Treehouse

I did install malwarebytes after installing kaspersky. It also found nothing so i removed it. Before that there is the built in av that is powered by mcafee. I dont want to resort to factory reset yet. The suspected virus might survive that and all i could manage would end up deleting apps and their data. At first kaspersky install, it did remove 2 things, which were malware. But it couldnt properly remove them apparently. It merely deleted the setup/apk of the malware. Also i only understood that i was infected after my discord was hacked and a suspicious link has been sent to everyone it can until discord logged me out. It took some time to understand that it wasnt my password or token that got compromised, but my phone. Then i installed kaspersky. Also what did you try to replicate? Or which issue are you referring to?

I think there has been a misunderstanding. You cannot replicate this at all. I am saying the usb debug option turns on by itself. I am able to turn it off but it either immediately turns back on, or i wipe the ram with ram cleanup and it stays off for a long time untill it goes back to on out of nowhere. To replicate this, you would need the malware that turns the setting on. I am %99 sure something is turning it on. A bug that turns that setting on seems extremely improbable.

Firstly, i had an idea. I tried using a ram cleaner app to test my theory of malware turning the usb debug thing on. After wiping the memory i have successfully turned the usb debugging off which strongly hints that my phone is indeed infected and malware is indeed turning usb debugging on. Also i am able to crash the mentioned malware with ram cleaner. 1- I installed it from the link you gave me. I downloaded the apk. Figured it would use less data since i can reinstall it from the apk. 2- Its from when it was installed but it was the same way when it was uninstalled too. 3- There are no red or yellow notifications. I will add a screenshot. I just turned off the developer options too but i am afraid malware can bypass that and open the usb debug anyway. I was and still am able to turn it off no problem but Kaspersky would tell me to turn off usb debugging in a yellow warning notification, detecting that it was on despite dev. opt. being off. Usb debug is off right now. This probably means trojan is also off.

Kaspersky ver. 11.114.4.12135

1 no 2 yes 3 latest/free 4-8 its still on. Developer mode is off yet usb debug is on.

l installed kaspersky for mobile to cleanse my phone of trojan. lt seems to be clean but now whenever i attempt to turn off usb debugging as i am instructed by the app, it immediately turns back on. ls it a bug from android, a leftover damage from trojan (perhaps it was relying on that option being on to work properly), or trojan evaded kaspersky and still working and keeps it on? Phone is galaxy j7 prime running android 8.1.0

@Flood and Flood's wife lt showed the warning today

Sorry for not answering timely. l don't have wifi or permanent internet access. 1. lt's 24.6.0.1874 (64-bit) 2. lt's 1.3.7.1 3. Yes 4. l installed it once upon a time from extension store iirc. l don't remember. lt became problematic recently. lt didn't give warnings before. 5. l can not get it to show me the warning now. lt is undeleteable though. l just deleted another extension and its gone but adlesse comes back. l open extensions folder in AppData\Local\Yandex\YandexBrowser\User Data\Default\Extensions and its folder literally manifest itself right in front of my eyes as i launch the browser.

@Flood and Flood's wife lt didn't really help. lt disabled the extensions but didn't remove them. Adlesse was still there. (Also version number was missing from the topic. That was the only mistake i made there. Then i wrote the number. l couldn't write it if it was missing from the app.) l deleted it again, maybe it won't come back this time but i doubt it.

1- Yandex 2- No. Should i do that? lf i should, do i reinstall the browser or is resetting settings enough?

it is back. l ran it again and it found nothing

Deleted. Right now it seems to be gone but i don't know if it will relapse.

Scan found 14 objects. Log:

There is no entry for adlesse. There is "VideoAdsBlocker" but i can't uninstall it. lt gives not found error. l did check the startup and it seems only thing missing is version number which is: 21.17.7.539

l am using yandex browser and despite deleting this adlesse extension it comes back. l have also tried deleting its folder but it still came back. lt also shows most things inside the folder are last modified in 2016 but folders themselves show the correct time it has been reinstalled. Kaspersky does not pick up anything.