Removing Malware That Uses Accessibility to Prevent Uninstallation

Product / Version includes:

Trend Vision OneAll , Mobile Security For EnterpriseAll

Last updated: 2023/03/10

Solution ID: KA-0014028

Category: Configure , Troubleshoot

Summary

For reference: TgToxic Malware’s Automated Framework Targets Southeast Asia Android Users

There's a kind of malware such as AndroidOS_SpyNote.GCLX which uses accessibility (Build accessible apps | Android Developers) to prevent itself from uninstallation.

This kind of malware infects Android devices.

Accessibility services on Android devices and apps are intended to help users with disabilities navigate their devices. These services operate in the background and receive callbacks from the system when AccessibilityEvents occur. These events denote some state transition in the user interface, such as when the focus changes or a button is clicked, etc. In some cases, these services can also request permission to view the contents of the active window.

However, the malware is designed to make use of the accessibility services. Here are some specific tactics the malware may use:

Monitor System Settings
- If the user attempts to uninstall the malware and reaches the Uninstall Page, the malware may use accessibility to click Cancel or Back, preventing the user from completing the uninstallation process.
- If the user attempts to view the App Detail Page for the malware, the malware may use accessibility to click Back, preventing the user from uninstalling or force stopping the malware.
- If the user attempts to disable the malware's accessibility, the malware may use accessibility to click Back, preventing the user from disabling the service.

Trend Micro Mobile Security is capable of detecting the malware and notifying the user to uninstall it before it is activated.

Action

Uninstall the malware detected by Trend Micro Mobile Security for best results.
However, if the malware has acquired accessibility, Trend Micro Mobile Security could not uninstall it.

If you encounter this issue, try the following method to uninstall the malware:

How to Uninstall

If the virus has acquired accessibility, the malware could not be uninstalled in "Normal Mode". You should enter the device in "Safe Mode" or "Development Mode" and then uninstall it.

The following steps show the uninstallation method needed if the malware has already acquired accessibility:

Safe Mode

Different devices have different methods for entering Safe Mode. Below are instructions for entering Safe Mode on various devices:

Pixel, Samsung, and etc.:

Press and hold the Power Button until a page appears.

^{Click the image to enlarge.}

^{Click the image to enlarge.}
Long press the Power off button on the Page.

^{Click the image to enlarge.}

^{Click the image to enlarge.}
Click OK or Safe mode icon to enter Safe Mode.

One plus, etc.:

Power off all the device and then power it back on.
Long-press the Volume + button when the manufacturer logo appears and hold until the login page appears.

Mi, etc.:

Power off all the device and then power it back on.
Long-press the Volume + button when the manufacturer logo appears and hold until the login page appears.
Use the Volume +/- button to select "Safe Mode" and use the Power button as the click button.

If your device is in Safe Mode, you should see a string "Safe Mode" on the bottom left of your screen.
The method to enter Safe mode may vary depending on your device, and some devices may not have the option available.

Uninstalling in Safe Mode

In Safe mode, enter "Settings - Apps", find the malware and uninstall it.

The malware may hide its icon, so you may not be able to find it on the Launcher.
After uninstalling the malware, reboot the device. It will return to Normal mode.

Development Mode

Below are instructions for entering Development Mode:

Enter "Settings - About phone".

^{Click the image to enlarge.}
Find the "Build number" (may be in "Software information").

^{Click the image to enlarge.}
Click the Build number more than 5 times.
Go back to "Settings" and find "Developer options" (you can use the search function).
Enter Developer options and turn on USB debugging.

^{Click the image to enlarge.}
Connect the device to a PC using a data cable and allow debugging on the device.

^{Click the image to enlarge.}

Use the adb tool. If you don't have it installed, you can download it from the Android Developer Center (Download Android Studio & App Tools - Android Developers).
1. You can download and install Android Studio or the Command Line Tools.
2. Open the Terminal, and use the following cmd:
  - To list all third-party (3rd) packages:
    adb shell pm list packages -3
  - To list all:
    adb shell pm list packages
  - To find the malware package name and then use the following command to uninstall it:
    adb uninstall <packagename>
    For example, adb uninstall com.gzrtnq.Bumble.
Turn off "Developer options" after uninstallation if you do not need it anymore.

Was this article helpful?

Featured

Automation Center

Education Portal

Online Help Center

Service Status

TrendConnect

Removing Malware That Uses Accessibility to Prevent Uninstallation

Action

How to Uninstall

Safe Mode

Uninstalling in Safe Mode

Development Mode

Removing Malware That Uses Accessibility to Prevent Uninstallation

Product / Version includes:

Summary

Action

How to Uninstall

Safe Mode

Uninstalling in Safe Mode

Development Mode