Hjem » Nyheter » xHelper “undeletable” Trojan smittet 45,000 Android-enheter

xHelper “undeletable” Trojan smittet 45,000 Android-enheter

Den xHelper Trojan, laget for Android-enheter, was first noticed by experts in the spring of this year, but the first detailed report on the problem appeared in August, when Malwarebytes experts rapportert that the malware had already infected 35,000 enheter.

Symantec experts publisert a review on the malware and claim that the number of infected devices has already exceeded 45,000, and on average xHelper infects 131 new victims per day (handle om 2,400 new victims per month), most of which were found in India, the USA and Russia.

“The main source of infections are redirects and suspicious sites that forward users to pages with Android applications. Such sites instruct the user in detail how to download applications not from Google Play, and the code hidden in the applications ultimately leads to the loading of xHelper”, – say researchers.

xHelper is currently displaying intrusive pop-up ads and spam alerts to its victims. Typisk, such ads and notifications lead users to the Play Store, where they are invited to install other applications. XHelper operators earn commissions that they receive for each such installation. Neverthelss, the malware has other, much more dangerous functions.

Both companies write that xHelper can download and install other applications. And malware operators can use this feature to deploy second-level threats, including ransomware, bank trojans, og så videre.

“However, the most interesting feature of xHelper is that it does not work like most Android malware When the trojan gains access to the device through the initial application, xHelper installs itself as a separate standalone service. Endelig, removing the original application does not remove xHelper, and the malware will continue to display ad windows and notifications”, — warn the researchers.

Verre, even if the victim finds the xHelper service in the OS settings, deleting it will not help the case, as the trojan is reinstalled every time, even if the user resets the device to the factory settings.

LESE  Cybercriminal med nick Achilles har lagt ut for salg tilgang til interne nettverk av Symantec, Comodo og UNICEF

I noen tilfeller, users complained that even uninstalling the xHelper service and disabling the ability to install applications from unknown sources did not help: the device appeared to be re-infected literally a few minutes after cleaning, and the option “install apps from unknown sources” turned out to be active again. Such discussions can be found on Reddit, among the topics on the Google Play Help.

Les også: Casbaneiro banktjenester Trojan brukt YouTube til å stjele kryptovaluta

Samtidig, experts from Malwarebytes and Symantec were not able to understand how xHelper “survives” after this. There was no Trojan interference in the operation of system applications and services, and Symantec believes that xHelper is unlikely to be preinstalled on devices out of the box, although the malware actually appears more often on devices of specific brands. Despite these facts, many users believe that this is the case and urge others not to buy cheap Chinese phones.

[Totalt:0    Gjennomsnitt:0/5]

Om Trojan Killer

Carry Trojan Killer Portable på minnepinne. Vær sikker på at du er i stand til å hjelpe din PC motstå eventuelle cyber trusler uansett hvor du går.

Sjekk også

Zonealarm hacket med vBulletin sårbarhet

Zonealarm fora hacket på grunn av vBulletin sårbarhet

Forumet på Zonealarm, which is owned by Check Point and whose products are used

Hvordan fjerne Villedende:Win32 / Lodi virus?

Misleading:Win32/Lodi is a generic detection utilized by Microsoft Security Essentials, Windows Defender and other anti-virus

Legg igjen et svar