A2000 Quad Core 2101_v89_jbla728 infected

[OldMX]

Got this phone and its preloaded with some spyware gfirewall/gsearch which makes some advertising pop everytime i unlock the phone, avg antivirus detected too some opera service and a fake play store, restored several times the phone but i believe the malware is embedded on firmware because it autoinstalls a couple of days later.

What can I do, please help me solve this issue.

Thanks in advance

[WuddaWaste]

There are two steps to malware removal:

1. Identify the malware
2. Remove the malware

You already have the programs identified via AVG. Now it's just a matter of removal.

I personally use Titanium Backup for that purpose. Other have their preferences as well. In either case, you'll have to be rooted to be able to remove the malware.

@Louis777 did a great write-up on that topic here: [Only registered and activated users can see links Click here to register]

[OldMX]

Thanks, rooted it and used Link2SD to remove the infection, hope it stays clean this time.

[OldMX]

Did not work, gsearch and gfirewall reinstalled themselves this morning and spam is back

[WuddaWaste]

Scan again.
Remove again.
Scan again.
If nothing is found, scan with another app.

There has to be something that's reinstalling these.
Keep vigilant. And keep us posted.
You shall prevail.

[tullixcup]

Hi! Have a look at this:
[Only registered and activated users can see links Click here to register]
I think this will help you.

Best regards

[OldMX]

Thanks apparently I was missing another infected app, hope this time stays clean.

Wonder if there is way to download the firmware, edit it to remove the spyware and reflash the phone with the cleaned / uninfected rom? I ask because i'm sure if i restore the phone the spyware will return right?

[tullixcup]

Thanks apparently I was missing another infected app, hope this time stays clean.

Wonder if there is way to download the firmware, edit it to remove the spyware and reflash the phone with the cleaned / uninfected rom? I ask because i'm sure if i restore the phone the spyware will return right?

If you perform a factory reset it will return because it´s enbedded in the firmware. But I think once it´s cleaned if you create a backup with CMW recovery and you restore it, it will remain clean as the recovery replicates your phone state just as it was backed up. I´m just guessing that...I gotta check it.