tokens: From there , infected phones display illegitimate ads and install fraudulent apps after certain events , such as rebooting , the screen turning on or off , a detection that the user is present , or a change in Internet connectivity .