How to uninstall a pre-installed malware as a default & only launcher app in your Android-phone, and install "Nova Launcher"

Sometime people find pre-installed malware in their Android-phone. Malwares record sounds around your phone and send them to servers that were rent by the malware creators or their clients(Reference). If your phone always connects some servers automatically and you can't identify the cause of the matter, you should doubt a pre-installed launcher app.

Now, if there is no abnormality in your smartphone, see the [1]Normal Course. Now, on your smartphone "because the problem has occurred, exit the Launcher" dialog box is displayed, and you can't press the home button, see [2]Abnormal Course

[1]Normal Course

(1) By using your Android-phone, sign in "Google Play Store" and install "Nova Launcher" and "Google Now Launcher" into your Android-phone.

• Because you won't be able to use your Android-phone when you change the mode into "safe mode", you HAVE TO install "Google Now Launcher", which is Google's official launcher app.

(2) If (1)'s 2 apps are completely installed, open "Settings > Home", and change from the launcher app to "Google Now Launcher".

(3) Press and hold the power button on your Android-phone, then, display "Power off/Reboot/Airplane mode" menu, and, long-tap "Power off", and choose "Reboot to safe mode" and tap "OK".

(4) Your Android-phone reboots in safe mode, then, "safe mode" is displayed at the lower-left of the window. Now, you can see "Google Now Launcher".

• Can't you see "Google Now Launcher"? Is the "select box" of launcher is displayed? Then, choose "Google Now Launcher".

(5) Open "Settings > Apps" and press the vertical buttons with 3 points vertically in the upper-right to display "Show system". Then, search the text of "Launcher" other than "Google Now Launcher" and "Nova Launcher". If you can search any launcher-app(s) other than "Google Now Launcher" and "Nova Launcher", force stop it/them, then, uninstall it/them.

If you are using a rooted device, do the pink-background-steps (6)-(9).

(10) At "Settings > Home", change from "Google Now Launcher" to "Nova Launcher".

(11) Reboot your Android-phone.

(12) Now, you can see "Nova Launcher".

• Can't you see "Nova Launcher"? Is the "select box" of launcher is displayed? Then, choose "Nova Launcher".

[2]Abnormal Course

(1) Using other device (PC/Mac/smartphone), sign in "Google Play Store", and install "Nova Launcher" and "Google Now Launcher" to your 'abnormal' Android-phone.

• Because you won't be able to use your Android-phone when you change the mode into "safe-mode", you HAVE TO install "Google Now Launcher", which is Google's official launcher app.

(2) Press and hold the power button on your Android-phone, then, display "Power off/Reboot/Airplane mode" menu, and, long-tap "Power off", and choose "Reboot to safe mode" and tap "OK".

(3) Your Android-phone reboots in safe mode, then, "safe mode" is displayed at the lower-left of the window. Now, you can see "Google Now Launcher".

• Can't you see "Google Now Launcher"? Is the dialog box of "Set Launcher to 'Google Now Launcher'. Once Always" displayed? Then, tap "Always".

(4) Open "Settings > Apps" and press the vertical buttons with 3 points vertically in the upper-right to display "Show system". Then, search the text of "Launcher" other than "Google Now Launcher" and "Nova Launcher". If you can search any launcher-app(s) other than "Google Now Launcher" and "Nova Launcher", force stop it/them, then, uninstall it/them.

If you are using a rooted device, do the pink-background-steps (5)-(8).

(9) At "Settings > Home", change from "Google Now Launcher" to "Nova Launcher".

(10) Reboot your Android-phone.

(11) Now, you can see "Nova Launcher".

• Can't you see "Nova Launcher"? Is the "select box" of launcher is displayed? Then, choose "Nova Launcher".

Then, did the external connection that was bothering you stop?

If you rooted your Android-phone and run the way for the rooted-phone ( in the above flow's the pink-background-steps ), the external connection that is bothering you may stop.

Reference (Added Nov 18, 2021)

"Rooting Malware Makes a Comeback: Lookout Discovers Global Campaign"

Reference (Added May 21, 2022)

If it is still not stable, it may have a Trojan.

Please refer to the following two URLs

"China ELF botnet malware infection & distribution scheme unleashed"

"Case Study: How legitimate internet services like Amazon AWS, DropBox, Google Project/Code & ShortURL got abused to infect malware"

Reference (Added May 29, 2022)

See to the following three

Reference１: Article on the other site

Microsoft Finds Critical Bugs in Pre-Installed Apps on Millions of Android Devices

Reference２: What RL investigated

IP address that connects "Android System (UID1000)": 154.223.168.72 (Port 443, TCP)

• Condition: External connection has been stopped by the firewall.
• Result: There is no actual connection because it was stopped by the firewall.

Reference３: What RL investigated

IP address that connects when opening "Nova laucher Settings": 45.56.71.66 (Port 443, TCP)

• Condition: "Check for updates" function was stopped. External connection was stopped by the firewall.
• Result: There is no actual connection because it was stopped by the firewall.

Reference (Added Jul 4, 2022)

Reference: What RL investigated

IP address that connects "(UID1073)":119.63.197.139 (baidu.jp) (Port 443, TCP)

• Condition: External connection has been stopped by the firewall.
• Result: There is no actual connection because it was stopped by the firewall.

Reference (Added Aug 22, 2022)

See the Article on the Other Site

Article

"TheTruthSpy exposed: This spyware lookup tool says if your Android device was compromised"

Reference (Added May 15, 2023)

See the Article on the Other Site

Article

"Millions of Android Phones Comes Pre-Infected with Malware Firmware"

Quote

• 'The manufacturing of the gadgets is outsourced to an original equipment manufacturer (OEM). According to the researchers, this outsourcing makes it possible for someone in the manufacturing process, like a firmware provider, to infect devices as they are shipped out with malicious code. '
• （自動翻訳）
  'ガジェットの製造は、 相手先商標製品製造業者 (OEM) に委託されます。 ''このアウトソーシングにより、ファームウェア プロバイダーなどの製造プロセスに携わる者が、出荷されるデバイスに悪意のあるコードを感染させることが可能になります。 '
  by RainbowLinkInc ( 2023-05-15T17:12:23+09:00 ) ( 1658022501153382401 )
  https://twitter.com/RainbowLinkInc/status/1658022501153382401

参考>Reference (Added Feb 19, 2024)

See the Article on the Other Site

Article

"How Cops Can Secretly Track Your Phone"

• Translate(ja)