An Android Virus That Can Re-Install Itself

Even Factory Reset Can't Remove This Virus. Check If Your Phone Is Safe.

Cybersecurity experts have noticed the growth of the new xHelper Trojan on Android devices. xHelper can get to the device when downloading applications, but when they are deleted, it will continue to be active. This malware was first noticed by specialists last year around spring.

According to Symantec, the xHelper malware infects an average of 131 devices per day and about 2,400 devices per month. And this infection is said to be found more in India, the USA, and Russia.

According to researchers, the main source of infections are redirects and suspicious sites that redirect users to pages with Android applications. Such sites instruct the user in detail how to download applications (the .apk setup files), not from Google Play, and the code is hidden in the applications which ultimately leads to the loading of xHelper.

Can You Uninstall It?

Unfortunately, uninstalling xHelper is not possible because it installs itself as a separate standalone service. As per the reports, even if you try to do a factory reset on your phone the virus will still be there.

What Can This Trojan Do?

According to the reports this trojan currently displays intrusive pop-up ads and spam notifications. Typically, such ads and notifications lead users to the Play Store, where they are invited to install other applications  - a means by which xHelper attackers earn money from the commission with payment for the installation.

But this virus app also has some other, much more dangerous functions for e.g., it can download and install other applications by itself. So the xHelper malware team can use this function at any time to deploy second-level malware, such as Ransomware, Banking Trojans, DDoS Bots, or Password Theft and what not.

Since it installs itself as a standalone offline service. So, removing the original application will not remove xHelper, and the trojan will continue to work on victims' devices, continuing to display pop-ups and spam notifications.

Some users who had encountered this malware said that ads constantly appear on the screen, and memory also gets shrink. They also reported that even after when they uninstalled the xHelper app and then uncheck the 'Install applications from unknown sources' option, this setting continued to turn on again and the device was re-infected after cleaning.