Database Users

[STICKY][Patch][Rom]Malware Exploit for all pre-Gingerbread devices

Who is affected? All devices pre-gingerbread
Who should act? Users and developers using pre-gingerbread roms
How do I fix? Flash attached .zip at the bottom of this post
What if I think I was infected? Completely wipe your device, format sdard, go back to stock and re-apply rom, then flash the attached .zip (before installing any apps)
Why should I care? read below...
http://www.androidpolice.com/2011/0...your-phone-steal-your-data-and-open-backdoor/
Flash this with ClockWorkMod.... this is for any Pre Gingerbread ROM.... ie TNT anything, VEGAn 5.1.1 and below, Zpad anything, GAdam anything.
This is not necessary for any ROMS based off Gingerbread AOSP or CM7. Including VEGAn-TAB Experimentals.
Be Safe.
Even More Details here: http://www.androidpolice.com/2011/0...-android-nightmare-and-weve-got-more-details/

I checked out the zip and it just adds a blank text file (0 bytes) called profile to the /system/bin folder. So I am not sure what the fix is?
**EDIT** Nevermind it is a dummy file meant to prevent the virus. Thanks to the OP for providing this.

http://www.androidpolice.com/2011/0...your-phone-steal-your-data-and-open-backdoor/
Nasty stuff. I would say this patch is high priority and I'm already going through my own ROMs to add it in.

http://forum.xda-developers.com/showthread.php?t=977154
Link above has info on creating the file manually.
Jim

fyi -
http://www.pcworld.com/article/221213/keep_malware_off_your_android_phone_5_quick_tips.html
Lookout mobile security . In case you cannot find it via the market.
http://www.getjar.com/Lookout-Mobile-Security-with-Antivirus
Edit. I just installed the lookout app to scan my tab, everything was fine and then, i un-installed it since it was running on the background and taking 10% of the cpu..
Anyways, a nice app that can be used to do a quick scan..

I don't have a stock gtab but I'll ask anyways... how can our stock rom users be protected? Is there an alternate method?
Edit just saw the manual process. Im guess that's the way to go.

xmr405o said:
I don't have a stock gtab but I'll ask anyways... how can our stock rom users be protected? Is there an alternate method?
Edit just saw the manual process. Im guess that's the way to go.
Click to expand...
Click to collapse
I'd curious to see what all the vendors are going to do about this. Granted, they could just say that the Market is not there, but regardless the security hole is still there and needs to be plugged up.

Hi,
I hope that this isn't too offtopic, but I was trying to create /system/bin/profile using a term and su, and when i went into root explorer to make /system/bin R/W, root explorer showed the dir as R/W already, and as mounted on /dev/loop9.
Is that normal?
I haven't installed dataloop, at least intentionally, so it seems strange that /system/bin would be mounted there, plus it being R/W by default?
FYI, I use z4root to get temp root. Could that be why /system/bin is R/W?
Then again, that wouldn't explain the /dev/loop9 mount ...
Jim

jimcpl said:
Hi,
I hope that this isn't too offtopic, but I was trying to create /system/bin/profile using a term and su, and when i went into root explorer to make /system/bin R/W, root explorer showed the dir as R/W already, and as mounted on /dev/loop9.
Is that normal?
I haven't installed dataloop, at least intentionally, so it seems strange that /system/bin would be mounted there, plus it being R/W by default?
FYI, I use z4root to get temp root. Could that be why /system/bin is R/W?
Then again, that wouldn't explain the /dev/loop9 mount ...
Jim
Click to expand...
Click to collapse
Hi,
Creating the profile file manually, it wouldn't persist,i.e., it was gone after rebooting, so I installed gojimi's zip usung CWM, and that worked.
I also did a mount w/o getting temp root, and /system/bin is not on /dev/loop9, so I'm guessing that when z4root sets temp root, it might be remounting /system/bin on /dev/loop9 itself.
Jim

You would have to download one of those sketchy apps to really be affected anyways, right? Who would do that?!

Appreciate the patch. This highlights the two problems with android though, google fixed this security issue in 2.2.2, but most carriers still haven't released that update. And the market needs some oversight, not authoritarian apple like, but some.
Sent from my T-Mobile G2 using XDA App

Is it possible to sticky this thread
Mods is it possible to sticky this thread so that it is easily visible.
Thanks

Hello guys. Is there a way to find out if our tablet is infected or not?
I mean if we have installed any of the apps in the list that automatically means that we are infected or not?
If infected what is preferred to do wipe the tablet or go back to stock rom??
Is there any manual for windows 7 noobies users?
Thanks.

Doctor LeVa said:
Hello guys. Is there a way to find out if our tablet is infected or not?
I mean if we have installed any of the apps in the list that automatically means that we are infected or not?
If infected what is preferred to do wipe the tablet or go back to stock rom??
Is there any manual for windows 7 noobies users?
Thanks.
Click to expand...
Click to collapse
Please read the thread completely, it is stated you can download lookout security to run a scan to see if you are infected.

downloading.....see what happens

There is a DroidDreamKiller app that allows you to check to see if you are already infected and install the patch. There is also a beta test app that gives you other information. Just search the market for DroidDreamKiller.

To devs: Thank You
TO Everyone else DO THIS ASAP

How do I flash the zip file after downloading it?
Thanks

Start cwm using volume up while powering on.
Once menu comes up select install zip using vol buttons
Use home to select.
Navigate to where you saved zip file
Select it with home button
Once install complete reboot from cwmod

MODs Please make this a sticky . It is being overlooked.

[DEV] System images

I want to collect the system images in case you must get back to stock.
Just do the following and upload your image.
Code:
su
dd if=/dev/block/mmcblk0p3 of=/sdcard/system.img
perfect would be an nearly untouched build
IMAGES:
WIFI - US: http://forum.xda-developers.com/showpost.php?p=13427976&postcount=7
WIFI - EU: Had to remove my image because of Dropbox

I'm currently uploading one to my dropbox should be done in about an hour. I'll poist the url, or pm you should you prefer.

You may post it in public, of course - thx a lot

seraphimserapis you forgot to ask somthing from the people that upload...
plase add in the first post to add:
3g/wifi model
us/eu versions

you're right.
it's the wifi eu model
Sent from my Nexus S using Tapatalk

wee really need one of each version... I really what to compare file on all versions

mine is the wifi us
here is the link
http://db.tt/dSafLm6

common ppl we need 3g models... go for 3g models....

Stock?
How would one of these get me back to stock? I've got a corrupt file - so I am bootlooping after root. SU causes a seg fault, so I can't get root permission to remount & replace the busted files... anyone figure out getting to recovery yet?

BitVenom said:
How would one of these get me back to stock? I've got a corrupt file - so I am bootlooping after root. SU causes a seg fault, so I can't get root permission to remount & replace the busted files... anyone figure out getting to recovery yet?
Click to expand...
Click to collapse
thinking its dead... thats what i'm afraid of... got lots of ideas but cant try them without a safety net...

BitVenom said:
How would one of these get me back to stock? I've got a corrupt file - so I am bootlooping after root. SU causes a seg fault, so I can't get root permission to remount & replace the busted files... anyone figure out getting to recovery yet?
Click to expand...
Click to collapse
Use this file http://db.tt/3hqvgP1 and push it to /data/local/tmp
Then run it via ./data/local/tmp/gb
You should be root afterwards and be able to fix permissions etc
Sent from my LG-P990 using Tapatalk

borked system/bin us version 16gb
hi I borked my acer. root went smoothly, but then I made mistake of trying to enable adhoc supplicant. I downloaded es explorer and used remount to enable rewrite to system/bin. Now everything disappeared. It will still load, but wifi shows error.
How do I return to stock?

ataib said:
hi I borked my acer. root went smoothly, but then I made mistake of trying to enable adhoc supplicant. I downloaded es explorer and used remount to enable rewrite to system/bin. Now everything disappeared. It will still load, but wifi shows error.
How do I return to stock?
Click to expand...
Click to collapse
its very simple you didnt set the wpa_supplicant to the right permissions... as you were told... and please dont post in the dev section :|

nycbjr said:
mine is the wifi us
here is the link
<Link removed>
Click to expand...
Click to collapse
Thank you so much! I got stuck on the Android ! boot screen and couldn't get the OS to boot after stupidly screwing up permissions after I rooted. I downloaded your zip, renamed it to update.zip and loaded it on a microsd card. Then I put the card in, booted the tablet while holding volume down and recovery loaded the system image and I'm back in business. It did come with a few apps loaded into system I'm not familiar with including a few that weren't in English. Will a factory reset remove those, does anyone know?
Edit: This is also missing gapps including the market... You sure this is a US image?

no thats a chinese update u need to follow a link thats been post above urs a bit ago and follow the directions on how to add market to the nook color.
Sent with my Acer A500 Ti-X RC1

Thanks I found the info. And I bricked it again. Looks like it's getting exchanged at best buy tonight. I'm not going to try rooting again anytime soon.

tonight come in to the irc channel and talk to me. we will get u rooted but not bricked.
Sent with my Acer A500 Ti-X RC1

Back to stock
EDIT - removed

Hi and sorry for my poor english...
Could you explain how to put back a system.img backup in the tablet in case of a problem ?
Thanks a lot !

I don't know if that's possible while running the device. This will be good for the recovery tho
Sent from my A500 using Tapatalk

Need Help with /system/bin/sh

Okay, so heres my case i rooted my play and installed the custom ROM GBTweaked0. Since then i couldn't access my Recovery or install my old rom from my SD card. Me being a n00b, i tried uninstalling busybox, the uninstall failed and since then my apps seem to have lost root access and im missing /system/bin/sh.
Please if anyone could help me get the sh file back i'd greatly appreciate it. i just want my phone running back on my stock rom

try downloading busybox installer from the market it has every version if that doesnt work reroot or give those apps permission in superuser again

psxpetey said:
try downloading busybox installer from the market it has every version if that doesnt work reroot or give those apps permission in superuser again
Click to expand...
Click to collapse
i already tried reinstalling busybox from the market and it claims it doesnt have root access even though it does. i made sure in super user

you could find the busybox files and move them manually to the correct location
-------------------------------------------
Fma965 - ForgottenCoders
http://forgottencoders.co.uk

i dont think that that would work either because system/bin is a read only folder. so even if i knew how to manually install busybox the way your talking about i don't think that it would let me.

never mind i flashed to stock 2.3.2 using WotanServer. Thanks for the help

mike61096 said:
never mind i flashed to stock 2.3.2 using WotanServer. Thanks for the help
Click to expand...
Click to collapse
well if you had root it is read/write? Isn't it?
-------------------------------------------
Fma965 - Forgottencoders.co.uk
Want to make me a banner? PM me

fma965 said:
well if you had root it is read/write? Isn't it?
-------------------------------------------
Fma965 - Forgottencoders.co.uk
Want to make me a banner? PM me
Click to expand...
Click to collapse
yes, but like i said in my first post, i tried uninstalling busybox which deleted the sh file in my system/bin folder which must have taken root access away.
But again, it's all good now cus like i said i managed to flash back to stock 2.3.2 using WotanServer and updated to 2.3.3, rooted, restored all my apps, and now my phone is back to normal.

How to disable OTA updates (rooted ICS)

Any know how to disable the OTA updates from messing with my root now that I have it the way I like it?
I have the stock OTA ICS upgrade rooted and enabled adhoc for use tethering to my phone while travelling (which is the only reason I rooted it).
TIA!

BBAHunter said:
Any know how to disable the OTA updates from messing with my root now that I have it the way I like it?
I have the stock OTA ICS upgrade rooted and enabled adhoc for use tethering to my phone while travelling (which is the only reason I rooted it).
TIA!
Click to expand...
Click to collapse
Delete either FDUpdater.apk (with odex file) or FWUpdateService.apk (with odex file) and reboot. This should effectively kill that service if I'm not mistaken. You will find them in /System/app.
I typically remove both before compiling a rom. You may or may not get an error when you reboot. Maybe. Mine are usually deodex'd. So might be best to cut and paste them to SD Card. Just in case

Moscow Desire said:
Delete either FDUpdater.apk (with odex file) or FWUpdateService.apk (with odex file) and reboot. This should effectively kill that service if I'm not mistaken. You will find them in /System/app.
I typically remove both before compiling a rom. You may or may not get an error when you reboot. Maybe. Mine are usually deodex'd. So might be best to cut and paste them to SD Card. Just in case
Click to expand...
Click to collapse
Unfortunately I am unable to make any changes to these two files. Using either ES File Manager or Root Manager, any file options returns a FAILED. Even chmod in Android Terminal Emulator says files are read only.
Any help on how to get rid of these annoying files would be greatly appreciated.
Thanks.
Cole

Settings- About Tablet- Update system -uncheck the box

How to get rid of the default emoji?

I'd like to have the hangout's emoji.
Not the Samsung.
BTW I'm not rooted

If you're not rooted then there's no way to do so. If you are rooted however, it's pretty easy. Reply to me if you want to know how.

guetzli32 said:
If you're not rooted then there's no way to do so. If you are rooted however, it's pretty easy. Reply to me if you want to know how.
Click to expand...
Click to collapse
I want for sure, maybe I'll root because of it
TY

paolobacci said:
I want for sure, maybe I'll root because of it
TY
Click to expand...
Click to collapse
THis only works if you are rooted, as I stated before.
I'm pretty sure you have to this:
With root access,
1. go to /system/fonts
2. rename NotoColorEmoji.ttf to anythign you'd like(lika a backup of it)
3. rename AndroidEmoji.ttf to NotoColorEmoji.tff
4. reboot
That SHOULD do the trick. I'm more used to changing the emoji to apple's Emoji to match them with Whatsapp.

guetzli32 said:
THis only works if you are rooted, as I stated before.
I'm pretty sure you have to this:
With root access,
1. go to /system/fonts
2. rename NotoColorEmoji.ttf to anythign you'd like(lika a backup of it)
3. rename AndroidEmoji.ttf to NotoColorEmoji.tff
4. reboot
That SHOULD do the trick. I'm more used to changing the emoji to apple's Emoji to match them with Whatsapp.
Click to expand...
Click to collapse
How do I go about getting the apple Emojis?

blackguy101 said:
How do I go about getting the apple Emojis?
Click to expand...
Click to collapse
Grab AppleColorEmoji.ttf and place it into /system/fonts/
Set /system/fonts/AppleColorEmoji.ttf to have permissions 644 (rw-r--r--) and owner:root group:root.
then do the process mentioned above, but use AppleColorEmoji instead of AndroidEmoji.
Also, right now there's no reason not to root, since towelroot doesn't trip the Knox Counter. That way, you keep your warranty and also have the benefits of a rooted phone. (Don't quote me on that, that's at least what I read )

guetzli32 said:
Grab AppleColorEmoji.ttf and place it into /system/fonts/
Set /system/fonts/AppleColorEmoji.ttf to have permissions 644 (rw-r--r--) and owner:root group:root.
then do the process mentioned above, but use AppleColorEmoji instead of AndroidEmoji.
Also, right now there's no reason not to root, since towelroot doesn't trip the Knox Counter. That way, you keep your warranty and also have the benefits of a rooted phone. (Don't quote me on that, that's at least what I read )
Click to expand...
Click to collapse
Is it possible if you can link the apple color emoji file again because the link is dead :/

Renaming the Android didn't do the trick.
I got only a few emoticons to choose.
I just did the root with towel root but I tried before with cf auto root and I'm waiting for a solution to reset knoxx counter back to 0.

This didn't seem to work at all. Anyone else have an idea? Samsungs emoji's are terrible.