New income stream 🤔 - Cleaning smartphones adwares
- Thread starter Rigo
- Start date
Markverhyden
Well-Known Member
- Reaction score
- 11,342
- Location
- Raleigh, NC
Were they browser based or from apps?
From apps, pdf readers so far
One video downloader as well actually
Last edited:
frase
Well-Known Member
- Reaction score
- 4,841
- Location
- Melbourne, Australia
..A.I > Nudie apps probably as well.
Just had one of these today. Android phone with ads with fake alerts popping up over the top of other apps with no obvious way to get back to home screen.
I managed to get to Settings > Apps and stopped/uninstalled recently "used" apps (several PDF related ones according to the names). The owner told me a couple of clues about how the phone might have been infested with adware:
1. He went to open a PDF attachment from email, the app selector popped up with a list of PDF related names, he selected one and that may have caused it.
2. He also complained about the Youtube app telling him his software was out of date. I opened Youtube and the top half of the app was a scammy ad saying he needs to update some app (rather vague but insistent with animation) and pressing on it opened the Google Play store with a PDF Reader app ready to press install.
I suspect 2. is what he did first, earlier. Then when he went to open an email attachment he invoked the scammy PDF Reader app, because it seemed the most obvious app name. Can anyone else confirm that is likely what happened?
I managed to get to Settings > Apps and stopped/uninstalled recently "used" apps (several PDF related ones according to the names). The owner told me a couple of clues about how the phone might have been infested with adware:
1. He went to open a PDF attachment from email, the app selector popped up with a list of PDF related names, he selected one and that may have caused it.
2. He also complained about the Youtube app telling him his software was out of date. I opened Youtube and the top half of the app was a scammy ad saying he needs to update some app (rather vague but insistent with animation) and pressing on it opened the Google Play store with a PDF Reader app ready to press install.
I suspect 2. is what he did first, earlier. Then when he went to open an email attachment he invoked the scammy PDF Reader app, because it seemed the most obvious app name. Can anyone else confirm that is likely what happened?
This aligns with what the client for the first job I received said.
The other clients didn't know what happened.
One case downloaded scammy cleaners to try to fix their problem just adding more to what was already happening. They didn't say so but there were about 8 cleaners in there.
Yes, it's a case of trying to force stop and unintall whatever is obviously not supposed to be there.
britechguy
Well-Known Member
- Reaction score
- 5,185
- Location
- Staunton, VA
A general observation: The general public never seems to learn.
This story keeps repeating itself across decades and platforms. I really don't know how/why most adults *can* get infected in this way if they're paying the slightest bit of attention and using very, very basic "sniff test" security procedures.
However, I know that they still *do* get infected because they don't bother with "sniff testing" when something "odd" appears, or they "know I shouldn't have done that" almost instantaneously after having done it, rather than having given pause and not having done it.
This story keeps repeating itself across decades and platforms. I really don't know how/why most adults *can* get infected in this way if they're paying the slightest bit of attention and using very, very basic "sniff test" security procedures.
However, I know that they still *do* get infected because they don't bother with "sniff testing" when something "odd" appears, or they "know I shouldn't have done that" almost instantaneously after having done it, rather than having given pause and not having done it.
lan101
Well-Known Member
- Reaction score
- 737
Any good legit cleaning tools at all that are free? I was doing a computer setup earlier this week and they mentioned their smartphone was plastered with ads. They literally just got it like 2 weeks ago lol. There wasn't much of anything on it so I just factory reset it and signed back into the google account and all was good...but many people that wouldn't be the best route to go.
I feel like before it was just a crap shoot on some app causing it but you're just literally guessing and praying you find the right one and uninstall it. Some game or weather or pdf app garbage. Sometimes it's been notifications too that's usually easy to pinpoint. It's the random ad pop ups that seem to be a little tougher.
I only run into once in a while though really.
I feel like before it was just a crap shoot on some app causing it but you're just literally guessing and praying you find the right one and uninstall it. Some game or weather or pdf app garbage. Sometimes it's been notifications too that's usually easy to pinpoint. It's the random ad pop ups that seem to be a little tougher.
I only run into once in a while though really.
Mick
Well-Known Member
- Reaction score
- 813
- Location
- Cambridge, UK
There's a Malwarebytes for Android. No idea if it's any good, I've never needed to try it. But free for personal use by the look of it.
These are not real infections per say and legitimately installed so antivirus including MBAM do nothing with them.
I've tried. The guy with the cleaners had tried Norton/MBAM/Macafe unsuccessfully before giving up and bring it to me.
The only way is to disable internet access then manually identify what doesn't appear legit, force stop/uninstall and all good.
For how long this will survive depends on what @britechguy said.
lan101
Well-Known Member
- Reaction score
- 737
Good point I didn't think about putting in airplane mode to stop the annoying ads lol. So it's basically just airplane mode and hope and prey you find the app doing it. I guess sorting by the latest installed would probably help pinpoint it better.
Disable wlan and sim service access, cleanup and re-enable
