Pop up problem that has me totally annoywed

Praetorian · 05-12-2014 12:17PM #1

I have a samsung galaxy note 4 running 4.4.4.

I am a technically minded person and can usually figure most problems out myself, but this issue has me stumped.

Basically whilst browsing, russian pop ups keep coming up.

I've tried reinstalling chrome multiple times. Uninstalling. Using Firefox. Restarting. Running every single anti adware / anti virus I can find on the play store. Nothing finds any issues at all.

I did a soft reset in settings, backup and reset and "factory data reset". Then spent the next 2 hours copying my photos / contacts and reinstalling apps. There is nothing out of the ordinary at all, skype / whatsapp / facebook / twitter / bbc / rte / onedrive / nytimes / todayfm, etc etc, all reputable companies. To my utter disbelief, the pop ups started again.

I've tried browsing 3g only (just in case somehow my home connection was the cause somehow) this didn't work.

I could try a hard reset, next, but is this a deeper wipe than the soft reset?

Am I missing anything obvious? I'd no idea some malware could get this deeply embedded.

any help / ideas would be appreciated,

Mantis Toboggan · 05-12-2014 12:33PM

Has it been a problem since you got the phone or did it start happening recently?

Kenny Logins · 05-12-2014 12:38PM

Could you be browsing via a proxy that allows pop ups through?

Praetorian · 05-12-2014 12:46PM

Tyson Fury wrote: »

Has it been a problem since you got the phone or did it start happening recently?

thanks for the reply, yes recently. I realise it must have been caused by something I installed. I only install software from the play store. I know that's no guarantee of clean software.

timetogo · 05-12-2014 12:46PM

That's a bit mad. I'd have thought the factory reset would have gotten rid of it. Do you have any apps stored on the SDCard. I know they wouldn't auto run but I'd try the factory reset with the card out of the phone (grasping at straws though).

For all of the apps that you've installed, have they all come from the Play Store? I'd guess so but no harm asking. Edit: ah you typed your response to this the same second I posted mine. Yeah the Play Store isn't guaranteed to be clean but it has a pretty good chance and especially if you've only installed standard software (e.g. Facebook, Twitter etc. If they had a problem we'd all hear about it).

Are you running a custom ROM at all?

From the time of you resetting the phone and the popups appearing again were you the only user (I never trust other users "No I didn't install anything")

Have a look at this app to see if they're any use in tracking down the culprit.

https://play.google.com/store/apps/details?id=com.brosmike.airpushdetector

Praetorian · 05-12-2014 12:47PM

Kenny Logins wrote: »

Could you be browsing via a proxy that allows pop ups through?

Thanks for your reply.

No proxy on home setup, and the pop ups happen on any web site. Bbc / rte / news.com And it happens with wifi disabled.

Praetorian · 05-12-2014 12:55PM

timetogo wrote: »

That's a bit mad. I'd have thought the factory reset would have gotten rid of it. Do you have any apps stored on the SDCard. I know they wouldn't auto run but I'd try the factory reset with the card out of the phone (grasping at straws though).

For all of the apps that you've installed, have they all come from the Play Store? I'd guess so but no harm asking. Edit: ah you typed your response to this the same second I posted mine. Yeah the Play Store isn't guaranteed to be clean but it has a pretty good chance and especially if you've only installed standard software (e.g. Facebook, Twitter etc. If they had a problem we'd all hear about it).

Are you running a custom ROM at all?

From the time of you resetting the phone and the popups appearing again were you the only user (I never trust other users "No I didn't install anything")

Have a look at this app to see if they're any use in tracking down the culprit.

https://play.google.com/store/apps/details?id=com.brosmike.airpushdetector

Thanks for the reply. I did have an sd card in the phone, but it only has photos on it.

Yes apps, all from playstore.

No custom rom

My 2.5 year old has used the phone, but not since the reinstall. Of course he could have installed somethign the first time...

This is a highly unusual problem.

I tried that software you recommended, it finds no issues

Next plan of action is a pain in the a$$. Hard reset with setting up a new google account.

Kenny Logins · 05-12-2014 01:00PM

Praetorian wrote: »

Thanks for your reply.

No proxy on home setup, and the pop ups happen on any web site. Bbc / rte / news.com And it happens with wifi disabled.

Your mobile APN can also be diverted through a proxy.

Praetorian · 05-12-2014 01:03PM

Thanks Kenny,

how would I go about checking for a proxy?

Kenny Logins · 05-12-2014 01:05PM

Settings >Wireless and networks > Mobile networks > Access Point Names

Samsung may be slightly different. It's been a while since I've had one.

Praetorian · 05-12-2014 01:10PM

Nothing looks out of the ordinary there, all the settings look like genuine 02 settings. No proxies specified.

I've checked the ip's / ports against the listed ones on the o2 site and they are the same.

Praetorian · 08-12-2014 11:42AM

I have done a hardware reset, setup a new google account. And unbelievably, the phone is still infected by something.

So unbelievably frustrating. I actually don't know what the next step is.

Kenny Logins · 08-12-2014 12:14PM

A full reset in recovery mode?

Fluffy88 · 08-12-2014 12:34PM

Apps installed to the system directories don't get removed when you do a full factory reset.
You would need to have your phone rooted to allow this though.
If you have your phone rooted you could take a look through /system/app for anything unusual.

Flashing a factory image or a custom ROM to your device will fix the problem but I'm not sure how to do this with a Samsung.

Praetorian · 10-12-2014 12:53AM

I've rooted the phone, but can't see anything obvious saying "delete me i'm a utterly annoying infection"

Just incredibly frustrating that not a single anti virus / malware service detects this problem. They all just scan on the surface which is useless!

I'll have to look into flashing a new rom tomorrow.

A temporary fix seems to be disabling java on google chrome.

MyPeopleDrankTheSoup · 10-12-2014 02:25AM

what websites do you get them on? surely it's the actual websites and not the phone.

Tombi! · 10-12-2014 04:50AM

What kind of popups are you seeing?

Testament1 · 10-12-2014 05:01AM

I get something similar while browsing. It's always a redirect to spaces.slimspots.com which then brings me to either a rubbish app on the play store or to a page telling me that I've won a phone or that my "Samsung GalaxyNexus has a virus" (I'm using a HTC!) and gives a link to a dodgy download.

It's incredibly infuriating to be honest. Happens on reputable sites, without clicking on anything the page just redirects. I've never once clicked on anything in the redirect pages either, I simply close the tab since you can't go back as it keeps reloading the same bloody page.

Same as yourself antivirus/malware scanners are coming up blank. A Google search shows others with the same problem but no real solution bar disabling JavaScript. Since you're rooted I would try something like AdAway to see if it works. Only reason I haven't is because I'm not rooted and given that I don't have Wi-Fi backing up and restoring data becomes more of a pricey pain in the ass when all you've got it as a meagre data allowance

Praetorian · 10-12-2014 09:29AM

Brutal Deluxe wrote: »

What kind of popups are you seeing?

All sorts, mostly russian. Thinking back the only site I could have gotten this from was a torrent web site.

Testament1,

I will get to the bottom of this problem. This afternoon if I get time I will try and find a default samsung flash and try and blank my phone that way.

Infuriating is definitely the word. Android's really annoyed me here. Obviously these issues are out in the wild and there is so little security. There are clearly gaping holes in chrome / kitkat. Then it seems the antivirus / malware detectors don't have deep enough access to be of any use at all.

thomasj · 10-12-2014 09:37AM

Sounds like a virus !

Have you tried any antivirus software ? I know mcafee have a free android app that amongst other things scans the phone for things like this.

Fluffy88 · 10-12-2014 09:51AM

Praetorian, before you flash your phone, take a listing of all system apps that way you can compare it after and see what was causing the infection.

Actually, maybe even do a adb backup so you will have a copy of the apk which you could send to Google after. Google offers to scan installed apps for malware, so you might be able to save a lot of other users the pain you went through.
For adb backup instructions I found this guide, http://forum.xda-developers.com/galaxy-nexus/general/guide-phone-backup-unlock-root-t1420351
Make sure to use the -system and -apk flags

Tombi! · 10-12-2014 10:09AM

All sorts? If they're all in Russian that sounds like adware/malware of some sort. The only thing I can think of to check is (assuming it's a torrent you can't say here) is to check the comments and the uploader. See if they uploaded much else or if the comments say it was a virus of some sort

Zombienosh · 10-12-2014 10:28AM

Try addons detector

Praetorian · 11-12-2014 11:07AM

Guys, thanks for all the replies. So yes a firmware reinstall has worked.

So if anyone else read's this thread that has a similiar problem. I'd skip to the firmware reinstall step. "Soft" and "Hard" resets seem fairly useless. All of the commercially available anti virus / adware / malware software don't seem to scan below the surface & are pointless!

Also, stick to reputable sites whilst browsing on phones. Android has some gaping holes in security.

Fluffy88 · 11-12-2014 03:26PM

Glad to hear you got it sorted.
It probably was a bad app hiding in the system directory.

Did you happen to do a backup of the apks?

Pop up problem that has me totally annoywed

Comments