Strange android app … possibly a mass malware?

Question

I started receiving on my android Samsung Galaxy note strange notifications in Mandarin (the language of the people of china). Once I click on the notification it opens my browser with a blank page and then exits just after few seconds. Few minutes later I get this app install prompt ... (it says in french : blocked install of apps not coming from android market ) This have been repeating several times since ~2 weeks now

Questions :

What's this ? How to be sure that it won't repeat again ?

PS: My phone has the latest up dates offered by samsung and is not rooted. I also did not installed any app in Mandarin.

thanks for your help

Answer 1

Are you running Android 4.0.4 (Wikipedia lists it as the latest)? While they're not widespread, there is at least a few known vulnerabilities (such as this one and this one), and given that it's about a year old, I wouldn't be surprised if there were a few bits of malware like this around.

The malware you have contracted sounds like what Symantec is calling Android.Updtbot, and you may have some luck following their Removal instructions, or at least by downloading and installing a scanner of some sort to check over the phone.

If you're unable to scan/remove the malware; you're likely going to need to wipe the device completely and restore a clean version of the OS.

As a preventative measure, after cleaning or wiping your phone; be careful not to open links provided by someone you don't know, and you shouldn't open links from someone you do know that you weren't expecting to receive - whether they arrived by SMS, email or whatever. Since you have the option of installing and running anti-malware and anti-virus on your device, much like on your PC, you should install and keep up to date some sort of malware protection.

Answer 2

I believe you indeed may have discovered malware. The best thing to do is to completely wipe your phone and re-install the android operating system.

Answer 3

Find the cause

If using "Jelly Bean", it is easy to know that which app make the push notification. Find out which app is pushing ads in my notification bar?

Otherwise, use Addons Detector to find out which apps are using push notifications inappropriately. Though it needs manual inspection.

Scan malicious file with ALYac. It can catch commonly-seen malwares on Android.

Actions

Never click on unfamiliar notification message unless you know what it is.

You are suggested to remove those suspicious apps that misuse push notifications.

If AirPush is detected, you can opt-out by using the Airpush opt out app once.

Note: The Simplified Chinese stated "Baidu Browser"

Answer 4

So I was curious what that text in Mandarin Chinese says and run it through an online OCR reader. The text that comes out is 百度浏览器 and (using Google Translate) translates into Baidu browser. Baidu Browser or 百度浏览器 is a browser that can be also downloaded from Google Play and is a perfectly legitimate piece of software.

I suspect all this you're experiencing is merely due to an unfortunate patch/update (possibly of software of one of OEMs that provide equipment for your smartphone) that propagated unsigned software package with it. Or have you been trying to root your smartphone and use it in developer mode, or for any other reason wanted to boot it with a customized loader? I'm asking this, because we have so far no clear indication we're talking of malware here, and it might as well be perfectly normal, or an unfortunate update that packaged wrong browser with it and unsigned at that too (thus the error you're getting, indicating you have left "Unknown sources" installations disabled under Settings/Security, as you probably should and is Android system default).

Either case, you should be able to connect your phone with an USB cable to your computer, navigate in its folder structure to wherever this application that wants to install is located, and simply delete it. You won't do no harm to your phone in doing so, just make sure it's the right installation package you're deleting. ;)