Apple Event: May 7th at 7 am PT

Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

another malicious app?

Hi guys,


Recently I noticed a background process titled “i派党-爱新闻”. I didn’t have any Chinese apps installed, so naturally thought it was odd. I did some research on it, and it turns out it’s the name of a Chinese news app. However I never downloaded it, so I’m starting to suspect that something malicious worked its way into one of the apps that I downloaded. Can someone help me?User uploaded file

iPhone 6, iOS 9.0.2

Posted on Oct 5, 2015 12:21 AM

Reply
14 replies

Oct 5, 2015 7:39 PM in response to Bluefishpro

To be honest, I have no faith in these battery reporting apps, as they tend to report things that are non-existent in devices. I've read of others. As you were told earlier, unless your phone is jailbroken, you cannot install anything on the phone. I'm betting it isn't even an application, but some process if it even exists, that this reporting app you are using is reporting.

Oct 5, 2015 8:07 PM in response to Bluefishpro

Buefish,


If you are unable to delete the app, you may have no choice but to do a full restore as per below:


Full Restore:


Please follow the instructions in the article below. The process is rather straight-forward as iTunes will guide you along the way. You will have to disable Find my iPhone/iPad first. Don't forget to set it back to On when you are through and also set Send Last Location to ON.


Connect your device to your computer. Then import all your photos from the device to the computer and copy all important documents directly to your computer as well. Then do a full backup to iTunes, just follow the instructions below. Then select Restore iPhone/iPad and iTunes will install a fresh copy of the current iOS and will erase all your data and settings. After iTunes has installed a fresh copy of the iOS, it will ask you if you want to set your device as New or restore from Backup. Choose From Backup. Restoring from backup will bring back all your Settings, Apps, Photos on Camera Roll, etc. You should not lose anything.


After completion check to see if works. There is a possibility that restoring from the backup may bring back the app corruption. If this occurs you would have to start over again, set it up as New and install all Apps manually (a time consuming process). You would also lose your photos and documents so it is important to back them up first as I mentioned above. I have done this procedure many times in the past and restored from backup with no difficulties - it takes 30-50 minutes.


https://support.apple.com/en-us/HT201252

Oct 5, 2015 8:55 PM in response to thunderzzz

Not entirely true. A Palo Alto company found some software that can can infect iPhones/iDevices without the device being jailbroken. The malware can change it's name and more to easily fool users.


The recommended steps to remove, if you think you are infected, are listed below, but this virus tends to be spread in China and Taiwan.


http://researchcenter.paloaltonetworks.com/2015/10/yispecter-first-ios-malware-a ttacks-non-jailbroken-ios-devices-by-abusing-private-apis/


"We recently identified a new Apple iOS malware and named it YiSpecter. YiSpecter is different from previously seen iOS malware in that it attacks both jailbroken and non-jailbroken iOS devices through unique and harmful malicious behaviors. Specifically, it’s the first malware we’ve seen in the wild that abuses private APIs in the iOS system to implement malicious functionalities."


"On infected iOS devices, YiSpecter can download, install and launch arbitrary iOS apps, replace existing apps with those it downloads, hijack other apps’ execution to display advertisements, change Safari’s default search engine, bookmarks and opened pages, and upload device information to the C2 server. According to victims’ reports, all these behaviors have been exhibited in YiSpecter attacks in the past few months. Some other characteristics about this malware include:"


"The world where only jailbroken iOS devices were threatened by malware is a thing of the past. WireLurker proved that non-jailbroken iOS devices can also be infected through abuse of the enterprise distribution mechanism. YiSpecter further shows us that this technique is being used to infect many iOS devices in the wild."


"For iOS users that are potentially infected by YiSpecter, we suggest removing it with the following steps:

  1. In iOS, go to Settings -> General -> Profiles to remove all unknown or untrusted profiles;
  2. If there’s any installed apps named “情涩播放器”, “快播私密版” or “快播0”, delete them;
  3. Use any third-party iOS management tool (e.g., iFunBox, though note that Apple’s iTunes doesn’t work in this step) on Windows or Mac OS X, to connect with your iPhone or iPad;
  4. In the management tool, check all installed iOS apps; if there’re some apps have name like Phone, Weather, Game Center, Passbook, Notes, or Cydia, delete them. (Note that this step won’t affect original system apps but just delete faked malware.)


Our primary security suggestion to avoid being affected by this kind iOS malware was, is and remains this: never download iOS apps from any untrusted sources, and never trust unknown developers. You should always download iOS apps from the official App Store for personal use, or download your company or organization’s internal app under your IT department’s guidance. Consider that even apps from the App Store can also abuse private APIs for harmful operations, and that these security habits won’t prevent all similar attacks but should prevent most of them. We have also made suggestions to Apple for improving their code review procedures and urged them to improve iOS security mechanisms to defeat these potential security problems."

Oct 7, 2015 4:25 AM in response to sswimmer

Hi sswimmer, if you are unable to delete the app try a forced restart first and then try deleting it. Hold down the Home and Wake/Sleep buttons at the same time for about 15-20 seconds until the Apple logo appears. Ignore the "Slide to power off" text if it comes up. You will not lose anything.


If that does not work you may have to follow through with a full restore as I recommended to Bluefish above. Good luck...

Oct 7, 2015 12:02 PM in response to bulldogz20

Apple responded to that information and it had been addressed in iOS 8.4, so I'm not sure it is exactly a problem. As I said earlier, many of these battery management apps display unusual things that don't really appear to be on people's phones and are at times a process of the management app itself.


http://www.macrumors.com/2015/10/05/apple-yispecter-malware-fix-ios-8-4/

Nov 4, 2015 12:33 PM in response to Bluefishpro

Hello! Omg, I'm having the exact same problem! And I discovered it via Battery Doctor too--maybe there's a bug on that app?? My phone isn't jailbroken either. I'm freaking out, I only got it a month ago.


EDIT: I only have one profile, from Battery Doctor, which is the "One-Tap Boost" and I manually did it. Also, I found nothing in the iFunBox program :3

Nov 4, 2015 1:21 PM in response to Bluefishpro

As ChrisJ said above, it is a process of the app and/or is a false display of processes. It's funny, though, because there is such an app that exists. (re: http://forums.macrumors.com/threads/is-my-iphone-infected-with-malware-please-he lp.1918693/page-2

But my friend just downloaded it and she isn't getting that "process". I would have thought that this "process" was added to the latest update of the app, but she has the latest version yet that thing doesn't appear on hers.

another malicious app?

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple ID.