Sorry for the long story. "tl:dr" version is at the end; these details are in case anyone can use them to figure out what happened and how to fix it.
4 days ago I got a pop-up saying "Unfortunately, Sophos Mobile Security has stopped." It had happened a couple of times the previous fortnight, randomly, and I had just pressed "OK" and it (apparently) restarted without a problem. This time was different. The pop-up returned, and then again and again, on about a 2-second interval and gradually speeding up. I tried to use the "Report" option but the pop-up interrupted everything I did until I was typing only a few letters at a time. I'm not even sure if the report was received or by whom.
That's when I noticed download activity I had not requested. The download was called "Testiculate.mp3 Something Rhymes with Purple" and said it was 30 MB. There were 3 of them when I looked in my file manager. I turned off the phone, pulled the battery, SIM and storage card, waited, reinserted them, and rebooted. The DLs had stopped and I deleted them successfully (I thought). The phone worked fine until yesterday.
The same thing began again. I cannot recall anything I was doing in particular, when the same sequence of events started but this time it was downloading 2 at a time.
This time I immediately turned the phone to Flight Mode to stop the multiple DLs. That seemed to stop both the downloads and the pop-up boxes from Sophos Mobile Security. I went into the file manager again and deleted the multiple copies of the file. I also looked through my other listed downloads. I could account for most of them but deleted some whose names seemed odd. (I may regret that when the phone is working again.)
I also saw, but didn't yet delete, a file I cannot explain at all. I took a screen shot of its listing in the file manager. It's called "dmc.txt". It says it's only "50 B". The download date and time indicate it was DLed 1 minute before the "Testiculate" files began DLing. I didn't delete it in case it's useful to someone to examine it.
tl:dr version
Current state of affairs: my phone is effectively bricked, since I can't take it out of Flight Mode. To the best of my ability to summarize things, my phone seems to have been infected somehow by some kind of code capable of stopping Sophos Mobile Security dead in its tracks. I still don’t know what it is, or where or how it got on my phone. Whatever that code is, it was capable of bypassing Sophos without being detected, and now it crashes Sophos Mobile Security every time it tries to restart and stop the code. Then I get another string of weird downloads and it’s as if the code uses Sophos Mobile Security to keep me from using the phone at all. It’s still on my phone and I still don’t know how to get rid of it.
This thread was automatically locked due to age.
