QR Code Scanner: Add-On Malware won't uninstall or be scanned

[Whit-More]

I am using a Moto G50 with Android v 12 (I believe with all latest patches)

I appear to have downloaded the malware - "QR Code Scanner: Add-On" as described here https://blog.malwarebytes.com/android/2021/02/barcode-scanner-app-on-google-play-infects-10-million-users-with-one-update/

I managed to uninstall the QR reader but the Add on is still there & has now run itself without my wanting it to.

Whenever I try to uninstall it by going to App info in the Apps list, the App info immediately shuts down, so I cannot get to uninstall.

I have tried looking on the Internet to see if I could find a work around, but all the articles on this as a malware problem just tell you to uninstall. I searched your forum but couldn't see a response on this (sorry for starting a new thread).

I downloaded Malware bytes from Playstore in order to run a scan & get rid of it. But not Malware bytes (& also AVG AntiVirus) do exactly the same thing. When you double click to run the programme thet shut down immediately. If I go to get app info it and click on it, it also shuts down immediately.

Are you aware of this issue? Is there anything I can do to remove?

[Whit-More]

OK - managed to remove it by rebooting phone in safe mode - at that point allowed me to uninstall.

Am not running secondary virus scans to check all is well after deletion.

[mbam_mtbr]

Hi @Whit-More,

Glad you were able to remediate.  It sounds like what you were infected with was nastier than the malware listed in the blog you posted.  We would have asked for an Apps Report to track down and detect this malware if it was still installed.  If you could Private Message (PM) me the source URL of where you downloaded this malware, or any other evidence like app name, screen shots, etc would be very helpful.

[Whit-More]

Thanks so much for getting back. I am sorry I removed it in these circumstances I didn't take screen shots etc.

In terms of where I got it from it was via Play Store (on Sunday on 20 Feb this year). I needed to download a QR code reader entering an exhibition, as I was having problems with me one - Using the gallery wifi I ended up downloading about 3 as nothing seemed to be working, and ended up with the 'add on' ("QR Code Scanner: Add-On" ) which would still not delete. As I downloaded a number I can't be sure but the logo of the add on that remained was light blue in colour & matches a "QR code reader" by BACHA Soft. I can't however be sure that the problem app downloaded from them even if it had this logo. I could not get rid of it (& it had the properties of shutting down if you tried to get app details), and I should have dealt with it earlier but didn't think it was too suspicous until recently (last week) when it was showing up as an active programme. So spent time focussed on sorting it on Sunday. Sorry I can't be more useful....

Andy