Koler trojan won't uninstall in safe mode and there are no device administrators

[aza3555]

As the title says I've put my phone into safe mode and tried to uninstall the trojan but the option is greyed out, there are no device administrators, any ideas?

[a_Mbam]

Hi Aza3555,

 

Yeah, these guys have become trouble. You can try disabling the app via command-line using ADB while connected with a USB. Keep in mind these are advanced steps so use at your own risk and use caution.

 

To get adb you can point them to http://forum.xda-developers.com/showthread.php?p=48915118#post48915118

 

Or, for the full Android Development kit here: https://developer.android.com/sdk/installing/index.html?pkg=tools

 

The trickiest part is identifying the package name because they obviously try to hide, so the name could be randomized, some adobe flash or porn variation, or one that's kind of nonsensical.

 

Best to do while device is in Safe Mode, connect the device via USB with USB debugging enabled.

 

Using adb, from a command line:

 

> adb shell

> pm list packages (identify app)

- non-root:

   > adb shell am force-stop com.mypackage (com.mypackage is the name of the app)

- with root: 

   > pm disable com.mypackage

 

Examples: 

adb shell am force-stop knhd.nduix.kvzpl

adb shell am force-stop com.porno.player

 

Next uninstall app.

 

Restart device

 

Good luck and let me know if you have trouble with the steps.

 

-Armando

[Alison1805]

I currently have this problem too.  But I found a website saying remove BaDoink from applications whilst in safe mode but that it will change names often.  There is nothing called BaDoink in my applications but there are loads of other stuff.  Being a bit of a technaphobe, I have no idea which one it could be and don't want to delete something that my phone actually needs in order to work!  Any ideas?

[a_Mbam]

Hi Alison1805,

 

Yeah, the malicious app names have changed a lot since the Badoink variant. I would suggest looking for apps listed as Device Admin, Settings > Security > Device administrators, for anything that looks unfamiliar. Typically they will have a porn or Flash related icon.

 

Unfortunately, It's difficult to identify the offending app with the info you provided. Some devices are able to list apps in the App drawer by most recent and there are apps that can give you an install/update time for apps installed, running one might help point out any unwanted recent additions.

 

Recent Installs app https://play.google.com/store/apps/details?id=com.recentapps.activities

 

 

Regards,

 

-Armando