How do I get rid of this Russian pop up?

[nastyrash]

Russian pop up

Hi there,
I would be grateful if anyonw has any suggestions to the following:
I have a galaxy Note 3 running lollipop 5 (o2). I have an issue when visiting web pages (seemingly the first time i visit).
The issue is that as the web page opens I get a pop up. The pop up box says the following: "The page at (whatever site address you are on) says" then there is 8 further russian words ending in a question mark with an option of "Cancel" or "ok" if you select cancel then nothing haoppens and the dialogue box dissapears, if you select "ok" then then I am taken to the Play store and to a page for an app called "TokensApp" by Android developer 58.

This happeneds with Firefox browser (uninstalled and reinstalled still the same) on chrome and duck duck go.

I have looked in app manager and cant see anything obvious, I do not have lots of apps installed although there are a lot of samsung and google apps which I do not know. I am running paid for "bitdefender" "Malware bytes" and CM security all of which scan and say no infection.

Is it best to just factory restore and start again?

Thanks in advance.

 

[belodion]

Re: Russian pop up

Have you tried Safe Mode?

 

[nastyrash]

Re: Russian pop up

still appeared in safe mode but the box dissappeared now cant replicate again in safe mode. what else should i be looking to do in safe mode?

 

[nastyrash]

if anyone is interested.... it appears after deleting and disabling everything on my Note 3 which had no impact and no further info here, I was resigned to the pop which kept appearing, I just gave up and assumed a factory install would sort it out. Before I did this I had some other tech related chores, and here is where I found my solution.

Now, at first glance, and seemingly unrelated to my phone, i was also getting spurious adobe pop ups on my PC so i reformatted my PC SSD. HD wiped and reformatted with the Samsung magician what happened next made my blood boil but lead me to the solution. With a fresh install of win 7 and after all the updates applied I tried to DL my antivirus, as soon as I went on the website of the AV company, there appeared the bogus adobe pop up (bogus as although i clearly needed adobe flash player, the file dl address was not adobe but instead some dodgy named site) so after several deep breaths and resisting the urge to wander downstairs into the garage and return with a large hammer and an energy bar, i googled about a bit more.

I found that my Asus router was vulnerable to hackers and as my firmware wasn't up to date (I know!) i seems I could very well have been hacked, there is plenty of info on google about Asus router vulnerability and the importance of UTD firmware. Now this then meant I had to wonder if perhaps my phone and PC pop up issues were related. It appears (although I do not have the tech ability to confirm for sure) that the issue was with the internet connection not the phone.

I can't remember for sure if the phone pop up only happened at home on wifi (i have a home office as well and as such i am here a lot of the time) but I can report after installing the latest firmware on my router, no more pop ups on my PC, but more importantly and relevant to this post, no more pop ups on my Note 3 which were still happening right up to the router firmware install. I hope this helps someone else by making them consider the internet connection as well as the phone.

 

[najbarajo]

This post is exactly what i've been looking for....I am in the very same situation, two android phones getting Russian popups taking me to 'TokensApp', and a Windows PC that keeps getting fake Adobe popups, all connected to my home network through my Asus router. The only difference is that I also got the Russian popup when using my mobile data too

I actually reset my router to Factory settings and checked it was on the latest firmware as I thought it couldn't be a coincidence that this all started happening at the same time. This didn't actually fix the issue though. What Asus router do you have, and did you just check for the latest firmware through the routers config page?

I've only found one other person with this issue who seemed to find that their routers DNS settings had been changed. That doesn'yt look to be the case with me either though