0

My father told me that he allowed the installation of apps from unknown sources when he was asked to do it to go further with something (he said that he doesn't remember when or what he was doing).

In android 8.0 (the version of his smartphone) we can allow third-party installation for individual apps, so I went in this tab and I saw that only Google Chrome was able to this type of installation.

So, I navigated through my father's apps and found nothing suspicious.

When I went to files, I found a folder called didi. Inside, a file with no extension called psnger_encrypted or something like this. When I selected the file to see details, I accidentally clicked on the file. Android told me that there was not found any app to open that file.

Could a file have been executed even when Android says that message? If this file is malicious, it is possible that has executed and so infected the phone?

Doing some research, I found that a chinese app called "DiDi" has a file called "psnger" too. Also, I found a file in my father's phone called .omega.key, and this file is also seen in topics related to DiDi app.

The fact is that I can't find this app on the phone, and I'm looking for ways that can indicate if the phone is infected. I executed AVG, and Malwarebytes but both detected nothing. What else can I do?

Improve this question
4
  • I've you're concerned about infected phone, then most malware should go (exception of rootkits imo) if its reformatted & reset. He's likely to lose date if you go down this route. Always keep backups..
    – unseen_rider
    Apr 1, 2019 at 15:42
  • 1
    Tapping the file would only prompt the system to look for an app that says it can handle it. If nothing has registered for the file extension, then you would get the message it gave you. Didi looks to be a legit rideshare app like Uber. It's likely your dad uninstalled it and these files are just remnants.
    – Kevin Mirsky
    Apr 1, 2019 at 20:58
  • @KevinMirsky this means that trying execute a file without extension will not work?
    – Mycroft
    Apr 1, 2019 at 23:57
  • @Mycroft That is correct, and is not an indication of maliciousness. The fact that your father allowed the installation of apps from other sources makes his phone much more vulnerable to malware. I wonder what prompted him to do that.
    – chillsauce
    Feb 5, 2020 at 18:51

2 Answers 2

Reset to default
1

Tapping a file without an extension will not run it so you are safe there.

If you have unexplained apps or files on your phone and you suspect malware your only good course of action it's to re-image/reset the phone to factory defaults.

Improve this answer
0

Both the Didi folder and the "omega.key" file are installed with the mobility app package (uber and 99 here in Brazil), I believe that they are not malicious, even deleting the omega.key it returns because the app is still on the smartphone , if you delete the mobility app and restore the factory defaults, it will not return. PS. Norton Clean was the only one that detected it on my smartphone phone. PS1. Sorry my English

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .