Do i really have a virus? what is going on here

AngWay

So i have been messing around with backups and trying figure out how to back up my phone with graphenos. anyway when i go here https://ibb.co/KxNhg93R and i click launch this will popup https://ibb.co/60wgccSG

Also this is showing up https://ibb.co/RpNRxxn1 and i'm also getting a notification that looks like this https://ibb.co/chGGLD5k

I really don't know whats going on here or what i have done or if i do have a virus but i'm worried about it. Any of you got a idea what is going on here? Many thanks

gristle-cause

That link that opens definitely smells malicious... Question is, what's launching it? A local firewall like RethinkDNS might be able to identify the app responsible for launching it

Johnnyloans

AngWay i click launch this will popup https://ibb.co/60wgccSG

I haven't used backups and restore, but this is as harmless as clicking an ad for a candy bar and it sends you to a website about candy bars. This screenshot is a website displaying whatever claims or text it wants.

I don't know what "launch" is but it seems suspicious if opening it causes that to open. Maybe they have ads in their app. You tapped the ad and it opened a website. I don't have "launch" on my phone. I have launcher though. A different pixel might have it, doubtful if it caused that.

Are you using the grapheneos built in back up or an app you got for backups?

Johnnyloans

gristle-cause Question is, what's launching it?

Could look at your most recently used apps like so:

https://i.imgur.com/kxkd0Cy.jpeg

I had redreader open, clicked a link, vanadium opened.

AngWay

Johnnyloans The lauch that is here https://ibb.co/KxNhg93R is at the very bottom when i click backup status under the backup settings it takes me there i'm on the pixel 10 pro xl by the way. but i also have this notification https://ibb.co/chGGLD5k that if i click it doesn't do anything all i can do with it is swipe it away.

Idk what is going on but something is messing something up i'm using the stock backup tho so it's apart of graphenOS. Thanks btw.

AngWay

Johnnyloans Yeah i closed out everything that was in my browser like all the open tabs i closed them all out but it's still happening.

AngWay

Johnnyloans Here is a screen recording of what all that does. https://dl4.pushbulletusercontent2.com/url1rkN7oinbsUuxjozFepUGioZwnFKw/screen-20260219-191616-1771546550716.mp4

Johnnyloans

AngWay

Oh, I see. launch will open the app.

It's weird there is no icon or name for the bottom 3 apps (near the word launch). Furthermore, that app you have installed has the job of opening a malicious website. Uninstall any apps you don't recognize. Careful what apps you install and what you download.

I doubt you are hacked or have a virus. That app probably just has code to open a website link.

But honestly, if it was me, I'd wipe my phone and nuke it all.

Also, why have microG instead of the GOS google play services? Hopefully you don't have both installed on the same profile.

dhhdjbd

AngWay

is the app "launch" listed under Apps->all apps?

For the notification, tap on it and hold, until the settings wheel appears. Then click on it.
A menu (from the settings app) will appear, where you can do notifications settings. At the middle on the top, click on the icon. It should go to the app, what app is it? Is it the launch app?

what apps did you install/ how do you install apps?

I believe you dont have a "virus", you just installed some adware / scam app in the past

AngWay

Johnnyloans So i ended up deleted those 3 at the bottom with no icon, i'm really not even sure where they came from i know every app i have on my phone because i only use what i need. But don't recall putting those on there.

And with the microG i had to download it because it wouldn't let me use youtube ravanced without it for some reason i tried using both the regular youtube app and the revanced one but they just would not work without having the microG installed so idk.

AngWay

dhhdjbd I'm not sure but i was able to long press on the 3 at the bottom with no icon and clicked uninstall so they were removed hopefully that fixes it now. i instlal apps using the google play store but i never seen a launcher app.

Johnnyloans

dhhdjbd is the app "launch" listed under Apps->all apps?

There is no app called launch. Angway somehow has 3 apps with no name and no icon as seen here:
https://i.imgur.com/HqAG5MP.jpeg

His screenshot that says launch should look like this for every app with an actual name and icon:
https://i.imgur.com/n4qzpgD.jpeg

Launch opens the app.

Johnnyloans

dhhdjbd I believe you dont have a "virus", you just installed some adware / scam app in the past

True.

You're probably fine angway

dhhdjbd

Johnnyloans
thank you sry i misunderstood that part

AngWay

I mean microG is not in the play store soo.. how did you install that?
and i am not sure but plus plus battery seems to be on fdroid (but maybe i missed it in the playstore)

if you did install everything only from playstore, these apps should come up in your app list there (any you had on this google account)

I am wondering about things like, did you use app verifier ? and so on

Johnnyloans

dhhdjbd thank you sry i misunderstood that part

I thought the same thing too at first. Another day another topic I don't know about 😊

Humbled

AngWay

dhhdjbd Oh no i used f droid and auroa to install some of the apps to so not all came from the play store. i think i got microG from there website .

AngWay

Johnnyloans I looked at that again why does some of the apps have launch under them but alot of them don't

Vincent96

You have some kind of malicious app, probably adware trying to show you ads using the display over apps permission it's trying to get you to give it. Though it is not a "virus".

Go through all of your app permissions in Settings>Security and privacy>Privacy controls>Permission manager and one by one remove permissions from apps that don't need them in case this app has dangerous access. For example if you don't use the QR code function of CashApp deny it camera permissions.

As for what app is causing this or where it came from is based on the apps you install and where they came from. If you download APKs at random through the browser (YouTube ReVanced comes to mind) it is likely one of them is doing this. Malicious popup apps like you have are also on the Play Store. Remove non-system apps you don't recognise.

AngWay

Johnnyloans But anyway like here the 3 at the bottom is gone now i managed to uninstall them . https://ibb.co/84tDjZh0

Johnnyloans

AngWay

Under backup some apps say:

this app was not backed up because it wasn't used/opened recently. You can open it now if you want with this "launch" button