Dozens of low-cost Android phone models come preinstalled with apps that covertly download and install adware and other unwanted programs, researchers said.
At least 26 phone models come preinstalled with a downloader dubbed Android.DownLoader.473.origin, according to a blog post published Monday by antivirus provider Doctor Web. Doctor Web researchers described the app as a downloader trojan that can download not only benign applications but also malicious and unwanted ones. One such app, known as H5GameCenter, displays ads on top of running applications. The image can't be removed, and infected users report that when they uninstall the app, Android.DownLoader.473.origin quickly downloads and installs it again.
Another preinstalled downloader Doctor Web detected is known as Android.Sprovider.7 and comes encrypted inside another app. It has the ability to automatically download Android application files and install them when users click on a confirmation button, make phone calls to certain numbers, and show ads on top of apps.