Photo provided by Amelia of xHelper running on mobile device Triggered: Google PLAY After all this, xHelper’s persistence would not end. Amelia was even able to grab various apps we didn’t have in our Mobile Intelligence System to rule everything out. Starting with the most obvious to the least, we systematically uninstalled suspicious system apps, including the mobile device’s system updater and an audio app with hits on VirusTotal, a potential indicator of maliciousness. With adb command line installed and the mobile device plugged into a PC, we used the workaround of uninstalling system apps for current user. This method renders system apps useless even though they still technically reside on the device. So Amelia tested this theory by going through the steps to run Android Debug Bridge (adb) commands to her mobile device. Since we had a clean mobile device and it was still getting re-infected, our first assumption was that pre-installed malware was the issue. This assumption was fueled by the fact that the mobile device was from a lesser-known manufacturer, which is often the case with pre-installed malware. We also ruled out any of the malware having device admin rights, which would have prevented our ability to uninstall malicious apps. In addition, we cleared all history and cache on Amelia's browsers, in case of a browser-based threat, such as a drive-by download, causing the re-infection. Clean slateįirst off, Amelia was clever enough to do a factory reset before reaching out to us. Unfortunately, it didn’t resolve the issue, though it did give us a clean slate to work with. No other apps (besides those that came with the phones) were installed besides Malwarebytes for Android, thus, we could rule out an infection by prior installs (or so we thought). By showing the roadblocks we encountered, we demonstrate the thought process and complexity behind removing malware so that others may use it as a guide. All the failsīefore we share the culprit behind this xHelper re-infection, I'd like to highlight the tactics we used to investigate the situation, including the many dead ends we hit prior to figuring out the end game.

If it wasn’t for the expertise and persistence of forum patron Amelia, we couldn’t have figured this out. She has graciously has allowed us to share her journey.

Malwarebytes support phone