Android Tablet Browser - Keeps Downloading Suspicious Web Address

[Petepot]

Hi,
When I open my Android tablet browser (within Android Lollipop ) a notice appears which says "Starting Download" and the following text is stuck in the address bar. http://no.stepfaster.com/files/xb_client_130_9111_4_nocion_04_28_apk.
The screen appears blank with only the text above in the address bar.
I have examined my Downloads file, and it now has 7 files named xb_client...28-1.apk running through to 28-7.apk, so I think it downloads and generates an additional file every time I open my browser.
However, if I select a previously saved Bookmark site, my browser opens it normally.
When I close & re-open the browser, it only opens as above and downloads another xb_client file.
I have tried running AVG anti virus and Super Cleaner, but neither have helped.

Can anyone help me to clear this issue ?

Many thanks,
Petepot
Tablet (6 months old) = Fusion 5, 10.6inch, Octacore, 2GB, 16GB, Lollipop.

 

[Javier P]

You could try clearing data for that browser in settings - apps, then delete all those files from the download manager and restart the device.

 

[ivomin]

Kill your browser and then if you can go and delete /data/data/com.android.browser/shared_prefs/xbservice.xml file.... or you can edit it... there you will find that url. You can replace the url with google.com if you wish.... but i would suggest to just delete the file and go with more stable default browser for everyday use. Don't forget to restart after that.

 

[lovemonkeysd]

I have the same problem as Petepot. My stock Browser instantly downloads http://no.stepfaster.com/files/xb_client_v30_9111_4_nocion_04_28_apk. whenever I open it. The only difference is Petepot's file is "client_130" and mine is "client_v30"

That file is Malware according to AVG antivirus.

My tablet is a DragonTouch E70
The browser is just named 'Browser' and is version 4.4.2-eng.lile.1418290424
Android Version is 4.4.2

I've tried clearing Browser cache, doing force stop, going into the Browser app, tapping settings, and clearing all cache, history, cookies, form data, and passwords, etc. I've gone in to Running apps, found Browser, and there is XbApplication listed under Browser, so I tapped Stop.

This did not work. It still downloads the xb_client_v30_9111_4_nocion_04_28_apk file when opening Browser.

I then rebooted in Safe Mode by doing this:
While powered on, press and hold Power until the Power Off menu appears. Press and hold the Power Off selection until the Safe Mode prompt appears. Tap OK.

I then repeated all the cache clearing and force stopping above. Unfortunately, when opening Browser it still downloads that stupid file.

I did a Factory Data Reset, but before I reset I went to Settings>Backup & Reset, and unchecked Automatically Restore.

The Factory Data Reset temporarily solved the problem. The stupid xb_client_v30_9111_4_nocion_04_28_apk file came back in a couple of weeks.

ivomin, I also tried finding the file you mentioned by hooking my tablet up to my computer, but I could not find it. I found data/com.android.browser, but there was nothing in the folder. I deleted the folder entirely. That did not solve the problem.

I really believe that the malware file attached itself to the hidden internal storage of my tablet and rewrote the code for the Browser app to make it go to http://no.stepfaster.com/files/xb_client_v30_9111_4_nocion_04_28_apk every time I start Browser.

I do not know how to get to the hidden internal storage, which I think is the actual operating system files. Is there some sort of regedit.exe function for an android tablet so I can get to that part of the tablet?

Otherwise, I'm thinking it's time for another Factory Data Reset and never open the 'Browser' app again. I'll download Chrome and use that.