继上次 Oppo 手机自动安装软件之后的新发现

This topic created in 2774 days ago, the information mentioned may be changed or developed.

前文被 OPPO 手机恶心到了, 自动安装推广软件 - V2EX https://www.v2ex.com/t/530478

这几天手机连着调试的过程中突然自动安装软件被我逮到了安装日志

04-04 09:33:41.602 6768-7215/? W/ContextImpl: Calling a method in the system process without a qualified user: android.app.ContextImpl.startActivity:1384 android.content.ContextWrapper.startActivity:334 com.android.xb.idleinfoz_6011.HonestApDb.doStartScriptCode:320 com.android.xb.idleinfoz_6011.HonestApDb.doIfDataInstall:510 com.android.xb.idleinfoz_6011.HonestFileDownCb.downloadSuccess:137

04-04 09:33:41.602 6768-7215/? W/ContextImpl: Calling a method in the system process without a qualified user: android.app.ContextImpl.startActivity:1396 android.app.ContextImpl.startActivity:1385 android.content.ContextWrapper.startActivity:334 com.android.xb.idleinfoz_6011.HonestApDb.doStartScriptCode:320 com.android.xb.idleinfoz_6011.HonestApDb.doIfDataInstall:510

04-04 09:33:41.603 929-2285/? I/ActivityManager: START u0 {flg=0x10000000 cmp=com.qihoo.video/.SplashActivity} from uid 1000 from pid 6768 on display 0

这段日志是手机自动安装推广软件 360 影视大全的日志

有大佬知道 com.android.xb.idleinfoz_6011 这个是个啥应用吗?

HonestApDb.doStartScriptCode,开始执行推广脚本代码

HonestApDb.doIfDataInstall,如果推广软件安装包不存在则下载

HonestFileDownCb.downloadSuccess,推广软件下载完成

HonestApDb.doStartScriptCode,再次执行推广脚本代码

HonestApDb.doIfDataInstall,检测到安装包已存在,开始安装并启动软件

Supplement 1 · Apr 11, 2019

04-11 11:55:03.252 988-1095/? I/PackageManager: init_copy idx=0: InstallParams{22bdfe09 file=/storage/emulated/0/idleinfozcomm/dsgds.apk cid=null}
04-11 11:55:03.267 988-1095/? I/PackageManager: startCopy UserHandle{0}: InstallParams{22bdfe09 file=/storage/emulated/0/idleinfozcomm/dsgds.apk cid=null}
04-11 11:55:03.330 28029-28048/? D/DefContainer: Copying /storage/emulated/0/idleinfozcomm/dsgds.apk to base.apk
04-11 11:55:06.252 27197-27582/? W/ContextImpl: Calling a method in the system process without a qualified user: android.app.ContextImpl.startActivity:1384 android.content.ContextWrapper.startActivity:334 com.android.xb.idleinfoz_6011.HonestApDb.doStartScriptCode:320 com.android.xb.idleinfoz_6011.HonestApDb.doIfDataInstall:510 com.android.xb.idleinfoz_6011.HonestFileDownCb.downloadSuccess:137
04-11 11:55:06.253 27197-27582/? W/ContextImpl: Calling a method in the system process without a qualified user: android.app.ContextImpl.startActivity:1396 android.app.ContextImpl.startActivity:1385 android.content.ContextWrapper.startActivity:334 com.android.xb.idleinfoz_6011.HonestApDb.doStartScriptCode:320 com.android.xb.idleinfoz_6011.HonestApDb.doIfDataInstall:510
04-11 11:55:06.426 27197-27582/? I/System.out: open:http://nlet.fscy168.com:20091/idlectrl_report_new/report

又有新发现, 抓到了一个日志上报域名
http://nlet.fscy168.com:20091/idlectrl_report_new/report

20 replies • 2019-04-06 05:13:08 +08:00

suhongbo

Apr 4, 2019

真的吗。这个就有点恶心了，没有 OP 手机，不清楚。

Zeonjl

Apr 4, 2019 via Android

为啥是 360 呢

newmind

Apr 4, 2019

@Zeonjl 不只是推广 360 影视,还有豌豆荚,腾讯 wifi 管家等等, 不过这件事和他们广告主无关, 只是推广者为了流量恶意推广的问题

leafleave

Apr 4, 2019 via iPhone

确定原厂 rom 吗？

Zeonjl

Apr 4, 2019 via iPhone

@newmind 如果原版系統如此，那真當消費者是肉雞，還好不買這家店的手機

LZSZ

Apr 4, 2019

可能被动了手脚吧不是官方途径买的？

newmind

Apr 4, 2019

@leafleave @Zeonjl @LZSZ
官方 rom, 但是为了方便调试(OPPO 手机每次打开调试都要输密码), 刷成了最老版本的系统(无需输密码进入调试), 然后也 root 了(忘记怎么 root 的了),
因为我在 Oppo 软件商店里面看到了每日安装指定软件并打开的任务显示已完成, 所以怀疑是系统搞的鬼

LZSZ

Apr 4, 2019

@newmind 我的意思是你在线下实体店买的？还是网店？还是 oppo 官方渠道？