Spam publicity virus (hidden as Settings) com.chunmei.calculator

[jg2874]

Hello
Since this friday, I have some problems with my cell phone. Every 30 minutes I see a disturbing message, full screen, showing publicity, with a countdown... it is clear I have been infected by a spyware, the problem is I am unable to remove it.
I see there is a suspicious Settings application, that is different to the one coming with my device. I can uninstall this app, however, 30 minutes later, the app, magically, reinstall itself.
I did a virus scan, and it was detected a malware called com.chunmei.calculator
The thing is I cannot get rid off this "Settings" app, that reinstall, even if I uninstall it.
Should I have to reset to the factory settings the cell phone?
I have an Adroid 6.0 and I do not see any option to restart it as factory default?
Or should I clean this in anyway?
I tried Kaspersky, don't work, Malwarebytes, don't work... and now I tried AVG, it detects this "crap" sorry, but don't clean it.

Just to add: It was identified as: Android/AVT.RepMetagen

 

[Elijah_G]

Im having exactly the same issue on my Nomu S10 thats running Android version 6.0.1
I did a factory rest but it didn't fix the issue as the spam app just reinstalled itself

 

[lunatic59]

Unfortunately, if you have a device where the malware infection is part of the system, there's not a lot you can do, unless your device is rootable.

 

[Deleted User]

Just for my information, how would this malware have gotten on to the device, and what steps should be taken to prevent it?
It does concern me, as my Nexus 5 is EOL now and doesn't receive any security updates.

 

[lunatic59]

Over the years we've seen many instances of off-brand or import phones come out of the box either with malware already installed as part of the system or rooted from day one, so root exploits can install to the system partition with impunity. Before Marshmallow, there were even apps that could take advantage of know root exploits to install their malicious components as part of the system, but that's not been an issue since.

On of the advantages of making rooting more difficult makes this sort of intrusion less likely.

 

[Deleted User]

Looks like the ZTE guys have the right idea then, with locking down the Zmax Pro

 

[jg2874]

My phone was working fine and the maker did not install any kind of malware in it. I want to clarify this, because I was using the phone 7 months without problems. What Elijah_G said worry me, because he did a factory reset, and the malware problem continue.
I am going to do a factory reset this saturday, and if I continue with this, I think I will die.

Elijah_G? When was the first time you experienced this problem? Do you remember the exact day?

All Android phones are like laptops. The same as laptops, Android phones have a partition with the Operating System to restore it as it was by default, coming from the factory. This happen also with laptops. They have the Windows in a partition inside the hard disk, so you can restore the factory settings in case of virus, etc. Okay.

QUESTION: Could be possible a malware infect the phone, and also attack the factory partition with the operating system, to infect, also, the factory partition and make all the factory resets apply the publicity? In such case, what option could be possible, to download a clean firmware from the maker and install it from scratch?

And the second thing is... what the hell is (I am sorry) com.chunmei.calculator! The chunmei thing seems to come from a Chinesse restaurant or something like that.

The thing is, we have identified the virus: Android/AVT.RepMetagen

RepMetagen seems to explain the behaviour, you uninstall the app, it reinstalls again. RepMetagen, REPlicate.

How is it possible any single antivirus for Android be able to scan and clean a well identified virus, like this one?
Any antivirus is able to deal with the Android/AVT.RepMetagen?

Cheers

 

[lunatic59]

My phone was working fine and the maker did not install any kind of malware in it.

This could be an instance of a recently installed app being infected with malware that was given permission to install apps as root. It's hard to tell without actually examining your phone. To make troubleshooting easier, what make and model is the phone? And, what version of Android is it running?

I am going to do a factory reset this saturday,

If the offending app is installed in the system partition, then a factory reset won't help.

The same as laptops, Android phones have a partition with the Operating System to restore it as it was by default, coming from the factory.

No, that's not quite the case. While it's true that the system partition is separate from the user data partition, and is protected (for the most part), what you are thinking of is a recovery partition on laptops/desktops where you can reimage a hard disk as if it were brand new. That is analogous to flashing the stock firmware on an android device. Factory resets simply wipe the user data from the device and allow you start fresh. And modifications to the system partition will remain, such as version updates, security patches and root apps.

And the second thing is... what the hell is (I am sorry) com.chunmei.calculator!

As far as I can see it's a calculator app from China. It does have network access permissions, but that would make sense if it was ad supported. Now, if the app was downloaded from somewhere other than the play store, then it could have had malicious code inserted into it.

The only truly safe way to fix this is to get the original firmware from the phone manufacturer and flash it to the device, which is a complete wipe of everything currently on your phone.

 

[jg2874]

Let's pray I don't have to flash the device my God.
Is that very difficult to do?
My phone is a Leotec Titanium Print, is a Spanish brand, and the Android is 6.0
I really don't know how that stupid calculator entered inside my phone because I don't remember to have installed it.

 

[lunatic59]

Is that very difficult to do?

Unfortunately most searches for your device are in Spanish (naturally) but it's one language I have never mastered.

While it can be tricky, flashing factory firmware is something a good shop should be able to do for you for a nominal fee, if you don't feel confident enough to try.

 

[Elijah_G]

My phone was working fine and the maker did not install any kind of malware in it. I want to clarify this, because I was using the phone 7 months without problems. What Elijah_G said worry me, because he did a factory reset, and the malware problem continue.
I am going to do a factory reset this saturday, and if I continue with this, I think I will die.

Elijah_G? When was the first time you experienced this problem? Do you remember the exact day?

All Android phones are like laptops. The same as laptops, Android phones have a partition with the Operating System to restore it as it was by default, coming from the factory. This happen also with laptops. They have the Windows in a partition inside the hard disk, so you can restore the factory settings in case of virus, etc. Okay.

QUESTION: Could be possible a malware infect the phone, and also attack the factory partition with the operating system, to infect, also, the factory partition and make all the factory resets apply the publicity? In such case, what option could be possible, to download a clean firmware from the maker and install it from scratch?

And the second thing is... what the hell is (I am sorry) com.chunmei.calculator! The chunmei thing seems to come from a Chinesse restaurant or something like that.

The thing is, we have identified the virus: Android/AVT.RepMetagen

RepMetagen seems to explain the behaviour, you uninstall the app, it reinstalls again. RepMetagen, REPlicate.

How is it possible any single antivirus for Android be able to scan and clean a well identified virus, like this one?
Any antivirus is able to deal with the Android/AVT.RepMetagen?

Cheers

I've been having having this issue since April the 25th
The malicious settings app was initially being installed from com.petsfamily what ever that is and last week it changed to com.chunmei.calculator and went from a medium threat to a high threat according to my McAfee phone security app.
I managed to find all the com.pets files and remove them but in 15 mins they were back.
I can force stop and remove all permissions but that only lasts a few hours before it's updated itself.

Maybe I need to ask Mrs Clinton for some advice on deleting files although she'll probably just blame the Russians.

 

[jg2874]

Chunmei sounds to Chinesse more than Russian, but it's the same this is a nightmare.
Leotec allow to download the firmware in a ZIP file 909 MB
Is very difficult to flash the device? I mean, what do I need?
I download the firmware... I have the ZIP file and now what?
How do I make the phone get the firmware? should I connect the phone to the PC?
Probably the best solution for Elijah_G and me is to flash the device (I guess this is a hard reset).
So what's next please?

 

[lunatic59]

Leotec would be the best place to get the proper method to reflash the firmware. Every device is going to be a little different and some require a specific tool to do it.

What you will need is most likely a PC and the proper drivers to connect to it in download or fastboot mode.

 

[darkjoscha]

hi,

i have the same problem with the "chunmei" - app...

i can frezze it i can deinstall it... a i keeps on coming back.

my nomu s20 is rooted... if thats helps to find a fix..

 

[Spec2nirvash]

hi,
i have the same problem with the 'chunmei' - app...
i can frezze it i can deinstall it... a i keeps on coming back.
my nomu s20 is rooted... if thats helps to find a fix..

Being rooted is probably why its in there to begin with.

 

[Spec2nirvash]

LV426
Looks like the ZTE guys have the right idea then, with locking down the Zmax Pro




That was a bad idea, but a job well done by them seeing as nobody broke into it, just yet. If not for the horrible UI, theming and CPU management programs running, I feel it wouldn't need root.

I feel the recent slew of 6/8 core CPU devices are as good as a marketing gimmick. Two different devices of mine (zmax pro and Kyocera Duraforce Pro) are octo-core and they are so bloody unstable right OTB because the manufacturer's CPU management programming pretty much cripple them and, compounded with Android's doze/optimization, makes them almost completely useless without root, which we CAN'T get at all.

I keep going back to my Nexus 5 because nothing I buy can outperform it.

 

[Piworzuop]

Hi there.
I'm having the com.chunmei.calculator in Settings app problems with my NOMU S10 for a couple of days. The problem is detected by all major antyvir apps: NORTON, McAFFE, AVG and BitDeffender. They all uninstall it but it reinstalls itself somehow.
The phone wasn't rooted. I've installed only apps from the Google store. The funny fing is that before I delete the malware it (again) it is visible in my Google Store as chunmei.calculator installed on my device as I had downloaded it by myself (but never did).
The only thing I recollect suspicious is that a week or two ago the system of my android updated by firmware (S10) software (date of system safety updates: march 2017). My operating system is 6.0.1.
I wondered if restoring the factory settings could help but according to what Elijah_G claims it probably won't.
Could anyone suggest the most intrusive solution? Or any sensible at least.

 

[mikedt]

Quite frankly I think this Nomu S10 might have actually come with chunmei baked into its firmware ROM. Nomu is only some trading company, and the actual device manufacturer is unknown.

Maybe worth trying to contact them about it, by email, webform or mobile phone numbers.
http://nomu.hk/contact

EDIT:

I suspect it's same problem with the "Spanish" Leotec phone, that also comes from an unknown Chinese manufacturer. Leotec are just some importer in Barcelona.

 

[TaeWon Kim]

1. don't insert USIM card.
2. format NOMU S20 with bootloader.
3. flush ROM(official version) with flush tool.
4. change the USIM card to new one.

 

[Max420]

Having the same problem with my Nomu S10...it got infected by a public WiFi portal in mid june. Same issue can't seem to remove it.

I've been having having this issue since April the 25th
The malicious settings app was initially being installed from com.petsfamily what ever that is and last week it changed to com.chunmei.calculator and went from a medium threat to a high threat according to my McAfee phone security app.
I managed to find all the com.pets files and remove them but in 15 mins they were back.
I can force stop and remove all permissions but that only lasts a few hours before it's updated itself.

Maybe I need to ask Mrs Clinton for some advice on deleting files although she'll probably just blame the Russians.

 

[Max420]

Did you ever find a solution?

My phone was working fine and the maker did not install any kind of malware in it. I want to clarify this, because I was using the phone 7 months without problems. What Elijah_G said worry me, because he did a factory reset, and the malware problem continue.
I am going to do a factory reset this saturday, and if I continue with this, I think I will die.

Elijah_G? When was the first time you experienced this problem? Do you remember the exact day?

All Android phones are like laptops. The same as laptops, Android phones have a partition with the Operating System to restore it as it was by default, coming from the factory. This happen also with laptops. They have the Windows in a partition inside the hard disk, so you can restore the factory settings in case of virus, etc. Okay.

QUESTION: Could be possible a malware infect the phone, and also attack the factory partition with the operating system, to infect, also, the factory partition and make all the factory resets apply the publicity? In such case, what option could be possible, to download a clean firmware from the maker and install it from scratch?

And the second thing is... what the hell is (I am sorry) com.chunmei.calculator! The chunmei thing seems to come from a Chinesse restaurant or something like that.

The thing is, we have identified the virus: Android/AVT.RepMetagen

RepMetagen seems to explain the behaviour, you uninstall the app, it reinstalls again. RepMetagen, REPlicate.

How is it possible any single antivirus for Android be able to scan and clean a well identified virus, like this one?
Any antivirus is able to deal with the Android/AVT.RepMetagen?

Cheers

 

[darkjoscha]

i found a solution wich seems to work so far...

1. disable automated updates
2. freeze/disable the "com.chunmei.calculator" app

 

[Piworzuop]

i found a solution wich seems to work so far...

1. disable automated updates
2. freeze/disable the "com.chunmei.calculator" app

I've tried it but doesn't seem to work for me. To clarify I've tried these solutions for my NOMU S10 so far:
1. I've flashed to the stock ROM.
2. I've rooted my phone to gain access to root folders.
3. I've disabled the com.chunmei.calculato app via "package disabler" app.
4. I've turned off the automatic google play updates (as well as the updates offered by NOMU).

After all of this it seems that after a few days at most and rebooting my phone the shitapp comes back over and over again.
I wonder if there is any tracking app, which could tell what on earth in my software installs it again and again.
As far I'm 100% convienced that the malware comes with the NOMU stock ROM.
I'm leaning towards installing some other's company ROM or some custom ROM.
Could anyone recomend some custom multipurpose ROM with Marshmallow? So far I've found a recommendation to install ARCOS 50 Saphire ROM but I would prefer installing some custom one if anybody could recommend something good...

 

[War Irf]

The answer for S10 is to use that clean Arcos 50 ROM. The answer to S20 is more complicated as there is no easy alternative ROM and Over The Air (OTA) updates do not work with the settings and that above mentioned calulator app being infected. I contacted Nomu Tech support (got their email from their web page) and got a link for the updated ROM from them. Then I manually flashed it to the phone. That was just today, but so far it has stayed uninfected. I will keep on checking the situation. The manual flashing was not simple as ADB gave me pain as did fastboot so it is definitely not a every-man-job. I would suggest contacting your retailer and sending back the phone for them to fix as the best solution unless you can do the flashing yourself. A phone infected in factory with a trojan is not a valid product and is well within your rights to require the retailer to sort it out either with a clean replacement or sending it to manufacturer for fixing.

 

[Piworzuop]

Well. I've installed the ARCHOS 50 ROM. It seems to work quite well, but still I can see some differences. To be honest I really think, that the orignal S10 ROM was much better (except the com.chunmei.calculator malware embeded). The phone seems to use battery about 25% faster and there are some important features missing like "double tap wake" (system setting). I wonder if they will ever update the software of NOMU S10 without the malware. If anyone knows, please let me know as I would gladly get back to the stock ROM. As for now I have to face quite a dramatic choice: to use the apparently worse ARCHOS rom or to use the stock one and live with the malware alongside...