3

I have root access in my device, but there is a malware in /system/app/ that I can't delete. This malware installs TimeService, MonkeyTest, and also some other apps like DR battery and privacy guard, and also shows ads.

I'm using ADB shell & I have tried Root Explorer in Android. Dr.Web also can't delete it. When I tried to delete without root access, it gives the following error message:

rm failed for <filename>, Permission denied

With root access, I got the following error:

rm failed for <filename>, Operation not permitted

Is there a Linux command to delete this kind of files? Should I install BusyBox first?

operation note permited

Andrew T.
  • 15,988
  • 10
  • 74
  • 123
sajad
  • 133
  • 1
  • 3
  • An alternative is to boot into custom Recovery and then delete it. It would work. Though how did you find out that OEM shipped app is a malware causing all the other malware installation? – Firelord Aug 28 '15 at 09:22
  • it's package name is android.backdoor183 oO – sajad Aug 28 '15 at 09:50
  • i can remove all system files except this file – sajad Aug 28 '15 at 10:04

1 Answers1

3

Most likely this files attribute is set to "immutable". Which means nobody will be able to edit, rename, move or delete it. (Not even root)

You can check this in linux with the command: lsattr file

If this output shows an "i" my assumption is right.

The immutable attribute can be removed by chattr -i file. After doing this you should be able to delete this file as root again.

As far as I know the android toolbox does not include these binaries. You need to cross compile(your device is ARM based?) busybox for your device and take care that both binaries are included or take a prebuilt busybox binary from a trusted source which includes them.

divided-by-zero
  • 982
  • 6
  • 16