't find firmware for my tablet: engel tb0725ips

Get a custom rom. If there is no custom rom, then do a factory reset and then format external and internal sd cards.

 

[drdkundu]

Brother Nuh has helped me solving cameraupdate and time service android malwares without flashing, may the Almighty bless him abundantly I really learnt some new things from him Thumbs Up for Brother Nuh:good:

 

[joshuas_79]

Get a custom rom. If there is no custom rom, then do a factory reset and then format external and internal sd cards.

I can't find a custom recovery either, so only stock recovery with not many options. :crying: