Technical issue/possible malware?

[AC Question]

Hi. Sorry if this isn't the correct place for a technical issue, but I was wondering if anyone could help me as I'm not very tech-savvy and I'm having no success finding help with this issue.

I've been experiencing problems with random ads popping up on my phone (a Kazam Tornado 348) every so often, so I downloaded a Malware scanner. The scan flagged up one app detected as malware (PUP.Adware.Gmobi), but attempts to uninstall this app have been unsuccessful. I even went to the last resort of factory resetting my phone, and the app is still present. I'd read something about cheaper phones coming with adware-type apps pre-installed, but wasn't sure as to the legitimacy of this claim as I purchased my phone via my phone provider's official website (Virgin Media).

When I looked at the app info under Settings, it shows up as a 'Software Update' app with a blue icon with a white upwards-pointing arrow on it (I'd attach screenshots, but can't see a facility to do this). A package name of 'com.rock.gota' is displayed, which is meaningless to me, and Googling it seems to bring up mixed results of its significance. The thing that concerns me most is the permissions of this app, as the only permission it has is 'read sensitive log data'. I can't do anything to change this permission, and I'm concerned my security may be being compromised.

I rang the phone provider's customer service, who despite being very polite said they weren't sure what to do, but suggested I update Google Play Store? Which doesn't seem to have done anything to help. I've cleared the cache/data and forced stopped the app, but it seems to sporadically restart itself so I'm having to keep checking it and stopping it again.

I just want to know whether this is normal and the malware scanner is giving me a false positive (neither my antivirus, nor other scanners I've used in an attempt to remove the app have flagged it as problematic), or if not, if there's anything I can do about this that doesn't involve invalidating my warranty (e.g. rooting)?

Any pointers in the right direction would be most appreciated!

 

[B. Diddy]

Welcome to Android Central! Do these ads occur only while browsing, or do they also pop up when you're on the homescreen or within another app?

Adware is is typically installed alongside certain apps (often in a sneaky way, without warning you ahead of time), but there are phones that have it preinstalled as well. Sometimes it's clearly mentioned in the specs (and lowers the price, like certain Blu phones sold through Amazon), but other times it's inserted without any real mention (which can be seen in some phones direct from China). Remember that adware isn't necessarily malware, in that adware usually isn't malicious -- just annoying. But it's usually considered PUP (Potentially Unwanted Program) by antivirus programs, which is why it's being flagged.

Does it happen in Safe Mode? If so, then the adware either came with the phone (most likely) or some bit of malware installed it to the system root (unlikely). It's highly unlikely that updating the Play Store will do anything about this. To boot into Safe Mode on most Android devices, while powered on, press and hold Power until the Power Off menu appears. Press and hold the Power Off selection until the Safe Mode prompt appears. Tap OK.

 

[tech-dummy]

Hi. Thank you so much for your reply; I feel like I'm getting somewhere now.

The ads were popping up when I was browsing in Chrome. They were really more like phishing attempts than ads, such as 'Virgin' telling me I had 3 minutes to click a link and get a brand new £1000 phone or some such garbage. I guess something else could have been causing that to happen though. I haven't noticed it happening again since I reset the phone, so hopefully it won't happen again.

I also went through a phase where every time I turned my phone on, this 'Software Update' icon would appear in my notifications bar, saying something about some unspecified software needing updating. Once again, this hasn't reoccurred since I reset the phone. Maybe the phone was just struggling to legitimately update something and the reset cured it? I don't know.

The app still appears when in safe mode, so I guess it's pre-installed. Since I purchased the phone from a legitimate source, it seems unlikely that it would have something malicious pre-installed on it. It also reassures me that you say adware isn't always malicious though, as I wasn't sure of the difference. As well as the 'Gmobi' part, the malware scanner labelled the suspicious app with the words 'Android/RockClient.apk'. Although I have no idea what this means, Googling it hasn't brought up any definite negative results, which is promising.

Virgin have offered for a technician to have a look at my phone, but I'm starting to think it'll be a waste of time. I wish I knew someone else with the same model phone so I could confirm that this is just a thing that happens with the Tornado 348.

Many thanks once again. I really appreciate that you took the time to answer me.

 

[B. Diddy]

Popups that occur only while you're browsing are almost certainly associated with the website you're visiting. Although annoying popups like this are usually associated with, shall we say, less-than-savory websites, they can also appear in more mainstream sites as well. Unfortunately, there's not that much you can do besides avoid the site. You could try the brand new Firefox Focus browser, which is supposed to have pretty good ad-blocking.

As for Gmobi, I found this article: New Android Gmobi adware found in firmware and popular appsSecurity Affairs. As they mention there, it's not malware per se, but it is annoying and potentially unsafe for the manufacturer (or an app developer) to have this degree of control over the phone. If it's concerning enough to you, you may want to talk to Virgin about it and see if they're willing to let you exchange the phone for something else.