There's finally a way to remove xHelper, the unremovable Android malware

It has taken safety researchers just about ten months to find a dependable means of cleansing smartphones inflamed with xHelper, one of those Android malware that, till lately, has been unimaginable to take away.

The elimination method is described on the finish of this text, however first some context for readers who need to be told extra about xHelper.

This actual malware pressure has brought about rather the ache for customers far and wide the sector previously ten months. The malware used to be first noticed again in March 2019, when customers started complaining on quite a lot of web boards about an app they were not ready to take away, even after manufacturing unit resets.

Those apps have been liable for perstering customers with intrusive popup commercials and notification unsolicited mail. Not anything truly malicious, however nonetheless very irritating.

Because the yr advanced, xHelper campaigns expanded the malware’s succeed in, infecting increasingly more gadgets. In step with a Malwarebytes record, there have been round 32,000 inflamed gadgets through August, a bunch that later reached 45,000 through overdue October, when Symantec researchers additionally revealed their very own record at the danger.

In step with researchers, the supply of those infections used to be “internet redirects” that despatched customers to internet pages web hosting Android apps. The websites steered customers on the best way to side-load unofficial Android apps from outdoor the Play Retailer. Code hidden in those apps ultimately downloaded and put in the xHelper trojan.

However whilst finding its supply, succeed in, and level of an infection used to be simple, what confounded safety researchers remaining yr used to be that they could not take away the malware from a tool through conventional strategies, akin to uninstall the unique xHelper app or through a manufacturing unit reset.

Each and every time a consumer would manufacturing unit reset the software, the malware would merely pop up a couple of hours later, reinstalling itself with out a consumer interplay.


Symbol: ZDNet

The one method to take away xHelper used to be to accomplish a complete software reflash through reinstalling all the Android running machine, an answer that used to be now not conceivable for all inflamed customers, a lot of whom did not have get admission to to the proper Android OS firmware pictures to accomplish a reflash.

Some clues emerge

Since coming around the malware remaining yr, safety researchers from Malwarebytes have persevered to seem into the danger.

In a weblog publish nowadays, the Malwarebytes group say that whilst they nonetheless have not discovered precisely how the malware reinstalls itself, they did uncover sufficient details about its modus operandi as a way to take away it for excellent and save you xHelper from reinstalling itself after manufacturing unit resets.

The Malwarebytes group says that xHelper has it sounds as if discovered some way to make use of a procedure throughout the Google Play Retailer app as a way to cause the re-install operation.

With assistance from particular directories it had created at the software, xHelper used to be hiding its APK on disk to live to tell the tale manufacturing unit resets.

“Not like apps, directories and recordsdata stay at the Android cellular software even after a manufacturing unit reset,” says Nathan Collier, Senior Malware Intelligence Analyst at Malwarebytes.

Collier believes that when the Google Play Retailer app carried out some yet-to-be-determined operation (supposedly some more or less scan), it reinstalled itself.

Elimination directions

Collier has now put in combination a chain of steps that customers can observe to take away the xHelper malware from gadgets and save you it from reinstalling itself.

Of observe, those directions depend on customers putting in the Malwarebytes for Android app, however this app is unfastened to make use of, so it should not be any factor for customers.

Step 1: Set up a document supervisor from Google Play that has the aptitude to go looking recordsdata and directories. (ex: Amelia used Document Supervisor through ASTRO).

Step 2: Disable Google PLAY briefly to forestall re-infection.

  • Pass to Settings > Apps > Google Play Retailer
  • Press Disable button

Step three: Run a scan in Malwarebytes for Android to spot the nameof the app that hides the xHelper malware. Manually uninstalling may also be tricky, however the names to search for within the Android OS Apps data segment are fireway, xhelper, and Settings (most effective if two settings apps are displayed).

Step four: Open the document supervisor and seek for anything else in garage beginning with com.mufc.

Step five: If discovered, make an observation of the remaining changed date.

  • Kind through date in document supervisor
  • In Document Supervisor through ASTRO, you’ll be able to kind through date below View Settings.

Step 6: Delete anything else beginning with com.mufc. and anything else with identical date (except for core directories like Obtain):


Symbol: Malwarebytes

Step 7: Re-enable Google PLAY

  • Pass to Settings > Apps > Google Play Retailer

Leave a Reply

Your email address will not be published. Required fields are marked *