{"id":2808,"date":"2015-12-14T16:10:32","date_gmt":"2015-12-14T15:10:32","guid":{"rendered":"http:\/\/blog.hovatek.com\/?p=2808"},"modified":"2022-08-15T22:12:48","modified_gmt":"2022-08-15T22:12:48","slug":"how-to-stop-malware-from-automatically-sending-sms-using-your-airtime-or-credit-on-your-android-phone","status":"publish","type":"post","link":"https:\/\/www.hovatek.com\/blog\/how-to-stop-malware-from-automatically-sending-sms-using-your-airtime-or-credit-on-your-android-phone\/","title":{"rendered":"How to stop malware from continually sending SMS on Android"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Its bad enough that our service providers debit our airtime at will, its even more alarming that malware have joined the race with a very aggressive strategy. Not too long ago, I discussed the<a href=\"https:\/\/www.hovatek.com\/blog\/how-to-remove-privacy-guard-easy-tool-monkey-test-and-time-service-malware-from-an-mtk-mediatek-android-phone\/\"> Time Service and Monkey Test Malware<\/a> .<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In that article, I explained how malware infect your Android phone, how to identify malware related activities and how to weed out the menace. Today, I&#8217;ll be taking you through another type of malware that also makes money off you, only in a more parasitic way.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">How does this automatic SMS sending malware work?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The malware requires an internet connection so you would often notice the automatic sending of SMS once data is enabled or you are connected to &nbsp;a Wireless network (WIFI). The malware sends the SMS (at regular intervals) to premium numbers and the hacker gets a cut of whatever you are charged.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Apart from malware, could there be any other reason why my Android phone keeps sending SMS to an unknown number?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Yes, quite a number. In some cases, its an error in your phone&#8217;s software. In this instance, the software is trying to register your phone by sending certain information to your service provider&#8217;s servers. The auto-sms bug could also be caused by installed apps, especially voicemail, SMS and call managers.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">On rear occasions, its caused by an error in your default SMS app causing it to resend an already sent SMS to the same number over and over.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">How do I stop my Android phone from automatically sending SMS?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Some fixes to consider include:<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Freeze \/ Delete GN_SalesStatistic and  GN_SalesTrack_GL  (for Gionee devices):<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">This fix is unique to Gionee users. For other brands, search for similar apps. To do this: <\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Root the phone (you could use <a href=\"https:\/\/www.hovatek.com\/forum\/thread-21427.html\">Magisk Manager + Boot.img<\/a> )<\/li><li>Install a root browser like ROM Toolbox Lite or ES File explorer from Playstore<\/li><li>Navigate to the system\/app folder<\/li><li>Locate GN_SalesStatistic and GN_SalesTrack_GL<\/li><li>Delete both apks.<\/li><li>If you prefer to freeze them then use Titanium backup or Greenify (from Play Store)<\/li><li>In the root browser, open the build .prop and delete <\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">ro.gn.oversea.brand.salestracka<br>ro.gn.oversea.brand.salestrackb<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Set ro.gn.salessttatistic.url to ro.gn.salessttatistic.url=0<\/li><\/ul>\n\n\n\n<figure class=\"wp-block-image is-resized\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/www.hovatek.com\/blog\/bpyeki\/uploads\/2019\/05\/Gionee-keeps-sending-text-sms-1.jpg\" alt=\"\" class=\"wp-image-6080\" width=\"306\" height=\"255\" srcset=\"https:\/\/www.hovatek.com\/blog\/bpyeki\/uploads\/2019\/05\/Gionee-keeps-sending-text-sms-1.jpg 691w, https:\/\/www.hovatek.com\/blog\/bpyeki\/uploads\/2019\/05\/Gionee-keeps-sending-text-sms-1-300x251.jpg 300w\" sizes=\"auto, (max-width: 306px) 100vw, 306px\" \/><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\">Do a factory reset<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">You could do a factory reset in <a href=\"https:\/\/www.hovatek.com\/forum\/thread-479.html\">recovery mode<\/a> or under Settings &gt; Backup &amp; Reset<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Wipe then re-install firmware<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Depending on the Chipset the phone is running on, wipe the phone then re-install the stock ROM \/ firmware (or a different one). Mediatek uses <a href=\"https:\/\/www.hovatek.com\/forum\/thread-159.html\">SP flash tool<\/a> , Spreadtrum uses <a href=\"https:\/\/www.hovatek.com\/forum\/thread-1231.html\ufeff\">Upgrade Download tool<\/a> and Qualcomm uses <a href=\"https:\/\/www.hovatek.com\/forum\/thread-22466.html\">QFIL<\/a> .<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Uninstall suspicious apps:<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Uninstall suspicious and newly installed applications as the problem could be coming from an app. Its best to do this with a system app uninstaller and root access.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Run a malware \/ virus scan:<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Install a good antivirus like 360 security&nbsp;, Stopbadapp&nbsp;, AVG&nbsp;, Ghost Push Trojan Killer, Avast&nbsp;or Malwarebytes&nbsp;and scan the phone.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Its bad enough that our service providers debit our airtime at will, its even more alarming that malware have joined the race with a very aggressive strategy. Not too long ago, I discussed the Time Service and Monkey Test Malware . In that article, I explained how malware infect your Android phone, how to identify [&hellip;]<\/p>\n","protected":false},"author":5,"featured_media":2798,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[818],"tags":[737,735,736],"class_list":["post-2808","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-tutorials","tag-auto-sending-sms","tag-gn_salesstatistic","tag-gn_salestrack_gl"],"_links":{"self":[{"href":"https:\/\/www.hovatek.com\/blog\/wp-json\/wp\/v2\/posts\/2808","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.hovatek.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hovatek.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hovatek.com\/blog\/wp-json\/wp\/v2\/users\/5"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hovatek.com\/blog\/wp-json\/wp\/v2\/comments?post=2808"}],"version-history":[{"count":0,"href":"https:\/\/www.hovatek.com\/blog\/wp-json\/wp\/v2\/posts\/2808\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.hovatek.com\/blog\/wp-json\/wp\/v2\/media?parent=2808"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hovatek.com\/blog\/wp-json\/wp\/v2\/categories?post=2808"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hovatek.com\/blog\/wp-json\/wp\/v2\/tags?post=2808"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}