• After 15+ years, we've made a big change: Android Forums is now Early Bird Club. Learn more here.

Android Malware - unable to remove

G

George L Smyth

Newbie
I have got a Samsung Galaxy S3 with Android version 4.4.2. Recently, on an occasional basis, when opening an app (it might be going to Facebook, it might be opening Score, it is not consistent) I am first taken to the Google Play Store and Uber has been selected for me to download. It does not happen every time, but several times a day. I have AVG and Clean Master on the phone and neither are finding any problems. I have even tried downloading the Uber app and this still happens.

I am not knowledgeable about such things and have no idea where to turn. Any suggestions would be greatly appreciated.

Thanks -

george
 
Clean Master and anything else by Cheetah Mobile would be the first thing I would uninstall. Notorious for data mining and other shady practices.
You can also boot into recovery and wipe the cache partition then restart.
There is a free app at the Play Store called Addons Detector which might find what is redirecting you to the Play Store
 
Could be it's Clean Master taking you to the Play Store. Cheetah might receive an affiliate commission if you install and use Uber, or whatever else is pushed.
 
I removed Clean Master after it was unable to find anything. I do not believe that I have anything else by them installed on the phone.

In addition to what was happening, if my phone is asleep for a period of time, when I wake it up then following the unlock it asks how I want to open "the program". I select Chrome (I also have Firefox and something called "Internet" and it opens Chrome and redirects to open the Play Store, with Uber selected.

george
 
After you unlock your phone, either with pin or swipe, you shouldn't see any pop up message. Are you using the default TouchWiz launcher?
 
I am using the lock with the nine dots. I was not getting the pop-up before this thing attached itself.

It just happened a little while ago and I told it to open with Firefox, which left the URL (I had not been able to capture it in Chrome). In case it is any help, this is the URL:

https://90832.measurementapi.com/serve?action=click&publisher_id=90832&site_id=26744&destination_id=23524&agency_id=608&ref_id=102a8b673b2f04595f90c2bc1a600c&sub_placement=Piano&sub_campaign=Display-Tapit-Fetch_1_-99_US-national_R_And_ACQ_CPI_en_Ongoing&sub_adgroup=A081_A182_D544595&sub_ad=PM_16237-RD-en-US-op6_NotReadyYet_320x50&device_ip={device_ip}&user_agent=Mozilla%2F5.0+%28Linux%3B+Android+4.4.2%3B+SPH-L710+Build%2FKOT49H%29+AppleWebKit%2F537.36+%28KHTML%2C+Like+Gecko%29+Version%2F4.0+Chrome%2F30.0.0.0+Mobile+Safari%2F537.36&tracking_id=102a8b673b2f04595f90c2bc1a600c&sub_publisher=1035&sub_campaign_ref=4384&sub_campaign_name=US+%28National%29+-+Uber+US+-+Android+CPI&android_id=&mac_address=&ios_ifa=&google_aid=&windows_aid=&cost=3.50&cost_model=cpa

Going to measurementapi.com directs one to the Google Play Store.

george

george
 
Did you try the Addons Detector app?
Next time the pop up appears, can you take a screenshot?
I would also go to each one of the browser's that you are using in the app manager, force stop and clear the cache and data then restart the phone.
 
The pop-up is the standard "which app do you want to use" box. I'll do the force stop on each browser as suggested and see if that helps.

george
 
Looking over your previous post, the lock screen that you mentioned, the nine dots is something that I'm unfamiliar with. I have seen pin, pattern and password. Is this something custom that you installed?
 
Jfalls63 said:
Looking over your previous post, the lock screen that you mentioned, the nine dots is something that I'm unfamiliar with. I have seen pin, pattern and password. Is this something custom that you installed?
Click to expand...
Nine dots is how the pattern lockscreen looks. You create a pattern that connects the dots in some way.
 
The problem still exists.

Google backs up my images and I use Google's contacts. It is my understanding that if I do a factory reset then Google will reload my apps and then I would just need to okay updates as they are noticed.

Is this correct? If so then I will go ahead and do that, as I have no other alternatives coming my way.

george
 
Everything you have backed up through Google will restore automatically when you log back into your account.
I was going to suggest a Factory Rest but wanted to wait and see if anyone else had any ideas.
If something ugly got installed into your system, a factory reset will re-install it.
If that is the case, you will need to reflash your stock firmware.
 
You must log in or register to reply here.
Back
Top Bottom