Android has been constantly haunted by new malware, however, the latest discovery leaves us a little concerned. Named xHelper, this piece of malicious software can persist on a smartphone even after a factory reset.

The discovery was made by the security company Malwarebytes for the first time in 2019. xHelper came back to this company’s attention in January 2020, after new reports of its harm began to emerge.

xHelper is using the Play Store to stay on affected devices

When we have a smartphone infected with malware, the most drastic and, supposedly, the most effective measure we can take is to restore your factory data. This process eliminates all smartphone content, leaving only the software with which the equipment is sent to stores.

Android malware

However, as Malwarebytes advances, xHelper is using the Play Store as a smokescreen to stay on infected equipment. The security company does not believe that the app store is really the source of these reinstallations. It is just a way of defrauding Android’s defense systems.

At no time is the security of the Google app store jeopardized. This remains the most reliable source you have at your disposal to install applications on your smartphone.

This malware can install other malicious programs without your knowledge

Malwarebytes’ findings document that xHelper can be the gateway to more malware on your smartphone. In addition to installing itself, it can download and install other infected programs.

As if that were not enough, xHelper floods your smartphone with advertisements. According to what is said, they can even make the equipment almost unusable.

Symantec, another well-known security company, says that this malware is more prevalent in the US and Russia. In these markets, it is estimated that there are already more than 45 thousand devices infected by xHelper.

How to remove xHelper from your smartphone once and for all

In view of these reports, it may seem impossible to remove this malware once installed on a device. Fortunately, this is not the case and Malwarebytes has a solution for that.

  • Malwarebytes recommends installing its free Android application for the main part of malware removal (you may also be able to use other anti-malware applications, but we’re not sure)
  • Install a file manager of your choice from the Play Store
  • Temporarily disable the Play Store by going to Settings – Apps – Google Play Store
  • Run a scan on the Malwarebytes application to remove xHelper and other malware, or manually search for names like fireway, xHelper and Definitions (only if two Definitions applications are displayed)
  • Open the File Manager and search for files starting with com.mufc
  • If found, write down the date of the last modification (you can filter by date to find information more easily)
  • Eliminates anything starting with com.mufc as well as anything from the same date (except main directories, like Download or others)
  • Reactivates the Play Store

These steps should solve the problem, however, if it was not the case you can always contact Malwarebytes support on the matter.

EBox editors recommend: