Strange android app … possibly a mass malware?

Question

I started receiving on my android Samsung Galaxy note strange notifications in Mandarin (the language of the people of china). Once I click on the notification it opens my browser with a blank page and then exits just after few seconds. Few minutes later I get this app install prompt ... (it says in french : blocked install of apps not coming from android market ) This have been repeating several times since ~2 weeks now

Questions :

What's this ? How to be sure that it won't repeat again ?

PS: My phone has the latest up dates offered by samsung and is not rooted. I also did not installed any app in Mandarin.

thanks for your help

Answer 1

I believe you indeed may have discovered malware. The best thing to do is to completely wipe your phone and re-install the android operating system.

Answer 2

Are you running Android 4.0.4 (Wikipedia lists it as the latest)? While they're not widespread, there is at least a few known vulnerabilities (such as this one and this one), and given that it's about a year old, I wouldn't be surprised if there were a few bits of malware like this around.

The malware you have contracted sounds like what Symantec is calling Android.Updtbot, and you may have some luck following their Removal instructions, or at least by downloading and installing a scanner of some sort to check over the phone.

If you're unable to scan/remove the malware; you're likely going to need to wipe the device completely and restore a clean version of the OS.

As a preventative measure, after cleaning or wiping your phone; be careful not to open links provided by someone you don't know, and you shouldn't open links from someone you do know that you weren't expecting to receive - whether they arrived by SMS, email or whatever. Since you have the option of installing and running anti-malware and anti-virus on your device, much like on your PC, you should install and keep up to date some sort of malware protection.