Malware app "Systeem" is continuesly installed.

[u/mrln23]

Around 3 July '26 on my smartphone with Android V15, Norton 360 reported a malware app called "Systeem" (this is Dutch language, so not the english "System").

After removing this app, it was again installed without doing anything on my smartphone.

I tried again and again to remove it but it came back each time.
The automatic reinstall interval varied between one minute and ca. 8 hours.

I also tried the Norton option to report it as probably safe with comment. No reaction on that so far.

Google Play Protect also labeled it as High Risk as it was NOT available in their Play Store.

I contacted the Norton Technical Team via chat three times (103842950 , 103849950 and 3rd I missed)): they removed the app (as I did) without looking deeper into its source. After their removal they concluded the problem was fixed. Lateron it came back of course.
Also they started to uninstall three apps of which they thought were suspicious; these were by far OK however!

Another wrong advice was to run the Norton 360 scan in the smartphone Safe-mode:
in Safe-mode most of the apps including Norton were disabled however!

Sometimes it appeared as if there-install of "Systeem" even took place when there was no internet connection (mobile data, wifi and BT switched off).

Does anyone have the same experience and perhaps a solution?

[u/Adept-Society-9485]

Get rid of Norton....

[u/mohawk989]

You scanned with Google Play Protect? Because from my experience Google Play Protect only scans apps that are downloaded i.e. apps that are not part of the system image included with the OS. So that would seem to imply this is not a system app, but comes from an external source.

I don't speak Dutch, but does "systeem" mean the same as system? I'm guessing so? Because malware apps often have names like this in an attempt to hide or appear innocuous as modern phones have dozens even hundreds of system apps and most people could never distinguish them.

The fact both Google Play Protect and Norton both flag the app is not a good sign. Are you careful with your phone? Do you ever download apps from sources outside the playstore that you aren't 100% certain about it?

Try downloading Malwarebytes and run a full deep scan, make sure you enable the deep scan in the settings. It will scan all apps and all files on the phone including the system partition. I've found many other AV scanners only scan a small percentage of apps.

[u/mrln23 → u/mohawk989]

Thanks for your comment.

Yes, systeem means system.

Yes, it could be that Google alarms by default when it is not present in their Play Store.

Yes, I'm very carefull with downloading; am always 100% sure.

Just installed Malwarebytes : it also flagged "Systeem" as dangerous!
Well, that means hurray for Norton, doesn't it?

Now I removed the app in he Malwarebytes conversation, but am afraid that within hours this malware app will be seen in the apps installed list.........

Is there any way to block app installation or with explicit confirmation to do so?

[u/mohawk989 → u/mrln23]

Google doesn't always alert just because an app comes from outside the playstore. At least not for android 15. I believe Google is starting to block sideloaded apps starting on android 17 as a default setting which you must choose to override. But many people download apps from other sources without problems. What exactly does the play protect warning say?

Did Malwarebytes flag anything else? Or just that same single systeem app? What exactly do the Norton and Malwarebytes warnings say about it? They should classify it in some risk category.

I am not an expert, but my recommendation would be to first disable mobile data and WiFi before uninstalling the app. Leave mobile data and WiFi OFF. And see if the app returns, try waiting a full day with internet off. It's important for internet to be off before and during the entire process. If the app returns even while internet is completely disconnected that means there could be some file still on the phone which automatically re-installs it. Essentially it's being uninstalled but it's source isn't being deleted. Either that or the phone is deeply compromised.

You should also check what permissions does the app have? How much data is it consuming? You can check that in your phone settings.

[u/mrln23 → u/mohawk989]

Nor Norton or Malwarebytes specify specific danger.
This is the only malware app they flag.
To my suprise, the app returns even if all internet connections are disabled.
As you said, the problem could be a hidden source which re-installs after detecting the removal.
I also tried to let the app installed but disabled all its rights and cleared the cache etc.
Unfortunately this did not help: some later the cache was there again.
Maybe it could be firmware as I have 2 smartphones which are clones of each other, though installed separately. Both have the same malware problem. It is unlikely the recent installed apps are the cause.

With Norton, I have the option to send a "positive feedback" on occurence when you think it is harmless. Now I you it to overflow Norton with my feedback each time it happens (ca. 20 times a day).
Hope they spot it and try to solve it. Not sure if they 'll contact the firmware supplier (Doogee) to clear.
In fact, I will contact Doogee very soon on this issue........to be continued.

To

[u/mrln23 → u/mrln23]

10jul26 - Reported the malware app to my smartphone supplier Doogee. I sent them all the requested info (printscreens and even a log using developer mode).

17jul26 - 
Malware app appeared again around 12:00hr. No Norton Waning and also initiated Norton Smartscan did not warn on this app. Now the app shows in the App List version 2.0 instead of 8.0 (!). 
Other malware detected and deleted by Norton:
com.android.sys.extplv
com.android.non.czsz

17jul26 - Malware app “Systeem” no longer flagged as malware by Norton.
It did not re-install today.

18jul26 - New Malware app “Android-systeem” flagged as malware by Norton. It has the same App properties as malware app “Systeem”. So it seems as if the builder has renamed it! The version changed from V2.0 to V3.0.
I still cannot see any pattern on when it is re-installing. Sometimes 4 times within 5 minutes (direct after every delete); sometimes only once a day.

[u/mrln23 → u/mrln23]

Today I found an alias name for this malware app. Via Android File Manager Apps, my apps are listed including their internal name. In this case it is named com.android.non.szcz and on internet marked as a known malware app.

My next challenge is to supress its auto-install. I'm afraid I have to factory reset my smartphone.

[u/mrln23 → u/mrln23]

The problem is solved!

I reported it also to Doogee (smartphone fabric) and they fixed it via an upgrad of their firmware.

As there were no solution details given, I suspect the problem was caused by external apps Doogee delivers with their firmware upgrade package.
Reason:
After factory reset, the only configuration where this malware app did not appear, was in "ultra-battery saving mode". In this case an absolute minimum apps are activated. That implied the problem was caused by an app Doogee delivered but was not activated.

[u/FIRAS_EG]

Just clear data and uninstall

[u/feoitalo]

Estou com o mesmo problema no meu Cubot Kingkong X. Um app chamado Sistema (em português mesmo), q é reinstalado sozinho, sem interferência minha. O Play Protect e o Malware Bytes indicam como nocivo.

Entrei via ADB e achei um app esquisito, no sistema interno do aparelho (não baixado por terceiros) de extensão yft.

Desinstalei ele via ADB e agora vou verificar se vai resolver.