Related
I installed a few apps from the google app marketplace over the last week or two, and found I'm getting random advertisements popping up under my phones notifaction list ( Where you can drag down the menu at the top of your phones screen and see recent events. ) There are also buttons being placed in empty locations on my phones main tabs, like shortcuts to applications or widgets, and they link me to the web. ( I have multiple browsers and just close the box when it asks which browser to use. )
I don't understand where this is coming from or what I have to do to get rid of it... I understand that some apps have advertisements, but those are only while the application is actually opened and being used I thought. This has been sending me messages waking me up when I'm sleeping, It's kinda sorta bull**** lol... And I don't think I need an anti virus program constantly zapping my Notes resources, but yeah...
Any comments? What do I do to pinpoint which program is causing it, and will removing that app even fix the problem?
Seems you got airpush install somehow, download add on detector from the market
Sent from my SAMSUNG-SGH-I717 using xda premium
Make sure you post which app it was so we can all avoid it. 1 star it in the market and say it has AirPush and to avoid it before you uninstall it please!
I think I have got a virus in my phone. Sometimes when I open any link in Chrome, a random popup opens which usually redirects to the play store somewhere. Once I opened 9gag.com and it opened 9gag's play store link. It even happened with android authority blogs that when I interact with the page i.e touch or scroll anywhere, a random ad link just pops up. Not only this but the original page is replaced by a facebook page whose URL contains something about a campaign i.e its ID etc. History shows a website terraclicks.com and google search on terraclicks shows that it's a PC virus.
Not only with Chrome, I even got the same popup while opening a link using facebook's own default internal browser.
I used Avast to scan for viruses including all files but it found no virus. The same thing is also happening in my brother's phone and we don't share anything between phones. There's a laptop in my home which also shows terraclicks in its history. So I think the virus is spread over all the devices, but I am still unsure as to how to remove it while mobile's antivirus detects nothing.
ad virus
Yes i have the same problem.Please help.
well I installed ccleaner and cleared three things:
All apps cache, chrome history and empty folders. It disappeared for some days but last night it came again to me. Now I have repeated the process again, let's see what happens now..
Usman i have factory restored my phone but it is still there. I dont know what to do now
khan khan said:
Usman i have factory restored my phone but it is still there. I dont know what to do now
Click to expand...
Click to collapse
which internet are you using? I am using PTCL
Do you also have this on another mobile or on computer?
no, there is only one mobile and it is only happening with it.
It's most likely a simple ad that is displayed when they detect your device and want you to download their app I stead. Use an ad blocker and you will be fine.
zelendel said:
It's most likely a simple ad that is displayed when they detect your device and want you to download their app I stead. Use an ad blocker and you will be fine.
Click to expand...
Click to collapse
It's also appearing on computers. And I can say it's not coming from the website's owner because I personally work on a website and one time clicking on its logo triggered the ad. That website would never put an onClick ad on its logo.
terraclicks ad virus
You should install a new window on your computer which will definitely remove these ads but what to do with this in the android. I have installed every antivirus , antimalware and have performed a reset too but no effect.
OMG, I was also infected with Terraclicks. All I can find is removal guides that have nothing to say about Android system.. Can I just reinstall by browser or reset my phone to factory settings? I would prefer the second option because I have lots of photos that are important to me on my device. thanks
It's almost a year since the original post on this thread, and still searches for info on this insidious malware, Terraclicks shows just non-android solutions and generic adware removal info.
Like several other posters I have tried dozens of AV and anti-malware apps but nothing works so far.
Has anyone found a solution??
Clear all apps cache, browser cookies (it will log you out of all websites in the browser), and browser history (only if needed).
Try the above steps one by one and give some time between them to see if the problem goes away without doing the other steps.
It probably comes from visiting cheap websites like those sharing apk files or songs etc. They don't give a damn about the users.
For me this was solved by making uTorrent pro inactive, the adds stopped.
Once I uninstalled it they never came back.
Assuming you have cleared your Chrome cache etc, I suspect you have an app which has been installed which is causing this. In my case it was an .APK which I had downloaded externally (because I couldn't get it from the Play Store). As it happened, this particular app made itself a device administrator (you can check by going into Security, Device Administrators) and it also had greyed out the ability to uninstall it. The app was also running as a background process which is how it keeps spawning those ads. Nothing picked it up as Malware (Malware Bytes, Trend, CCleaner). That was the giveaway to me, that something wasn't right with this app. This would also explain why a phone reset wouldn't remove it, because that typically reinstalls all your apps (except in your case) the app would have probably come from the Play Store. Since removing the app, I've had no problems and the dreaded problem has gone away. Now I am a lot more careful about which APKs I loaded. Good luck
I had this issue and it ended up being one of the apps I downloaded. Once in uninstalled the correct app the problem ended. If you do factory reset, then redownload all your apps, then the problem would come back because you redownloaded all the apps you originally had. This is especially true if you use an app that's not in googles playstore so what he is saying sounds almost exactly the same as what happen to me.
Thank you that fixed it. I downloaded showbox of a site. N it messed up my phone.
I ran both Avast and Malwarebytes separately (delete one and install the other) and both detected nothing malicious.
Ran Airpush Detector and Ad Detect plugin, no helpful results.
This happened after downloading Wechat and some automatic updates of a few apps. I have since deleted Wechat, but the problem persists. The few apps that were automatically updated at that time were: Facebook, Foxit,Gmail, Google Drive,Google+,Kik,Maps,FB messenger,Twitter,Whatsapp Messenger, Twidere,Swiftkey keyboard, Mini Warriors. I have not tried deleting them yet, but it seems to me that they are pretty legit apps.
Some examples of the adware in action:
Taking over my lockscreen with this annoying blue lockscreen:
i418.photobucket.com/albums/pp270/ravenoz_bucket/Screenshot_2016-04-11-06-41-01.png
Occasionally the adware's lockscreen will contain ads:
i418.photobucket.com/albums/pp270/ravenoz_bucket/Screenshot_2016-04-11-06-46-46.png
Pop up ad:
i418.photobucket.com/albums/pp270/ravenoz_bucket/Screenshot_2016-04-11-17-12-45.png
I've also noticed that the pop up ad would occasionally be opened from the default Android web browser, as the web browser will be opened with an "about:blank" page with the pop up ad in front. A browser hijack as well ? :crying:
I am trying to avoid resetting the phone, hopefully there are possible ways to troubleshoot this adware
Phone: INO 3
Android version: Android Lollipop 5.1
Root status: Not Rooted
DrilloBan said:
I ran both Avast and Malwarebytes separately (delete one and install the other) and both detected nothing malicious.
Ran Airpush Detector and Ad Detect plugin, no helpful results.
This happened after downloading Wechat and some automatic updates of a few apps. I have since deleted Wechat, but the problem persists. The few apps that were automatically updated at that time were: Facebook, Foxit,Gmail, Google Drive,Google+,Kik,Maps,FB messenger,Twitter,Whatsapp Messenger, Twidere,Swiftkey keyboard, Mini Warriors. I have not tried deleting them yet, but it seems to me that they are pretty legit apps.
Some examples of the adware in action:
Taking over my lockscreen with this annoying blue lockscreen:
i418.photobucket.com/albums/pp270/ravenoz_bucket/Screenshot_2016-04-11-06-41-01.png
Occasionally the adware's lockscreen will contain ads:
i418.photobucket.com/albums/pp270/ravenoz_bucket/Screenshot_2016-04-11-06-46-46.png
Pop up ad:
i418.photobucket.com/albums/pp270/ravenoz_bucket/Screenshot_2016-04-11-17-12-45.png
I've also noticed that the pop up ad would occasionally be opened from the default Android web browser, as the web browser will be opened with an "about:blank" page with the pop up ad in front. A browser hijack as well ? :crying:
I am trying to avoid resetting the phone, hopefully there are possible ways to troubleshoot this adware
Phone: INO 3
Android version: Android Lollipop 5.1
Root status: Not Rooted
Click to expand...
Click to collapse
Try the app Addons detector, find the apps that are causing the ads to popup on your phone, then remove those apps.
Mufrad said:
Try the app Addons detector, find the apps that are causing the ads to popup on your phone, then remove those apps.
Click to expand...
Click to collapse
Apparently this particular adware only targets INO, how did this even occur ?
Found solution from here: yampblog.blogspot.sg/2016/03/solved-ino3-android-smartphone-suddenly.html
The adware masqueraded itself as a core system app and also in another apk. Geez.
DrilloBan said:
Apparently this particular adware only targets INO, how did this even occur ?
Found solution from here: yampblog.blogspot.sg/2016/03/solved-ino3-android-smartphone-suddenly.html
The adware masqueraded itself as a core system app and also in another apk. Geez.
Click to expand...
Click to collapse
Good to know that you found a solution and have fixed your problem.
DrilloBan said:
I ran both Avast and Malwarebytes separately (delete one and install the other) and both detected nothing malicious.
Ran Airpush Detector and Ad Detect plugin, no helpful results.
This happened after downloading Wechat and some automatic updates of a few apps. I have since deleted Wechat, but the problem persists. The few apps that were automatically updated at that time were: Facebook, Foxit,Gmail, Google Drive,Google+,Kik,Maps,FB messenger,Twitter,Whatsapp Messenger, Twidere,Swiftkey keyboard, Mini Warriors. I have not tried deleting them yet, but it seems to me that they are pretty legit apps.
Some examples of the adware in action:
Taking over my lockscreen with this annoying blue lockscreen:
i418.photobucket.com/albums/pp270/ravenoz_bucket/Screenshot_2016-04-11-06-41-01.png
Occasionally the adware's lockscreen will contain ads:
i418.photobucket.com/albums/pp270/ravenoz_bucket/Screenshot_2016-04-11-06-46-46.png
Pop up ad:
i418.photobucket.com/albums/pp270/ravenoz_bucket/Screenshot_2016-04-11-17-12-45.png
I've also noticed that the pop up ad would occasionally be opened from the default Android web browser, as the web browser will be opened with an "about:blank" page with the pop up ad in front. A browser hijack as well ? :crying:
I am trying to avoid resetting the phone, hopefully there are possible ways to troubleshoot this adware
Phone: INO 3
Android version: Android Lollipop 5.1
Root status: Not Rooted
Click to expand...
Click to collapse
Interesting how you're seeing this. It looks eerily familiar to something I found after downloading the Flash Keyboard app. After downloading, and only while charging, the phone will show a second lock screen often with ads (for apps from the same company). Even more annoying, is that the app grants itself admin rights - so the only way to uninstall is to visit the admin section in settings before you can remove. Anyone else seeing issues like this for other apps?
Some very weird things started happening on my phone earlier today. It's a Nexus 5X, running 8.0 Oreo, with the October security patch. I'm not rooted and I'm careful about what I install. The phone is fairly new, from this summer.
I will begin with describing what I did in the hours before this started. I can think of two things that possibly could have started it:
1) Two of my Facebook contacts sent malicious links to me an hour before. It looked like Youtube videos but was not. I did NOT open any of these links, knowing directly they were harmful (not sure if you can be affected by just receiving them, not clicking on them?). I received them in the Messenger Lite application (an official app from Facebook with scaled-down functionality).
2) A few hours before the Facebook links, I sideloaded an APK containing the new Pixel Launcher. I got the APK from Android Police/APK Mirror.
Can't attach links, but Google for: Hands-on with the updated Pixel Launcher, including the new Pixel 2 features [APK Download]
The APK was working fine and nothing seemed odd with it (I used the launcher for a few hours). As long as Android Police know what they uploaded, this shouldn't be the cause for my problems. I bet on Facebook Messenger instead. (People that click such malware links typically get their Facebook accounts hacked, however my account seems fine and my account didn't spam others with the same link. I did not change password or did anything else to "recover" my account yet).
So what happened after this on my phone?
Here is the first thing I noticed. I open Play Store to install updates. It turns out I have one update pending, it's called BankID. This is a major Swedish app used by nearly every smartphone user in the country, and it's for signing into government websites, bank websites, insurance company websites, and much more. When I click update in Play Store two things happen almost instantly:
1) Six pictures are downloaded from Messenger Lite to my phone. That makes no sense, how could clicking a button in Google Play trigger something to happen in Messenger Lite? In fact I tried it three times, with the same behavior every time. (Well, actually opening the Messenger Lite photo album, there are only photos there I already downloaded, so nothing new seems to be added there - but the photos were probably re-downloaded I believe).
2) The BankID update downloads to 100 % (the downloading takes a little longer than expected), then it halts and does nothing, i.e. it's not installing. No error message, it just stops there. I can choose to abort and try again, which I do three times or more, with exactly the same behavior.
Also, I now notice Play Protect hasn't run for two days, but when I try to run it, it seems to be down. After ~30 seconds of scanning it says "App verification temporarily down". "App verification temporarily down" could very well be connected with the halted update I just described? It still says it hasn't run for two days after this.
When I experiment, I notice other things that are very weird indeed.
1) Notifications in Gmail, Snapchat and possibly other apps aren't coming through. By opening the apps, I can sync manually.
2) When I move a file to a new folder using the Downloads app (Files app, stock one) I get a error message saying the move operation failed. This also triggered the photo notifications from Messenger Lite (same behavior as described above, with six photos). However, after a while the moved pictures are indeed in the right folder, even though the error message saying otherwise.
3) After some time I remove "app data" for the Google Play app. When I open it after that, there are now three app updates pending (e.g. Google Wifi also). But the same behavior occurs, when I try to download one or all of them, I get the Messenger photo notifications and the updates halt at 100 % without installing. So the BankID app - which could be targeted by attackers for obvious reasons - could just be a coincidence. It could have happened with any app I suppose, this was the only one pending right then. But still, why couldn't Play Store detect other pending app updates until I refreshed it the way I did? Was Play Store blocked from connecting to Google (or forced to connect to some other server, perhaps?).
What did I do after all of this?
I uninstalled three apps:
-Facebook Lite
-Facebook Messenger Lite
-Pixel Launcher APK
However the uninstall process was very odd. A process called "Package Installer" had a notification saying "Uninstalling Lite" and "Uninstalling Messenger Lite". It didn't seem to be working, it was stuck after some time. I restarted my phone and the apps seem to be gone now, at least they aren't listed in Settings --> Apps. So the uninstall process was successful I suppose, even though it didn't seem to work.
After I restarted my phone I also noticed:
-When I install Messenger Lite from Play Store now, it's easy to uninstall it the way it should be - in mere seconds.
-When I open Play Store, updates are now installing fine. Play Protect is also scanning fine now.
Everything looks back to normal now. But I'm not trusting my device. I'm gonna factory reset it. Before I do, I wonder:
-Can I feel safe the wipe would erase whatever malware I might have had on the phone?
-Is there something I could do to let us know what caused this? Upload a log here somehow?
The only piece of advice I have received as of now is: "Try restarting in safe mode, installing some AV software, and generally looking for suspicious processes." I haven't done that yet, would it still be a good thing to do? Must I install AV software before rebooting into safe mode, or could I install it directly from safe mode? (App suggestions, AV software?).
Usually I'm very careful and security-minded. I haven't had something like this happen before. So I'm very intrigued and mad about this. I'm gonna change my Google account and Facebook account passwords later on I think (I already have 2-factor authentication enabled).
One last thing: When I install Pixel Launcher on my non-rooted phone, it's not running as a system app if my understanding is correct. (At least it shouldn't be). But none the less, when I wanted to uninstall it I had to go into Settings --> Apps and tap "Show system apps" to find it in the list. Is that normal? Perhaps it doesn't mean anything, I just want to know.
Thanks for your advice in advance. Anything else to add? What should I do know? All you might have to say is appreciated.
Come on now guys, someone must be able to help?
If I factory reset the device, will it be clean? I didn't mess with custom ROMs, root, the bootloader or something else. (I suppose the bootloader is locked).
My phone was serviced "reprogrammed" and when it came back I keep getting ads. I tried resetting the phone but it still keeps getting adware silently installed. Is there any way to fix this?
You are not alone. Bought this phone for my mom since she likes a bigger screen to do social media stuff. The malware popped in after the last ota. The official wirelessupdate app included on the phone silently installs random apks that pushes full screen ads and impersonates clicks even if the the phone is not being used. This is common with generic android phones coming from CHINA
I haven't figured out a way to root the phone as most rooting methods will fail(because of the sucky spreadtrum SOC which makes it difficult to root the phone).SADLY, rooting is the only way to disable/uninstall the wirelessupdate app.
However, here's a workaround I found that works.
1) restrict your network to limit background data usage (Found in settings).
2) **uninstall the malware app: finding the app may be difficult as It normally disguises itself as a system app with names like radio, settings, wifi or some application name that doesn't even make sense. It uses a lot of data and is always active. You'll know its the fake app if it poses as a system app but you have the option to uninstall it(System apps cannot be uninstalled without root/Su access).
Buttt....
The wireless update will probably install another malware app after uninstalling the current one.
3)disable notification of the app so it doesnt send fake notifications to you that opens ad based webpages as it also fakes notification, posing as a fake notif from FB, whatsapp
4) force stop it and stop the services from settings so it doesn't load or push apps while you use your phone
Restarting the phone will make the app run again
5) Remove the app's permission. By default its granted access to location, settings, storage and sometimes camera or mic. The wireless app doesnt detect this and wont turn those permission back on
6) lastly, you can contact firefly support AND PRAY TO THE GOOD LORD they know know what they're doing. Because I did and they were completely clueless on the troubleshooting or on the issue itself and even blamed the problem on the user. Ridiculously stupid.
I haven't really tried ADB yet because i don't have the time and the phone lacks resources online to restore it in case I brick it. Frankly, this phone is not worth investing time fixing especially with the quality of support it has from Firefly and the price it asked for.