What is com.google.android.gms.persistent and why is it always using the CPU?
Even when nothing else is happening this system process seems to use a steady 1-2% of the CPU. Over the course of a day this drains a significant amount of battery even when the device wasn't used for anything. I haven't been able to correlate it to any other apps because even when they have only used a few seconds of CPU time each over the course of several hours this process is using minutes.
It still seems to run even if I:
- turn off WiFi
- turn off BlueTooth
- turn off location services
- turn off everything except the most bare minimum of syncing (e.g. GMail)
I wrote a little test app that monitors /proc/<pid>/stat every 10ms and writes to logcat any time com.google.android.gms.persistent, hoping that it would write something to logcat itself which would pinpoint what app or other service is using "persistent" for its services. I don't see much, but here are a few things I did see:
InputReader: Reconfiguring input devices. changes=0x00000010
WifiService: acquireWifiLockLocked: WifiLock{NlpWifiLock type=2 binder=android.os.BinderProxy@f73f0b8}
LocationFilter: Forcing stable location. Original location:Location[...
ConnectivityService: notifyType CAP_CHANGED for NetworkAgentInfo [WIFI () - 246]
Each line above was at a different time, immediately preceding (within 10ms of) a log message detecting CPU usage by com.google.android.gms.persistent but without any clear indication whether or not it is related. Unfortunately, none of the above reports more than 10ms of CPU time taken, and so - even if accurate in denoting what is using "persistent" represents only a small portion of the actual CPU time being used.
Other attempts to research what uses this process have suggested various things (such as wearables) which I don't have and have never had connected to my device.
What is using this process? I am looking either for this information directly, or for additional ways I can deduce this information similar to my attempts via logcat.
Update: I have been looking for the source (e.g. com.google.android.gms.persistent.java or something like that) on https://android.googlesource.com without any luck. Is this not part of the public source code? What is really strange is that there doesn't even appear to be any documentation, e.g. here: https://android.googlesource.com/platform/frameworks/base/+/33fca8e/docs/html/reference/com/google/android/gms
Update 2: I disabled all syncing under Settings -> Accounts. This seems to reduce CPU usage a bit more, and battery drop seems to have dropped to a crawl - except periodically com.google.android.gms.persistent still seems to take a burst of CPU.
My working theory now is that it has an Alarm that is firing at approximately 60 second intervals regardless of whether it is needed or not, and that code is checking for syncing work, and if nothing needs to be synced it gives up the time slice right away and lets the CPU go right to sleep. However, I halfway can't believe that such a horrible design would be used, as anything that wakes up the CPU every minute is sure to drain the battery a lot faster even if it just goes back to sleep, and why would polling be used instead of something interrupt driven for syncing anyway?
As far as I can tell (due to not being able to find it) the source code for com.google.android.gms.persistent is not open source or available online anywhere. If I am wrong, I would accept as an answer to my question, any answer which would point to the source code as I could browse it and determine for myself why the CPU usage.
Michael2 Answers
It is not a virus or Trojan. it is google play service process that need to run properly the Google play Services in Android Platform. In fact it is the main process runs in background, it is useful to make support for the apps and linked with google play store and keep them updated and provide other google play service features. Regarding CPU usages many other apps too run in backgrounds and taking resources but it is for keep them updated and provide you better real time services.
Mohit DixitThe latest member of a notorious family of Android trojans downloads and launches malicious apps without the user's knowledge on infected devices, according to researchers at Russian anti-virus firm Dr Web.
The malware, known as "Android.Xiny.60," hails from the same family as Android.Xiny.19.origin, which made its grand entrance back in January 2016.
At the time, Xiny hid itself in over 60 games available for download from the official Google Play store, and used instructions relayed to it in the form of image files modified via steganography to run arbitrary APK files.
Infected android games
As Softpedia reports, the latest versions of the Xiny trojan don't need to trick users into granting it admin privilges, but instead deploy exploits to root the device.
Once the malware launches, it loads up its malicious components and saves them to the system directories. The trojan can use those elements to wreak all kinds of trouble.
For instance, Xiny can inject malicious processes into IM chat apps, snooping on conversations and even sending messages without the user's permission. Furthermore, the malware targets banking apps, and can display fake login pages to steal usernames and passwords.
As Dr Web explains in a blog post:
"The trojan launches the igpi module (Android.Xiny.61) which uses the ptrace function to inject the igpld.so executable Linux library (Android.Xiny.62) into the system processes of Google Play (com.android.vending) and Google Play Services (com.google.android.gms, co.google.android.gms.persistent) applications."
The malware can also inject Android.Xiny.62 into the zygote, a crucial Android process whose infection allows the trojan to launch new applications and additional malware.All the while, Android.Xiny.60 waits for a charger to be detected, the home screen to turn on or off, or several other specific events to occur. Whenever one of those events takes place, the trojan connects back to its command-and-control server and sends all kinds of information about the device to home base.
Android users should work to protect themselves against all versions of the Android.Xiny malware by maintaining an up-to-date anti-virus solution, reading the reviews of apps before they install them, and checking to make sure an app's requested permissions jives with its advertised purpose.
Few if any legitimate apps actually require root privileges, so beware of imposters looking for rights they don't deserve
True258
Brad LarsonUser contributions licensed under CC BY-SA 3.0