Android Trojan xHelper uses persistent re-infection tactics: here’s how to remove

We first stumbled upon the nasty Android Trojan xHelper,  a stealthy malware dropper, in May 2019 www.avg.com/activate. By mid-summer 2019, xHelper was topping our detection charts—so We wrote a article about it After the blog, we thought the case was closed on xHelper. Then a tech savvy user reached out to us avg internet security in Install Avg With License Number activation early January 2020  avg antivirus free on the Malwarebytes support forum avg.com/retail    :

“I have a phone that is infected with the xhelper virus. This tenacious pain just keeps coming back.”

“I’m fairly technically inclined so I’m comfortable with common prompt or anything else I may need to do to make this thing go away so the phone is actually usable!”

— forum user misspaperwait, Amelia

Indeed, she was infected with xHelper. Furthermore,Malwarebytes for Androidhad already successfully removed two variants of xHelper Install Avg With License Number activation and  avg antivirus free a Trojan agent from her mobile device. The problem was, it kept coming back within an hour of removal. xHelper was re-infecting over and over again.

If it wasn’t for the expertise and persistence of forum patron Amelia, we couldn’t have figured this out. She has graciously has allowed us to share her journey avg.com/retail    . 

All the fails

Before we share the culprit behind this xHelper re-infection, I’d like to highlight the tactics we used to investigate the situation, including the many dead ends we hit prior to figuring out the end game. By showing the roadblocks avg internet security we encountered,  avg antivirus free we demonstrate the thought process www.avg.com/activate and complexity behind removing malware so that others may use it as a guide. 

Clean slate

First off, Amelia was clever enough to do a factory reset before reaching out to us. Unfortunately, it didn’t resolve the issue, though it did give us a clean slate to work with. No other apps (besides those that came with the phones) were installed besides Malwarebytes for Android, thus, we could rule out an Install Avg With License Number activation infection by prior installs (or so we thought).

We also ruled out any of the malware avg.com/retail     having device admin rights, which would have prevented our ability to uninstall malicious apps  avg antivirus free. In addition, we cleared all history and cache www.avg.com/activate on Amelia’s browsers avg internet security, in case of a browser-based threat, such as a drive-by download, causing the re-infection.

The usual suspect: pre-installed malware

Since we had a clean mobile device and it was still getting re-infected, our first assumption was that pre install malware was the issue. This assumption was fueled by the fact that the mobile device was from a  lesser known manufacturer, which is often the case with pre-installed malware.  So Amelia tested this theory by going through the steps to run  Android bridge drugged command to her mobile device. 

With adb command line installed and the mobile device plugged into a PC, we used the workaround of uninstalling system apps for current user. This method renders system apps useless even though they still technically reside on the device  avg antivirus free. 

Starting with the most obvious to the least, we systematically uninstalled suspicious system apps, including the mobile device’s www.avg.com/activate system updater and avg internet security an audio app with hits on VirusTotal, a potential indicator avg.com/retail     of maliciousness.  Amelia was even able to grab various apps we didn’t have in our Mobile Intelligence System to rule everything out Install Avg With License Number activation. After all this, xHelper’s persistence would not end

Triggered: Google PLAY

We then noticed something strange: The source of installation for the malware stated it was coming from Google PLAY. This was unusual because none of the malicious apps downloading on Amelia’s phone were on Google PLAY. Since we were running out of ideas, we disabled Google PLAY. As a result, the re-infections stopped

We have  seen important pre installed  system apps with malware in the past. But Google PLAY itself!? After further analysis, we Install Avg With License Number activation determined that, no, Google PLAY was not infected with malware. However, something within Google PLAY was triggering the re-infection—perhaps something that www.avg.com/activate was sitting avg internet security in storage. Furthermore, that something could also be using Google PLAY as a avg.com/retail     smokescreen, falsifying it as the source of   avg antivirus free malware installation when in reality, it was coming from someplace else.

In the hopes that our theory held true, we asked Amelia to look for suspicious files and/or directories on her mobile device using a searchable file explorer, namely, anything that started with com.mufc., the malicious package names of xHelper.