Help Xperia Z Malware

[holcus]

Hi, I can't get rid of an adware on my Sony Xperia Z C6603. From time to time I get popups from various phishing sites like getappdeals(.)com, store.apple.com-free(.)tech

I am on 5.1.1 stock firmware, the device has never been rooted or tempered with. About a month ago I unclocked it with a code from my service provider.

I tried performing factory default from settings menu, installing a ROM using that guide http://forum.xda-developers.com/xperia-z/general/guide-how-to-package-flash-stock-roms-t2914567
using this ROM: C6603_Meteor IE_1270-5992_10.7.A.0.222_R1E and selecting wipe: USERDATA

but the adware keeps going back even if i am not restoring my contacts etc.
Any thoughts?

 

[Hadron]

Did you actually manage to install the ROM? Some malware can install to system (which will survive a factory reset) but flashing a ROM would remove that. But if you didn't succeed in flashing the ROM then that could be the problem.

Otherwise are you restoring any apps, or syncing a browser with some account? If it's not in the system then it must be returning through something you are installing, restoring or from some website you visit (if it's a browser hijack rather than a malware app). Make sure you have the option to install from unknown sources deselected (though even if not you should have to confirm installation).

 

[Slug]

If you flashed a clean official firmware package via Flashtool and wiped /data then it's not installed adware but most likely a browser hijack/redirection. Open Chrome, select History from the menu, then Clear Browsing Data and select everything. Hit Clear, restart phone and (hopefully) this annoyance will be gone forever. If not report back and we'll nuke it from orbit...

 

[holcus]

Thanks guys, What I tried just today was to reflash ROM and do not restore anything - neither from PC companion nor google account. Flashtool reported that it was successful. I did not sign on to neither google, nor facebook or anything else. I went through initial config cancelling all features requiring account. I then downloaded the internet settings from my operator and clicked on accuWeather - an app included in a ROM from my operator. First thing that came up was a popup.

Maybe that app is somehow malicious?

Anyway I used a different ROM and testing it now - so far so good

I'll try clearing chrome data once I get back home