• After 15+ years, we've made a big change: Android Forums is now Early Bird Club. Learn more here.

Help Redirection virus

shantanu88d

shantanu88d

Newbie
Hello,
Since last couple of months I am being tormented by this redirection virus or malware or something like that. Whenever I browse on the net, regardless of any browser I use, randomly I am redirected to some fake pages asking to download some apps for sony xperia m. Redirections happen only sometimes, but completely randomly. When redirection begins url like onclickads.com or spaces.slimspot.com can be seen.

I have tried a lot of ways to tackle this. Uninstalled suspicious apps, cleaned cache memory, removed browser extensions,installed avg Antivirus, cm security scanner. Nothing helped. Then out of frustration I flashed my phone. But still virus found its way back. I am totally frustrated. Please, somebody help me out with this. I m running on Android 4.3
 
Hi

Which country are you in? If you flashed your phone's rom and memory and it re-occurred, it sounds like its from your service provider.
 
Or you are visiting sites that are infecting your browser(s). Did you try clearing data for the browsers as well as their caches?

If you have a spam problem, downloading a "CM" app is not going to help - Cheetah Mobile are part of the problem there rather than the solution.
 
girolez said:
Hi

Which country are you in? If you flashed your phone's rom and memory and it re-occurred, it sounds like its from your service provider.
Click to expand...
If it from service provider how can i be sure of that? I have noted on strange thing that my router's default dns address keeps on changing. I set it to automatic next time i login it changed!
 
Hadron said:
Or you are visiting sites that are infecting your browser(s). Did you try clearing data for the browsers as well as their caches?

If you have a spam problem, downloading a "CM" app is not going to help - Cheetah Mobile are part of the problem there rather than the solution.
Click to expand...
I formatted entire phone. Still virus reappeared. It is not specific to a website. Even while trying to get to this page I got redirected once
 
Where are you actually installing apps and games from, Google or Amazon, or somewhere else?

But then there's also a possibility that your router might be compromised(pwned), that can happen. Are other devices and computers using it?
 
mikedt said:
Where are you actually installing apps and games from, Google or Amazon, or somewhere else?

But then there's also a possibility that your router might be compromised(pwned), that can happen. Are other devices and computers using it?
Click to expand...
Yes, my desktop and mobile access same router
 
Shan,

You might want to try rebooting your device in Safe Mode and see if the redirecting happens in that state. If you can browse without it redirecting you while in Safe Mode, more than likely you have some kind of malignant program installed. If that is the case, you'll want to scan your device to see if the problem app/program can be detected. If your device did not come with Lookout Security & Antivirus pre-installed, you can download it from the Google Play Store free of charge. Log into that app with your Google account, and you'll get access to a free anti-virus that's guaranteed to not mess up your phone. Run that anti-virus in Safe Mode to make sure whatever you may have downloaded does not interfere with the scan.

On the other hand, if your browser continues to redirect you and you're not connected to Wi-Fi, more than likely you either have an issue with accumulated cache, or an issue with your OS. If it's a cache issue, clearing app cache/data from all your browsers and power-cycling should solve the issue. Otherwise you might have to either check to see if you can upgrade your OS or you might have to try another master reset.

If the issue continues after all of that, your last option would be to either contact your service provider or your device's manufacturer to find out what repair/replacement options you may have for your device.
 
Kibaikasu said:
Shan,

You might want to try rebooting your device in Safe Mode and see if the redirecting happens in that state. If you can browse without it redirecting you while in Safe Mode, more than likely you have some kind of malignant program installed. If that is the case, you'll want to scan your device to see if the problem app/program can be detected. If your device did not come with Lookout Security & Antivirus pre-installed, you can download it from the Google Play Store free of charge. Log into that app with your Google account, and you'll get access to a free anti-virus that's guaranteed to not mess up your phone. Run that anti-virus in Safe Mode to make sure whatever you may have downloaded does not interfere with the scan.

On the other hand, if your browser continues to redirect you and you're not connected to Wi-Fi, more than likely you either have an issue with accumulated cache, or an issue with your OS. If it's a cache issue, clearing app cache/data from all your browsers and power-cycling should solve the issue. Otherwise you might have to either check to see if you can upgrade your OS or you might have to try another master reset.

If the issue continues after all of that, your last option would be to either contact your service provider or your device's manufacturer to find out what repair/replacement options you may have for your device.
Click to expand...
Start device in safe mode, means which device? Router? I have tried 4 5 different famous anti virus. No one was able to find any sort of virus
 
shantanu88d said:
Start device in safe mode, means which device? Router? I have tried 4 5 different famous anti virus. No one was able to find any sort of virus
Click to expand...
Device meaning the smartphone or tablet you're using. Just like with a regular computer, all Android devices are able to be rebooted in Safe Mode.

When in Safe Mode, no apps other than what came pre-installed will be available for use. You should be able to run an antivirus then.

If you do this, along with all other advise I posted in the previous post and you still have issues, you might want to experiment with another, separate device (another smartphone or tablet) and see if you can replicate the issue on that 2nd device while on Wi-Fi. If you can, then it's your modem that's infected. In that case, contact your ISP as soon as humanly possible for help in getting the modem cleaned or to get the modem replaced entirely.
 
Kibaikasu said:
Device meaning the smartphone or tablet you're using. Just like with a regular computer, all Android devices are able to be rebooted in Safe Mode.

When in Safe Mode, no apps other than what came pre-installed will be available for use. You should be able to run an antivirus then.

If you do this, along with all other advise I posted in the previous post and you still have issues, you might want to experiment with another, separate device (another smartphone or tablet) and see if you can replicate the issue on that 2nd device while on Wi-Fi. If you can, then it's your modem that's infected. In that case, contact your ISP as soon as humanly possible for help in getting the modem cleaned or to get the modem replaced entirely.
Click to expand...
I am an android noob. Don't know how to enter safe mode. Please tell me how to. Also, on one day I got redirected to some random playstore app even when I was on mobile internet. So can this be router issue now?
 
shantanu88d said:
I am an android noob. Don't know how to enter safe mode. Please tell me how to. Also, on one day I got redirected to some random playstore app even when I was on mobile internet. So can this be router issue now?
Click to expand...
If it happened while on mobile data, then it's definitely an infected smartphone. Either an app or a website infected your Xperia.

To enter safe mode on your particular smartphone, turn off the phone completely. Then, turn it back on immediately. When your screen turns back on, hit the menu button and keep pressing it until it finishes booting up. You'll know you're in Safe Mode if you see the words "Safe Mode" on the bottom-right hand corner of the screen.
 
Kibaikasu said:
If it happened while on mobile data, then it's definitely an infected smartphone. Either an app or a website infected your Xperia.

To enter safe mode on your particular smartphone, turn off the phone completely. Then, turn it back on immediately. When your screen turns back on, hit the menu button and keep pressing it until it finishes booting up. You'll know you're in Safe Mode if you see the words "Safe Mode" on the bottom-right hand corner of the screen.
Click to expand...
Which menu button? Xperia has no physical buttons for menu. Only power button, volume rocker and camera button
 
Hey guys, I booted in Safe Mode. I have been browsing the web for more than 15 minutes now, on random sites. There seem to be no redirections any more. What would this mean now?
 
shantanu88d said:
Hey guys, I booted in Safe Mode. I have been browsing the web for more than 15 minutes now, on random sites. There seem to be no redirections any more. What would this mean now?
Click to expand...
It means that you have malignant apps/processes installed on your phone. They're not running because safe mode isn't letting them. Find the culprits and uninstall them or do a factory reset if you can't find the cause.
 
KI begibaikasu said:
It means that you have malignant apps/processes installed on your phone. They're not running because safe mode isn't letting them. Find the culprits and uninstall them or do a factory reset if you can't find the cause.
Click to expand...
Where do i begin from? how can I find those processes. If they exist on my device how come they returned even after i flashed my phone? In the meanwhile my router's default dns keeps on changing on its own. How's that happening i have no idea.
 
It sounds like it is your router that is infected.
It is redirecting DNS to a malicious site that returns false IP addresses to malware sites.
 
I agree with glc. If your router's DNS is constantly changing, that's a definite sign that your router is acting in an abnormal fashion and could very well be infected. If the same thing happens on your phone's mobile data, you will have to do a factory reset, as that is literally the only thing you can do on your part to attempt a permanent fix. Otherwise, it might be time to contact your manufacturer or service provider for a warranty replacement.
 
You must log in or register to reply here.
Back
Top Bottom