Sistema Android

[Milton_Villacis]

Note: Please do not post Personally Identifiable Information like email address, personal phone number, physical home address, product key etc.

Issue abstract:

Detailed description: Tengo un problema en mi telefono movil con sistema Android, que a cada momneto detecta una aplicacion mailiosa pero solo me da la opcion de desinstalar, una vez que lo hago la vuelve a detectar y asi suscesivamente, cuando lo que realmente deberia es evitar que se instale, o bloquearle de alguna forma. Alguien tiene la solucion??

Product & version number:

OS details:

What is the error message you are seeing?

If you have any supporting screenshots, please add them:

[bjm]

@Milton_Villacis

I have a problem with my Android phone. It keeps detecting a malicious app, but only gives me the option to uninstall it. Once I do, it detects it again, and so on. What it should really do is prevent it from installing in the first place, or block it somehow. Does anyone have a solution?

Hello @Milton_Villacis

If Norton keeps detecting the same malicious app after you uninstall it, that often means something else on the device is reinstalling it rather than the original app surviving the uninstall.

A few questions that may help narrow it down:

• Which Norton app are you using (Norton 360 or Norton Mobile Security), and what version?
• What Android phone model and Android version do you have?
• Does Norton identify the app by name, or provide a threat name?
• Was the app installed from the Google Play Store, or from another source (APK, third-party app store, etc.)?

If the app keeps coming back, check for things like:

• Another app with Device Administrator or Accessibility permissions that may be reinstalling it.
• A third-party app store or installer app.
• A work profile or device management app that automatically reinstalls applications.

In normal operation, Norton can detect and prompt you to remove malicious apps, but it generally cannot prevent every app from being installed in the first place because Android’s security model limits what third-party security apps can do. If we can identify the app that’s being detected, it may be possible to determine what’s causing it to reappear.

Could you tell us:

• What is your phone model and Android version?
• Which Norton app and version are you using?
• What is the name of the app Norton detects, or what threat name does it report?
• Was the app installed from Google Play or from another source (APK or third-party app store)?

That information will help determine why the app keeps being detected after you uninstall it.

AI sourced content may make mistakes

[Milton_Villacis]

• Telefono marca doogee modelo fire 3 pro, android version 15
• Norton 360 version 26.10.1.260610581
• Sistem Android is the name
• Se instala sola por lo que el origen es desconocido, aunque en la informacion de la misma indica que es de la tienda de google play

[bjm]

@Milton_Villacis

• Telefono marca doogee modelo fire 3 pro, android version 15
• Norton 360 version 26.10.1.260610581
• Sistem Android is the name
• Se instala sola por lo que el origen es desconocido, aunque en la informacion de la misma indica que es de la tienda de google play

• Phone: Doogee Fire 3 Pro
• Android: 15
• Norton 360: 26.10.1.260610581
• Detected app name: “System Android” (“Sistema Android”)
• It installs itself, and the source is unknown, although the app information says it is from Google Play.

A few thoughts:

• The fact that the detected app is called “System Android” is unusual. On a standard Android device, the Android system is a core component and should not be uninstalling and reinstalling itself.
• On the other hand, malware sometimes disguises itself with names like “Android System,” “System Update,” or similar to look legitimate.
• The OP’s statement that it “installs itself” but is shown as coming from Google Play is also suspicious. It could be a mislabeled source, a Play Protect-related component, a vendor customization, or malware masquerading as a system app.

I would not recommend Clear Data/Clear Cache or any other removal steps yet.
Instead, I’d ask for one more critical piece of information:

Could you post a screenshot of the Norton detection showing the threat name and the app details? Also, if you tap on the detected app in Android Settings, what is the package name (for example, com.android...)?

The package name is much more reliable than the displayed name. If it’s something like com.android.systemui or another standard Android package, that’s a very different situation than a fake package with a misleading display name.

I’d also be interested to see whether other forum contributors recognize this on Doogee devices. Some manufacturers preload components with localized names that can confuse security software, and it’s possible this could even be a false positive specific to that device. Until there’s more evidence, I’d avoid telling the OP to keep uninstalling what appears to be a “System Android” app.

1. A screenshot of the Norton detection.
2. The app’s package name (com...).
3. The threat name Norton reports.

If it turns out to be a false positive against a legitimate package, then escalating it to Norton (and, if possible, providing the APK for analysis) would make sense. Right now, there’s just not enough information to know what Norton is actually flagging.

AI sourced content may make mistakes

[SoulAsylum]

@bjm

System Android

@Milton_Villacis Have you ran a Google Play Store scan on your device?

AI Overview

Malware occasionally slips past Google Play’s security, commonly hiding in apps like QR code readers, document scanners, or keyboards. These malicious “dropper” apps download hidden payloads later to steal credentials or hijack accounts.

How to Check and Remove Malware

1. Run a Play Protect Scan:
** * Open the Google Play Store app.**
** * Tap your profile icon in the top right.**
** * Select Play Protect and tap Scan to check for harmful apps.**

2. Review Permissions: Check your app list for recent downloads with suspicious permissions (e.g., Accessibility access or SMS reading rights) and uninstall them.

3. Use Safe Mode: If the app resists deletion, restart your phone in Safe Mode to disable third-party apps, then uninstall the malware.

Visit the Google Support Guide for official, step-by-step instructions on securing your device and removing unsafe software.

SA

[bjm]

@SoulAsylum

Run a Play Protect Scan:

Running a Play Protect scan is a good additional check. It would also be helpful to see a screenshot of Norton’s detection, including the threat name and, if available, the app’s package name.

[SoulAsylum]

Indeed!!

[bjm]

@Milton_Villacis

• Doogee brand phone model fire 3 pro, android version 15
• Norton 360 version 26.10.1.260610581
• Android System is the name
• It installs itself, so its origin is unknown, although its information indicates that it is from the Google Play store.

In early 2023, there was a widespread Avast/AVG false positive where an app displayed as “Android System” was suddenly flagged as malware on many devices. Other scanners (such as Malwarebytes) came back clean, and AVG later acknowledged it was a false positive and disabled the detection.
https://www.reddit.com/r/AndroidQuestions/comments/1049y17/android_system_malware/

I use Avast Antivirus and Malwarebytes applications to scan my Samsung Galaxy Tab S7+ device (running on Android version 13) regularly to check if there is viruses/malware detected and always results to none.

Until today, January 6, 2023, my Avast Antivirus app has detected one malware program named “Android system” (Detection ID: 2f53b9400cea). The app says that this malware is installed in my device’s system partition and cannot be uninstalled, instead I must deactivate it through the Settings app. When I tried to uninstall/disable, there is no option.
https://support.google.com/android/thread/195996096/my-antivirus-app-detected-android-system-as-malware-is-it-true

Similar false positives involving apps displayed as “Android System” have occurred with other Android security products in the past. Before assuming this is malware or a false positive, it would be helpful to see the Norton detection details, including the threat name and the app’s package name.

============

Doogee is a Chinese smartphone manufacturer that focuses on budget and rugged phones. They’re legitimate, but they’re not a mainstream brand like Samsung, Google, Motorola, or OnePlus.

A few things about Doogee that are relevant here:

• They often ship heavily customized Android builds.
• They may include vendor-specific system apps and utilities.
• Their firmware and update cadence can differ from Google’s Pixel devices or Samsung’s One UI.
• Because of their smaller market share, security vendors may have less exposure to their custom system components, making false positives more plausible (though certainly not guaranteed).

Some Android devices from various manufacturers, particularly certain budget models, have been reported over the years to include unwanted software or, in isolated cases, malware embedded in the firmware. If malware is truly embedded in the system image, it may survive a factory reset and cannot always be removed by conventional antivirus software alone.

============

Malwarebytes Mobile Security free

— related pics —

Mobile Malware Removal Help & Support

============

DOOGEE S41T latest firmware laced with malware
https://www.reddit.com/r/chinaphones/comments/1uv5ybk/doogee_s41t_latest_firmware_laced_with_malware/

Warning: Suspicious background traffic on Doogee S118 Pro devices linked to specific firmware version
https://www.reddit.com/r/sysadmin/comments/1slzkh6/warning_suspicious_background_traffic_on_doogee/

There are recent user reports involving a different Doogee model alleging suspicious behavior after a firmware update. While that’s not evidence your device has the same issue, it does reinforce the need to identify exactly what Norton is detecting before drawing conclusions.

Regardless of whether OP report turns out to be:

• a false positive,
• a Doogee firmware issue,
• a malicious preinstalled app,
• or something masquerading as “Android System,”

it’s unlikely to be something the Community can resolve.

AI sourced content may make mistakes

[Milton_Villacis]

@bjm

• The fact that the detected app is called “System Android” is unusual. On a standard Android device, the Android system is a core component and should not be uninstalling and reinstalling itself.
• On the other hand, malware sometimes disguises itself with names like “Android System,” “System Update,” or similar to look legitimate.
• The OP’s statement that it “installs itself” but is shown as coming from Google Play is also suspicious. It could be a mislabeled source, a Play Protect-related component, a vendor customization, or malware masquerading as a system app.

I would not recommend Clear Data/Clear Cache or any other removal steps yet.
Instead, I’d ask for one more critical piece of information:

Could you post a screenshot of the Norton detection showing the threat name and the app details? Also, if you tap on the detected app in Android Settings, what is the package name (for example, com.android...)?

The package name is much more reliable than the displayed name. If it’s something like com.android.systemui or another standard Android package, that’s a very different situation than a fake package with a misleading display name.

I’d also be interested to see whether other forum contributors recognize this on Doogee devices. Some manufacturers preload components with localized names that can confuse security software, and it’s possible this could even be a false positive specific to that device. Until there’s more evidence, I’d avoid telling the OP to keep uninstalling what appears to be a “System Android” app.

1. A screenshot of the Norton detection.
2. The app’s package name (com...).
3. The threat name Norton reports.

If it turns out to be a false positive against a legitimate package, then escalating it to Norton (and, if possible, providing the APK for analysis) would make sense. Right now, there’s just not enough information to know what Norton is actually flagging.

thanks guru, but all done, and nothing resuts goods

[Milton_Villacis]

@bjm

It is

[bjm]

@Milton_Villacis

Software malicioso encontrado
Norton 360 detect6 una aplicaci6n maliciosa y le ayudarå a eliminarla.

Malicious software found
Norton 360 detected a malicious application and will help you remove it.

Hello @Milton_Villacis

• Norton is displaying a generic malware alert:
  • “Software malicioso encontrado” (“Malicious software found”)
• The app name shown is simply:
  • “Sistema Android” (“Android System”)
• Norton offers only:
  • Cancel
  • Uninstall
• There is an information (“i”) icon, which may provide additional details if tapped.
• The detection ID is:
  • 6b91dbbe4f13

What’s not shown—and what we still need—is:

• Threat name (Trojan? Heuristic? Riskware?)
• Package name (e.g., com.android...)
• Any explanation of why Norton considers it malicious.

My next question to the OP would be

Could you tap the ⓘ (information) icon and post what it says? Also, if you tap the app in Android Settings > Apps, what is the package name?

The ⓘ may reveal the detection name or other metadata.

One thing I noticed

Norton is not saying “Android System” is infected. It’s identifying an app whose display name is “Sistema Android.”

Those are not necessarily the same thing.

Android allows apps to present almost any display name. Malware authors have long used names like:

• Android System
• System Update
• Google Services
• Device Services

to appear legitimate.

Conversely, a legitimate system component may also have the localized display name “Sistema Android.”

That’s why the package name remains the critical missing piece.

Where I stand now

I still think this is unlikely to be solved solely through the Community. If the OP confirms the app keeps returning after uninstalling and Norton continues detecting it, this is becoming a case for Norton Support to investigate. The Community can help identify what’s being detected, but it can’t determine whether detection ID 6b91dbbe4f13 corresponds to a legitimate threat, a false positive, or a vendor-specific system component. That will require Norton’s internal detection database or engineering review.

• What exactly is Norton detecting? (package name/threat name)
• Is it actually a system app?
• Does Play Protect agree?
• Does the app reappear because Android restores it, or because something reinstalls it?

May be best – to document/report “issue” directly via Norton support.
Note: for an official Norton response – open a support case:
Norton Support Help Center → Contact us (bottom of page)
Contact Norton Support → Let’s get started.

Thank you for providing the screenshot. Since Norton continues to detect the application after uninstalling it, and the application appears to be system-related (“Sistema Android”), I recommend contacting Norton Support. Please provide them with the screenshot and mention the detection ID (6b91dbbe4f13). They can review the detection in more detail and determine whether it is a legitimate detection, a device-specific issue, or a possible false positive requiring further investigation.

OP has provided enough to justify contacting Norton Support, even though there are still unanswered technical questions.

Here’s what Norton Support now has to work with:

• Device: Doogee Fire 3 Pro
• Android: 15
• Norton 360: 26.10.1.260610581
• Symptom: Norton repeatedly detects an app named “Sistema Android.”
• Behavior: The user uninstalls it, but Norton detects it again.
• Evidence: A screenshot showing Norton identifying it as a malicious application and offering Uninstall.
• Detection ID: 6b91dbbe4f13

That’s enough for support to begin investigating. They may ask for additional information (such as the package name or logs), but the case is sufficiently documented that it shouldn’t remain solely in the Community.

Since Norton continues to detect the app after uninstalling it, and it appears to involve a system-related application, I recommend contacting Norton Support. They can determine whether this is a legitimate detection, a false positive, or an issue requiring further investigation.

AI sourced content may make mistakes

[SoulAsylum]

One other question coming to mind is has this device been “rooted” at some point?

SA

[peterweb]

If you have Norton 360 set to scan system files, you risk getting the kind of warnings you are seeing here. That is because Norton detects a system app doing things that would seem to be malicious.

To disable the System App scan tap on the Account icon at the bottom right of the 360 interface. Then tap on Settings > Security then be sure to turn off Scan System Apps.

As long as you have not rooted the device, this will not reduce your protection.