1. dgcoventry's Avatar

    I have some sort of infection on my Android device as shown on my screenshot above.

    I have installed Malwarebytes but the scans tell me that the device is clean.

    The green popups purport to download and install legitimate apps but if they are inadvertently tapped, they download malware.

    The popups only appear in the various browsers. Ie. if I install Chrome, then they activate in Chrome and if I uninstall Chrome and install Firefox, then they appear in Firefox.
    07-13-2017 01:32 AM
  2. B. Diddy's Avatar
    Welcome to Android Central! Are you sure those popups aren't just associated with the sites you're visiting?
    07-13-2017 03:10 AM
  3. dgcoventry's Avatar
    Thank you.

    No, the screenshot shows the popup on this website.

    Edit:- Sorry, wrong screenshot uploaded.How can I get rid of green popup malware-screenshot_2017-07-12-08-50-52.png
    Attached Thumbnails How can I get rid of green popup malware-screenshot_2017_07_08_08_57_15.png  
    07-13-2017 04:26 AM
  4. B. Diddy's Avatar
    Ok, but do the popups appear exclusively while you're using a browser, or do they also appear on the homescreen or when running other apps?
    07-13-2017 01:17 PM
  5. dgcoventry's Avatar
    They don't appear in other apps: just in browsers.

    Firefox, Chrome and the default browser which came with the tablet are all affected.

    Other apps are not, as far as I can tell.
    07-14-2017 01:33 AM
  6. B. Diddy's Avatar
    Try going to Settings>Apps, select the browser, then Clear Cache/Clear Data. Also, in Chrome, go to the Privacy settings and clear all browsing data "from the beginning of time."
    07-14-2017 12:10 PM
  7. dgcoventry's Avatar
    Clearing the cache and data has no effect.

    The popup is still there.

    It really is a nuisance with it making the browser unresponsive.
    07-16-2017 04:40 AM
  8. B. Diddy's Avatar
    And you also cleared the browsing data as well, right?

    The next step is to start uninstalling apps one by one to see if the problem goes away. Start with some of the more common culprits like 3rd party battery-saver apps, "RAM boosters," flashlight apps, antivirus apps (apart from well-respected ones like Malwarebytes), certain keyboard apps, and certain file manager apps.
    07-17-2017 12:33 AM
  9. dgcoventry's Avatar
    I have removed all downloaded Apps.

    The problem still persists.

    It's got to the point where I don't use the device anymore.
    07-20-2017 04:00 PM
  10. Rukbat's Avatar
    As B. Diddy said, it looks as if those are popups generated by the site. Does this site (if you go to it with a browser) generate the popup? If not, it's the sites you go to. (A website can put a popup anywhere on your screen, seemingly part of the web page or seemingly not part of the web page - the only difference is the 'target' of the popup, so it's trivial for someone to write the kind of popup you're getting. (If they did a better job, it would refer to Android tools, or "for Android professionals". A generic ad like that is just plain old improperly-developed adware.)

    If it's not, try installing AdAway v3.2 or AdWare.
    B. Diddy likes this.
    07-20-2017 04:32 PM
  11. B. Diddy's Avatar
    @Rukbat makes a very good point. Unfortunately, the Android Central site tends to be plagued by intrusive ads. You may want to try using the Tapatalk app instead.
    07-20-2017 09:29 PM
  12. Doug Moffat's Avatar
    Android Central goes in phases. Sometimes it's unuseable on my browser because of pop-ups. Only seems to last a few days. I don't like Tapatalk and end up going back to the browser until a new roundup of pop-ups start. Most of the time the site is cool.
    07-20-2017 11:27 PM
  13. dgcoventry's Avatar
    The popups appear on all sites.

    It will appear on androidcentral.com and it will appear on bbc.com, blender.org and others and it always takes the same form which is the green horizontal banner as in the screenshots above, so I doubt it has anything to do with the sites. Something has installed itself on my device.

    I have removed everything, including watsapp and skype, but the problem still persists.
    07-21-2017 01:15 AM
  14. B. Diddy's Avatar
    Does this happen in Safe Mode as well?
    07-21-2017 03:20 AM
  15. RossJosh's Avatar
    What about your extensions? Maybe running processes? Have you taken a look at that? could be an issue. Also, does restarting your phone after removing apps help?
    07-21-2017 05:45 AM
  16. dgcoventry's Avatar
    The popups persist after removing all data and installed apps and shutting down and restarting does not affect them.

    How do I reset the device to factory settings?
    07-23-2017 06:06 AM
  17. B. Diddy's Avatar
    I don't believe you mentioned which device you have yet, but typically, you can do a factory reset in the Settings>Backup & Restore menu. After the reset, during the Setup Wizard, don't restore previous data -- set it up as if it's a brand new device.
    07-23-2017 12:44 PM
  18. dgcoventry's Avatar
    I've reset the machine to factory settings using your instructions and for a while this sorted the issue.
    However it seems to be back.

    McAfee seems to have identified an app called "MediaService" which may or may not be the culprit. Mcafee does attempt to remove the app, after which it claims success, but the App always reappears shortly afterwards.

    It may be legit as it claims to be packaged under the name "com.google.eMediaService", but I don't doubt that this can be spoofed.
    08-28-2017 07:21 AM
  19. weasel5i2's Avatar
    It seems that it may exist in your phone's firmware, according to recent news:


    Apologies if you already knew about this. They actually link back to this thread on that blog post.

    See here: https://blog.avast.com/android-devic...talled-malware

    Itappears to be installed in your firmware. If you don't want to consider it a total loss, you could try rooting the handset and removing the malware for good with something like Titanium Backup.

    The other option which may happen is that the manufacturer(s) could be embarrassed by the whole ordeal and offer updated firmware images sans-malware in the very near future.

    05-24-2018 05:00 PM
  20. Freddie Green's Avatar
    You Need A New Phone Those Ads Were Caused By Malware That Came Hideing With The Phone
    12-31-2018 09:02 PM

Similar Threads

  1. How to send video to family
    By AC Question in forum Ask a Question
    Replies: 2
    Last Post: 07-13-2017, 05:01 PM
  2. Replies: 1
    Last Post: 07-13-2017, 03:14 AM
  3. How do I transfer messages from Samsung Centura to Samsung S5
    By AC Question in forum Ask a Question
    Replies: 1
    Last Post: 07-13-2017, 03:10 AM
  4. Replies: 1
    Last Post: 07-13-2017, 12:49 AM
  5. How to completely remove data usage warning bar?
    By AC Question in forum Ask a Question
    Replies: 0
    Last Post: 07-13-2017, 12:10 AM