i may have downloaded a malicious software on android I may have downloaded a malicious software on android. Completing the CAPTCHA proves you are a human and gives you temporary access to the web property. What can I do to prevent this in the future? If you are on a personal connection, like at home, you can run an anti-virus scan on your device to make sure it is not infected with malware. If you are at an office or shared network, you can ask the network administrator to run a scan across the network looking for misconfigured or infected devices. Another way to prevent getting this page in the future is to use Privacy Pass. You may need to download version 2.0 now from the Chrome Web Store. Cloudflare Ray ID: 67db3db51e7fcb0c • Your IP : 188.246.226.140 • Performance & security by Cloudflare. Google bans 9 popular Android apps! It's vital you now delete them from your phone. We use your sign-up to provide content in ways you've consented to and to improve our understanding of you. This may include adverts from us and 3rd parties based on our understanding. You can unsubscribe at any time. More info. Android users need to be on high-alert as Google has removed nine hugely popular apps from its Play Store – but they could still be hiding in plain sight on your smartphone. This latest batch of applications were found trying to gain access to Facebook user names and passwords via hidden malicious code. Related articles. Hackers love getting their hands on these social media credentials as a vast amount of people often use the same email address and password for multiple accounts, leaving them open to large scale attacks. This latest threat was clever as, once the fully functional apps were installed from the Play Store, unsuspecting users were offered the chance to stop annoying adverts from popping up by simply logging into their Facebook accounts. If users agreed and clicked the log in button, they saw the standard social network login form. However, some nasty software hidden in the background was then able to steal the credentials as they were being entered. How the apps looked on the Play Store (Image: DR WEB) Users were duped by a Facebook sign in page (Image: DR WEB) READ MORE. The issue was spotted by the team from Dr. Web who say the malware was spread as "harmless" software and installed more than 5,856,010 times. Upon Doctor Web’s specialists report to Google, part of these malicious applications were removed by the US firm. Sadly, that doesn't mean anyone who downloaded them are now safe as these will stay on devices until they are manually deleted. Here is a full list of the applications users need to remove without delay. • PIP Photo - Over 5.8 million downloads. • Processing Photo - Over than 500,000 downloads. • Rubbish Cleaner - Over 100,000 downloads. • Inwell Fitness - Over 100,000 downloads. • Horoscope Daily - Over 100,000 downloads. • App Lock Keep - Over 50,000 downloads. • Lockit Master - Over 5,000 downloads. • Horoscope Pi - Over 1,000 downloads. • App Lock Manager - Over 10 downloads. Nearby Share: Android explain how users can use new feature. Trending. In post on its blog page, Dr. Web said: "We recommend Android device owners install applications only from known and trusted developers, as well as to pay attention to other user reviews. The reviews cannot provide an absolute guarantee that the apps are harmless but can still alarm you about potential threats. "You should also pay attention to when and which apps ask you to login into your account. If you are not sure that what you are doing is safe, it would be better for you not to proceed any further and uninstall the suspicious program." If you think you may have downloaded any of the apps mentioned in this latest report then you should change your Facebook password and any accounts that use the same login without delay. How to a remove a virus from Android? Android viruses and malware are rare, but they do happen. So, if you’re concerned that your phone may have a virus, then read on because we’ll be explaining how to remove a virus from an Android phone in detail and how you can protect yourself from future attacks. This article will look at: How to install Kaspersky Antivirus for Android and use it to remove an Android virus How to remove malicious apps manually from Android The differences between Android viruses and malware How to tell if your phone has a virus How malware damages your phone if you do not remove it. How to remove an Android virus. Download and install Kaspersky Internet Security for Android Open the app and tap ‘continue’ to allow access to system features. Tap ‘allow’ twice so that the app can make and manage phone calls and access necessary files on your phone. Tap ‘continue’ to allow access to phone and storage so the app can scan your device for threats. Select your location and tap ‘next’. Tap ‘accept and continue’ to accept the end user license agreement and Kaspersky security network statement. Tap ‘have an account’, ‘set up an account’ or you can skip this step for now. Tap ‘buy now’, that you ‘have an activation code’ or ‘use free version’. The app is now ready to scan your phone. Tap ‘run the scan’. If a virus is found, tap ‘remove’. Your phone is now virus free. How to remove a malicious app from Android. Is your phone playing up? It may be because you have downloaded a malicious app. You can quickly identify and remove any malicious apps with Kaspersky Internet Security for Android. There is a manual method, but this can be tricky and time consuming to do if you don’t know how to do it correctly. If you want to try, here’s how to remove a malicious app from your Android phone manually: Put your phone into ‘safe mode’. This stops all third-party apps from running. If your phone stops behaving strangely in safe mode, you can assume the problem was due to a malicious or malfunctioning app. Look for malicious apps . Choose ‘manage apps’ in settings and look at the apps you have downloaded. If any seem suspicious or you do not recall downloading them, these could be malicious. Uninstall suspected malicious apps . Simply select the app you suspect may be malicious and tap ‘uninstall’. If the button is greyed out, revoke device admin access in ‘device admins’ within ‘security’. Then you can uninstall. Can Android phones get malware and viruses? People commonly use the terms ‘malware’ and ‘virus’ interchangeably, but viruses are actually a subset of malware. When a computer is infected with a virus, the virus replicates itself within that PC. This basically means that it copies itself and spreads throughout the computer system, causing harm, destroying data, and potentially corrupting the PC itself. When it comes to Android devices, we have not seen malware which replicates itself on smartphones as we’ve seen on computers. However, Android malware does exist, and it comes in many different forms. For example, spyware and mobile ransomware are two major types of malware. What’s the difference? Well, spyware steals your personal data from third parties. Whereas, mobile ransomware blocks your devices or encrypts the data, demanding a ransom to decrypt them. To easily protect yourself and your devices Kaspersky Internet Security for Android can protect your phone from all sorts of Android malware. Plus, it also detects and removes malware if your phone is already infected. How do Android phones get viruses? So how does Android malware infect your phone? Here are the three mains ways malware can make it onto your mobile: Malicious applications Downloading a malicious application is a common way to get malware. Hackers disguise malware as popular or new apps and spread them through app stores Malvertising This is when malware is spread through dodgy online ads. Clicking on them can infect your phone. Infected links Hackers often send out emails or SMS messages with links to infected web pages. Clicking on them can start a malware download. Does your Android phone have a virus? There are a number of signs that may indicate your Android phone has been infected by malware. Let’s explore each red flag individually: You have apps you do not recognize. Spotted an app on your phone you have no memory of installing? The appearance of unfamiliar apps may be a sign of malware. Uninstall any app you do not recognize. Apps keep crashing. If apps on your phone crash often and for no clear reason, your phone may have been attacked by malware. Data usage has gone up. Noticed a strange increase in your data usage? If you are not using your phone any differently, this may be caused by malware. Phone bill has gone up. Some bits of malware may rack up bills by sending messages. An unexpectedly large bill may be a sign of malware. Pop-ups when your browser is closed. Pop-ups and ads are a pain at the best of times. If you are seeing pop-ups when your browser is closed, your phone may be infected. Battery is draining quickly. Malware can drain your battery. A phone that keeps dying on you may indicate malware. Phone is overheating. Is your phone overheating? Malware activity may also make your phone heat up more than usual. How to avoid Android malware. Now you understand how to spot and remove malware from your Android phone, but how can you prevent your phone from being infected with malware in the first place? Here are some key ways to keep your phone virus free: Use anti-virus protection for Android. Protect your phone with our Android Internet Security software. There is a free, basic version which offers protection or a premium version with more advanced security features for the ultimate and more secure protection. Only download apps from the Google Play Store. Downloading apps from a trusted source means you are less likely to download malware than if you use untrusted sites. Check developer in descriptions. Although rare, malware infected apps may slip through the net on Google Play Store. For this reason, always read about the developer in the description. Read app user reviews. Always read app reviews from other users. Be suspicious of rave reviews as they may not be real. Real reviews tend to highlight both pros and cons. Check out the number of app downloads. Apps with millions of downloads are less likely to be malware. Check permissions requested by the app. Do the permissions the app is requesting seem reasonable for the function of the app? If what is being suspected sounds suspicious, do not download the app, or remove it if you’ve already installed it. Do not click on unverified links. Make sure you mark all spam emails and messages as junk and do not open them. If you accidentally open a spam email, do not click on the links inside. Keep operating system updated. Updating your operating system regularly means your phone is protected by Android’s latest security updates. Keep apps updated. Updating all your apps regularly will help to patch security updates found in the app and android itself. Be mindful of using free Wi-Fi. Avoid online shopping and banking within public networks. If you must use free Wi-Fi use a VPN connection like Kaspersky VPN Secure Connection . This protects your connection by encrypting your data. How malware affects your phone. Malware can wreak havoc with your mobile. It can make apps crash and cause your phone to overheat. And, perhaps more alarmingly, Android viruses can cost you money and personal data. Left unchecked, malware can subscribe phones to scam premium services, sending them messages and racking up huge bills. Malware can also collect personal data such as banking information and use this to steal your money. It can even send hackers recordings of your private phone calls for the purposes of blackmail. For these reasons, taking steps to protect your phone against malware is crucial. Follow our phone safety tips to avoid Android malware and download our Internet Security for Android to know you are protected. Worried your Android phone has a virus? Remove malware today with Kaspersky Antivirus for Android . How to a remove a virus from Android? What is the best way to remove a virus from your Android phone? Discover all there is to know about virus removal for Android. How to remove FluBot from an infected device. FluBot is the name of malicious software that targets Android smartphones. Cybercriminals distribute FluBot via SMS messages, which they send (in at least in three different languages such as German, Polish, and Hungarian) with links to download websites for a fake FedEx application. These websites download a malicious APK file (Android Package file) designed to install FluBot banking malware. As mentioned, cybercriminals distribute FluBot via SMS messages. They send messages (in different languages) containing a fake shipment tracking website designed to download an APK file, which has similar appearance to the installer for the FedEx application. During installation, the fake FedEx application (FluBot malicious application) asks for various permissions. For example, to read contacts, write, read and send SMS messages, read the phone state, keep the device awake, create notifications and post them using startForeground feature, initiate phone calls without going through the Dialer user interface, delete packages, allow querying of any normal app installed on the device, and allow applications to open network sockets. FluBot can receive commands via a Command and Control (C&C) server, including commands to uninstall applications, block the card, upload SMS messages, open URLs (website addresses), extract contact lists, disable Google Play Protect, and various other commands. FluBot is banking malware targeting users in different countries. One way that the malware employs to steal sensitive data is to display windows asking to provide credit card details. In this way, cybercriminals use FluBot to trick victims into providing sensitive information that could be used to steal identities, make fraudulent purchases and transactions, etc. They might also use it to extract other personal details such as, for example, login credentials (usernames, email addresses, passwords). Threat Summary: Name FluBot virus Threat Type Android malware, malicious application, unwanted application. Detection Names (fedex.apk) Avast-Mobile (Android:Evo-gen [Trj]), BitDefenderFalx (Android.Trojan.Banker.TW), ESET-NOD32 (A Variant Of Android/TrojanDropper.Agent.HKE), Kaspersky (HEUR:Backdoor.AndroidOS.Polph.c), Full List (VirusTotal). Related Domains cssincronbucuresti[.]ro, windjey[.]com, gispert[.]pt Detection Names (cssincronbucuresti[.]ro) Fortinet (Phishing), PREBYTES (Malware), Full List (VirusTotal). Detection Names (windjey[.]com) Dr.Web (Malicious), Fortinet (Malware), PREBYTES (Malware), Full List (VirusTotal). Symptoms The device is running slow, system settings are modified without users' permission, dubious applications appear, data and battery usage is increased significantly, browsers redirect to bogus websites, intrusive advertisements are delivered, monetary loss, problems with online privacy, stolen personal accounts. Distribution methods Social engineering, SMS messages, fake FedEx website. Damage Stolen personal information (private messages, logins/passwords, etc.), decreased device performance, battery is drained quickly, decreased Internet speed, huge data losses, monetary losses, stolen identity (malicious apps might abuse communication apps). Malware Removal (Android) To eliminate malware infections our security researchers recommend scanning your Android device with legitimate anti-malware software. We recommend Avast, Bitdefender, ESET or Malwarebytes. In conclusion, cybercriminals use a fake FedEx application to distribute FluBot banking malware. Since this malware can access the contact list, upload and send messages, cybercriminals can spread it further using gathered numbers and sending SMS messages pertaining to be notifications from FedEx with a malicious website link. More examples of Android malware are Oscorp, ThiefBot, and Basbanke. How did FluBot infiltrate my device? As mentioned above, FluBot is distributed through a fake FedEx website. Android users receive link to that website via SMS claiming to be a notification from FedEx about the package supposedly due to arrive. Cybercriminals target users living in different countries (e.g., Germany, Poland, Hungary). Note also that malware can be distributed using email (malicious email attachments, website links in emails), fake software updaters, 'cracking' tools, third-party downloaders, Peer-to-Peer networks, and other dubious sources for downloading files and programs. In fact, the aforementioned distribution methods are more likely to be used to trick users into installing malware on their computers, rather than mobile devices. How to avoid installation of malware. Software should be downloaded from legitimate sources (e.g., official pages or platforms). It is never safe to use unofficial pages or other sources for downloading files or applications. Irrelevant email messages that contain attachments or website links should not be trusted, especially if they are received from an unknown sender. Cybercriminals often use emails of this kind to deliver malware (they encourage users to open the attachment or click on a provided link). Installed programs must be updated and activated using tools that their official developers provide. Unofficial, third-party tools are often malicious. Moreover, it is illegal to bypass activation of any licensed software using 'cracking' tools or pirated software. Additionally, your device should have reputable antivirus or anti-spyware software installed - use this software to scan the device regularly. Screenshot of the fake FedEx website: Screenshot of the German SMS message: Text in this message: Ihr Paket kommt an, verfolgen Sie es hier: - Screenshot of the Hungarian SMS message: Text in this message: Megerkezett a csomagja, kovesse nyomon itt: - Screenshot of the Polish SMS message: Text in this message: FedEx: Twoja paczka przybywa, sledz tutaj: - Screenshots of the FluBot installation dialog boxes: Quick menu: Delete browsing history from the Chrome web browser: Tap the " Menu " button (three dots on the right-upper corner of the screen) and select " History " in the opened drop-down menu. Tap " Clear browsing data ", select " ADVANCED " tab, choose the time range and data types you want to delete and tap " Clear data ". Disable browser notifications in the Chrome web browser: Tap the " Menu " button (three dots on the right-upper corner of the screen) and select " Settings " in the opened drop-down menu. Scroll down until you see " Site settings " option and tap it. Scroll down until you see " Notifications " option and tap it. Find the websites that deliver browser notifications, tap on them and click " Clear & reset ". This will remove permissions granted for these websites to deliver notifications, however, once you revisit the same site, it may ask for permission again. You can choose whether to give these permissions or not (if you choose to decline, the website will go to the " Blocked " section and will no longer ask you for permission). Reset the Chrome web browser: Go to " Settings ", scroll down until you see " Apps " and tap it. Scroll down until you find " Chrome " application, select it and tap " Storage " option. Tap " MANAGE STORAGE ", then " CLEAR ALL DATA " and confirm the action by taping " OK ". Note that resetting the browser will eliminate all data stored within. Therefore, all saved logins/passwords, browsing history, non-default settings and other data will be deleted. You will also have to re-login into all websites. Delete browsing history from the Firefox web browser: Tap the " Menu " button (three dots on the right-upper corner of the screen) and select " History " in the opened drop-down menu. Scroll down until you see " Clear private data " and tap it. Select data types you want to remove and tap " CLEAR DATA ". Disable browser notifications in the Firefox web browser: Visit the website that is delivering browser notifications, tap the icon displayed on the left of URL bar (the icon will not necessarily be a " Lock ") and select " Edit Site Settings ". In the opened pop-up, opt-into the " Notifications " option and tap " CLEAR ". Reset the Firefox web browser: Go to " Settings ", scroll down until you see " Apps " and tap it. Scroll down until you find " Firefox " application, select it and tap " Storage " option. Tap " CLEAR DATA " and confirm the action by taping " DELETE ". Note that resetting the browser will eliminate all data stored within. Therefore, all saved logins/passwords, browsing history, non-default settings and other data will be deleted. You will also have to re-login into all websites. Uninstall potentially unwanted and/or malicious applications: Go to " Settings ", scroll down until you see " Apps " and tap it. Scroll down until you see a potentially unwanted and/or malicious application, select it and tap " Uninstall ". If, for some reason, you are unable to remove the selected app (e.g., you are prompted with an error message), you should try using " Safe Mode ". Boot the Android device in "Safe Mode": The " Safe Mode " in the Android operating system temporarily disables all third-party applications from running. Using this mode is a good way to diagnose and solve various issues (e.g., remove malicious applications that prevent users from doing so when the device is running "normally"). Push the " Power " button and hold it until you see the " Power off " screen. Tap the " Power off " icon and hold it. After a few seconds, the " Safe Mode " option will appear and you'll be able run it by restarting the device. Check the battery usage of various applications: Go to " Settings ", scroll down until you see " Device maintenance " and tap it. Tap " Battery " and check the usage of each application. Legitimate/genuine applications are designed to use as little energy as possible in order to provide the best user experience and to save power. Therefore, high battery usage may indicate that the application is malicious. Check the data usage of various applications: Go to " Settings ", scroll down until you see " Connections " and tap it. Scroll down until you see " Data usage " and select this option. As with the battery, legitimate/genuine applications are designed to minimize data usage as much as possible. Therefore, significant data usage may indicate the presence of malicious application. Note that some malicious applications might be designed to operate when the device is connected to a wireless network only. For this reason, you should check both Mobile and Wi-Fi data usage. If you find an application that uses a lot of data even though you never use it, then we strongly advise you to uninstall it as soon as possible. Install the latest software updates: Keeping the software up-to-date is good practice when it comes to device safety. The device manufacturers are continually releasing various security patches and Android updates in order to fix errors and bugs that can be abused by cyber criminals. An outdated system is much more vulnerable, which is why you should always be sure that your device's software is up to date. Go to " Settings ", scroll down until you see " Software update " and tap it. Tap " Download updates manually " and check if there are any updates available. If so, install them immediately. We also recommend to enable the " Download updates automatically " option - this will allow the system to notify you once an update is released and/or install it automatically. Reset the system to its default state: Performing a " Factory Reset " is a good way to remove all unwanted applications, restore system settings to the default, and clean the device in general. Bear in mind, however, that all data within the device will be deleted, including photos, video/audio files, phone numbers (stored within the device, not the SIM card), SMS messages, and so on. I.e., the device will be restored to its factory state. You can also restore the basic system settings and/or simply network settings as well. Go to " Settings ", scroll down until you see " About phone " and tap it. Scroll down until you see " Reset " and tap it. Now choose the action you want to perform: " Reset settings " - restore all system settings to default; " Reset network settings " - restore all network-related settings to default; " Factory data reset " - reset the entire system and completely delete all stored data; Disable applications that have administrator privileges: If a malicious application gets administrator-level privileges, it can seriously damage the system. To keep the device as safe as possible, always check which apps have such privileges and disable the ones that should not. Go to " Settings ", scroll down until you see " Lock screen and security " and tap it. Scroll down until you see " Other security settings ", tap it and then tap " Device admin apps ". Identify applications that should not have administrator privileges, tap them, and then tap " DEACTIVATE ". Click to post a comment. About the author: Tomas Meskauskas - expert security researcher, professional malware analyst . I am passionate about computer security and technology. I have an experience of over 10 years working in various companies related to computer technical issue solving and Internet security. I have been working as an author and editor for pcrisk.com since 2010. Follow me on Twitter and LinkedIn to stay informed about the latest online security threats. Contact Tomas Meskauskas. PCrisk security portal is brought by a company RCS LT. Joined forces of security researchers help educate computer users about the latest online security threats. More information about the company RCS LT. Our malware removal guides are free. However, if you want to support us you can send us a donation. These Nine Android Apps May Have Stolen Your Facebook Login Information. Nine trojan apps with more than 5.8 million combined downloads have been kicked off Google's Play Store. Google has kicked nine Android apps with more than 5.8 million combined downloads off its Play Store after researchers discovered they contained malicious code used to steal users’ Facebook login credentials, according to the Russian anti-virus software firm Dr. Web . As reported by Ars Technica , these trojan apps were designed to look and function like legitimate services for photo editing, exercising, clearing up storage space on your device, and providing daily horoscopes, Dr. Web’s malware analysts said in a post this week. In reality, this was all elaborate front to trick users into sharing their Facebook usernames and passwords. Here’s how the scheme worked: Each offered users an option to unlock all the apps’ functions and get rid of in-app ads by logging into their Facebook accounts, which likely wouldn’t raise too many eyebrows since a lot of mobile services let you sync your social media accounts. Upon choosing this option, the apps would then load a legitimate Facebook login page containing fields for entering usernames and passwords. Whatever users typed into these forms would go directly to a computer controlled by the hackers, called a command-and-control server, via some cleverly concealed malicious code, Dr. Web researchers wrote: These trojans used a special mechanism to trick their victims. After receiving the necessary settings from one of the C&C servers upon launch, they loaded the legitimate Facebook web page https://www.facebook.com/login.php into WebView. Next, they loaded JavaScript received from the C&C server into the same WebView. This script was directly used to hijack the entered login credentials. After that, this JavaScript, using the methods provided through the JavascriptInterface annotation, passed stolen login and password to the trojan applications, which then transferred the data to the attackers’ C&C server. After the victim logged into their account, the trojans also stole cookies from the current authorization session. Those cookies were also sent to cybercriminals. The analysts discovered 10 malicious trojan apps in total, nine of which were previously available on the Google Play Store. Two apps posing as photo editing services made up the most downloads by far: PIP Photo with over 5 million installations and Processing Photo with over 500,000. Three other apps had more than 100,000 downloads each. If you downloaded any of the apps listed below, you should consider updating your Facebook login information immediately and check your other online accounts for fraudulent activity: