Go Back   Android Forums > Android Phones > Samsung Galaxy S4

New Forums: Nexus Player | Nexus 9
Like Tree2Likes
  • 2 Post By sdrawkcab25

test: Reply
 
LinkBack Thread Tools
Old November 14th, 2013, 09:06 PM   #1 (permalink)
New Member
Thread Author (OP)
 
Join Date: Nov 2013
Posts: 12
 
Device(s):
Carrier: Not Provided

Thanks: 2
Thanked 2 Times in 2 Posts
Unhappy Possible spyware?

Hello,

Since yesterday, websites I visit on my Samsung Galaxy S4 Chrome try to randomly download an APK file called mobogenie_1501.apk. Webpages that trigger this are very random. It happened on Metacritic today. I get the following message "This type of file can harm your device. Do you want to keep mobogenie_1501.apk anyway?" So I tap cancel.

I reverted back to the original "no apps besides the ones in Play Store" setting, but that did not change anything.

Also, I was reading on Feedly. I tapped an article to visit the website (the Wowhead website, to be specific) in Feedly's in-app browser, and I got a popup menu asking me if I wanted to visit Mobo Market.

In the meantime, I upgraded to 4.3. That, of course, did not change anything, either.

I googled Mobogenie. It looks like a legitimate remote management app, but it's definitely not legitimate to have it try to auto-download by itself when I visit random websites.

This surely cannot be a very intrusive way to advertise "Mobo" apps and the marketplace. I'm pretty sure somehow someone or something is trying to access my phone but I have never seen anything like this before. Has anyone ever had an issue like this? Am I just better of wiping my phone and starting from scratch?

Thanks in advance for all input.

PS. I have two screenshots of the APK trying to auto-download in two websites, but no screenshot of the "Visit Mobo Market" dialog box. I cannot post the images because I'm a new user.

Advertisements
domatespatates is offline  
Reply With Quote
sponsored links
Old November 14th, 2013, 10:22 PM   #2 (permalink)
Clueless Senior Member
 
GuitarG20's Avatar
 
Join Date: Jun 2012
Location: Texas
Gender: Male
Posts: 1,793
 
Device(s): Nexus 5, HTC One XL (retired)
Carrier: AT&T

Thanks: 886
Thanked 860 Times in 418 Posts
Default

Welcome to the forums, domatespatates!

You should be able to post the screenshots now. Although I'll be the first to admit I have no idea what is going on here, I'm gonna keep an eye on this thread because I'm curious. Hopefully someone will chime in with more helpful info soon. But go ahead and post those screenshots, if you wouldn't mind
__________________
The FAQ page has the answer to every question you could ever have about the forums, ever!

See something you don't think should be here? Use the report
GuitarG20 is online now  
Reply With Quote
Old November 14th, 2013, 10:26 PM   #3 (permalink)
New Member
Thread Author (OP)
 
Join Date: Nov 2013
Posts: 12
 
Device(s):
Carrier: Not Provided

Thanks: 2
Thanked 2 Times in 2 Posts
Default

Quote:
Originally Posted by GuitarG20 View Post
You should be able to post the screenshots now.
Thanks a lot. I attached the two screenshots I have. If I come across the "visit Mobo Market" dialogue again, I'll definitely grab a screenshot. I'm very curious to understand what's going on as well. That's why I still didn't wipe my phone. Hopefully someone might point me in the right direction to find the source of this problem.
Attached Images
File Type: jpg 1462831_10151944379975677_1751457087_o.jpg (267.1 KB, 56 views)
File Type: jpg Screenshot_2013-11-15-03-22-59 copy.jpg (386.6 KB, 52 views)
domatespatates is offline  
Reply With Quote
Old November 14th, 2013, 10:30 PM   #4 (permalink)
Clueless Senior Member
 
GuitarG20's Avatar
 
Join Date: Jun 2012
Location: Texas
Gender: Male
Posts: 1,793
 
Device(s): Nexus 5, HTC One XL (retired)
Carrier: AT&T

Thanks: 886
Thanked 860 Times in 418 Posts
Default

Just curious, what is that icon in your notification bar in the second screenshot? I'm wondering if that might have something to do with it.
GuitarG20 is online now  
Reply With Quote
Old November 14th, 2013, 10:35 PM   #5 (permalink)
New Member
Thread Author (OP)
 
Join Date: Nov 2013
Posts: 12
 
Device(s):
Carrier: Not Provided

Thanks: 2
Thanked 2 Times in 2 Posts
Default

It's Instashare. I'm quite sure it has nothing to do with the problem. I've been using it a very long time and this APK thing started only yesterday (or maybe two days ago already).

I also want to note, though off-topic, that I wouldn't advise anyone to use Instashare. It was great during beta, but since they've gone on the Play Store as a paid app, it's been incredibly unreliable with virtually no support. Just wanted to make sure that I wasn't advertising for this incompetent thievery :P
domatespatates is offline  
Reply With Quote
The Following User Says Thank You to domatespatates For This Useful Post:
GuitarG20 (November 14th, 2013)
Old November 15th, 2013, 02:48 AM   #6 (permalink)
Senior Member
 
Shotgun84's Avatar
 
Join Date: May 2011
Location: Cambridgeshire, England
Posts: 5,245
 
Device(s): Galaxy S4 GT-I9505 ROM: WanamLite, Kernel: KT-SGS4
Carrier: 3UK

Thanks: 1,613
Thanked 3,039 Times in 1,815 Posts
Default

Hi domatespatates.

When you get the message saying the apk is trying to install is there also a message on your notification panel if you pull it down. If there is long press on it and it should give you the option to select app info which will tell you which app if any is causing the problem.
Shotgun84 is offline  
Reply With Quote
Old November 15th, 2013, 03:13 AM   #7 (permalink)
New Member
Thread Author (OP)
 
Join Date: Nov 2013
Posts: 12
 
Device(s):
Carrier: Not Provided

Thanks: 2
Thanked 2 Times in 2 Posts
Default

Quote:
Originally Posted by Shotgun84 View Post
Hi domatespatates.

When you get the message saying the apk is trying to install is there also a message on your notification panel if you pull it down. If there is long press on it and it should give you the option to select app info which will tell you which app if any is causing the problem.
I did not pull down the notification panel. I will next time when it happens and see if there's anything there. But the notification bar didn't anything anyway (as you can see in the screenshots).

Also, the app causing the problem is basically Chrome at this point since that's the one trying to download the APK. I'll still check the panel next time. Thank you.
domatespatates is offline  
Reply With Quote
Old November 15th, 2013, 03:54 AM   #8 (permalink)
Oil Can!!! Oil Can!!!
 
Metroid Prime's Avatar
 
Join Date: Feb 2012
Location: Land Of Metal
Gender: Male
Posts: 9,106
 
Device(s): Samsung Galaxy SIII
Carrier: AT&T

Thanks: 2,080
Thanked 2,922 Times in 1,883 Posts
Default

Hi there I hope I can be of some help.

Since you say chrome is basically causing the problem have you tried clearing any data on chrome to see if this prevents the problem?
__________________
Android Forums is more than just a forum, it's a community.
Thank helpful posts. Report abusive/spam posts.
Come hang out with us!
The Lounge| Forum Games
Need help? Questions? Ask a Staff Member!
Site Rules/Guidelines|Android Forums FAQ
Metroid Prime is offline  
Reply With Quote
The Following User Says Thank You to Metroid Prime For This Useful Post:
domatespatates (November 15th, 2013)
Old November 15th, 2013, 04:48 AM   #9 (permalink)
New Member
Thread Author (OP)
 
Join Date: Nov 2013
Posts: 12
 
Device(s):
Carrier: Not Provided

Thanks: 2
Thanked 2 Times in 2 Posts
Default

Quote:
Originally Posted by Metroid Prime View Post
Hi there I hope I can be of some help.

Since you say chrome is basically causing the problem have you tried clearing any data on chrome to see if this prevents the problem?
I'm not sure I know what that means exactly, but right now I went to Settings/Privacy and tapped Clear Browsing Data. Do you suggest I do anything else?

Also, to be clear, I don't "really" suggest Chrome is the problem here. But what happens is, when I'm surfing the web, Chrome asks me if I really want to download the APK file (as if I clicked a download link). When I said Chrome is the problem, I meant that I cannot see how another app might be causing the trouble.
domatespatates is offline  
Reply With Quote
Old November 15th, 2013, 05:00 AM   #10 (permalink)
Senior Member
 
ironass's Avatar
 
Join Date: Aug 2010
Location: Cotswolds, England
Gender: Male
Posts: 8,732
 
Device(s): SGS5 SM-G900F. Rooted. KitKat 4.4.4. CM11 ROM. Baseband: NG8. CM kernel+TWRP.
Carrier: Vodafone

Thanks: 1,192
Thanked 3,944 Times in 2,597 Posts
Default

This thread over on xda forums seems to shed more light on the issue which seems to have reared its ugly head in the last 48 hours or so...

Mobogenie_1501.apk downloads by itself

Mobogenie can be downloaded from the Play Store...

Mobogenie Market
__________________
Did you know that hitting the Thanks button is quicker than typing it and the Search button is your friend.

Dummies Guides Rooting Galaxy S4 * Know Your S4 * Update Problems * Knox Security * Bloatware * GPS
ironass is online now  
Last edited by ironass; November 15th, 2013 at 05:06 AM. Reason: more info
Reply With Quote
The Following 3 Users Say Thank You to ironass For This Useful Post:
domatespatates (November 15th, 2013), GuitarG20 (November 15th, 2013), Metroid Prime (November 15th, 2013)
sponsored links
Old November 15th, 2013, 05:12 AM   #11 (permalink)
New Member
Thread Author (OP)
 
Join Date: Nov 2013
Posts: 12
 
Device(s):
Carrier: Not Provided

Thanks: 2
Thanked 2 Times in 2 Posts
Thumbs up

Quote:
Originally Posted by ironass View Post
This thread over on xda forums seems to shed more light on the issue which seems to have reared its ugly head in the last 48 hours or so...

Mobogenie_1501.apk downloads by itself

Mobogenie can be downloaded from the Play Store...

Mobogenie Market
Wow! Thank you so much for this. I could come up with nothing when I searched for mobogenie on Google. If nothing, it's really good to know that this is not a problem that infects just me. I'm sure someone more savvy than me will find out soon what this is all about. It looks like really nasty stuff, though. I hope I won't tap "accept" by mistake until this is resolved :P

I skimmed the thread there. Apparently this happens on any browser and not just on Chrome.

I will follow the linked thread, but please feel free to keep posting here if you feel the need.

Thank you all very much.
domatespatates is offline  
Reply With Quote
Old November 15th, 2013, 05:28 AM   #12 (permalink)
Senior Member
 
Join Date: Aug 2010
Location: PA
Gender: Male
Posts: 5,572
 
Device(s): Rooted Samsung Galaxy Nexus, Rooted HTC Incredible, Stock 4G Motorola Droid Xyboard 10.1 (32GB)
Carrier: Verizon

Thanks: 477
Thanked 1,983 Times in 1,341 Posts
Default

Quote:
Originally Posted by domatespatates View Post
Wow! Thank you so much for this. I could come up with nothing when I searched for mobogenie on Google. If nothing, it's really good to know that this is not a problem that infects just me. I'm sure someone more savvy than me will find out soon what this is all about. It looks like really nasty stuff, though. I hope I won't tap "accept" by mistake until this is resolved :P

I skimmed the thread there. Apparently this happens on any browser and not just on Chrome.

I will follow the linked thread, but please feel free to keep posting here if you feel the need.

Thank you all very much.
looks like you also have 28 browser tabs open.... i would think it is just trying to download from one of the tabs that are open(might still be on the original "mobo" site. try closing them all
ironass and D-U-R-X like this.
sdrawkcab25 is offline  
Reply With Quote
Old November 15th, 2013, 05:32 AM   #13 (permalink)
New Member
Thread Author (OP)
 
Join Date: Nov 2013
Posts: 12
 
Device(s):
Carrier: Not Provided

Thanks: 2
Thanked 2 Times in 2 Posts
Default

Quote:
Originally Posted by sdrawkcab25 View Post
looks like you also have 28 browser tabs open.... i would think it is just trying to download from one of the tabs that are open. try closing them all
Gulp...
I was like, THIS IS THE DUDE WHO'S GETTING INTO MY PHONE!
Then I remembered I posted screenshots

Those tabs have been open for months. Never had this happen.
Don't judge me. I have problems letting go
domatespatates is offline  
Reply With Quote
The Following User Says Thank You to domatespatates For This Useful Post:
Metroid Prime (November 15th, 2013)
Old November 15th, 2013, 06:12 AM   #14 (permalink)
Senior Member
 
Join Date: Aug 2010
Location: PA
Gender: Male
Posts: 5,572
 
Device(s): Rooted Samsung Galaxy Nexus, Rooted HTC Incredible, Stock 4G Motorola Droid Xyboard 10.1 (32GB)
Carrier: Verizon

Thanks: 477
Thanked 1,983 Times in 1,341 Posts
Default

Quote:
Originally Posted by domatespatates View Post
Gulp...
I was like, THIS IS THE DUDE WHO'S GETTING INTO MY PHONE!
Then I remembered I posted screenshots

Those tabs have been open for months. Never had this happen.
Don't judge me. I have problems letting go
closing them all should definitely fix the problem though
sdrawkcab25 is offline  
Reply With Quote
Old November 15th, 2013, 06:59 AM   #15 (permalink)
New Member
Thread Author (OP)
 
Join Date: Nov 2013
Posts: 12
 
Device(s):
Carrier: Not Provided

Thanks: 2
Thanked 2 Times in 2 Posts
Default

Quote:
Originally Posted by sdrawkcab25 View Post
closing them all should definitely fix the problem though
You say "definitely" but I'm sure it has nothing to do with the problem. As I said before, something similar happened on Feedly's in-app browser too, where I (of course) had no tabs open. If you check the link to the XDA Developers thread, you'll see that something else is going on and affecting a lot of people.
domatespatates is offline  
Reply With Quote
Old November 15th, 2013, 01:18 PM   #16 (permalink)
Senior Member
 
Join Date: Aug 2010
Location: PA
Gender: Male
Posts: 5,572
 
Device(s): Rooted Samsung Galaxy Nexus, Rooted HTC Incredible, Stock 4G Motorola Droid Xyboard 10.1 (32GB)
Carrier: Verizon

Thanks: 477
Thanked 1,983 Times in 1,341 Posts
Default

Quote:
Originally Posted by domatespatates View Post
You say "definitely" but I'm sure it has nothing to do with the problem. As I said before, something similar happened on Feedly's in-app browser too, where I (of course) had no tabs open. If you check the link to the XDA Developers thread, you'll see that something else is going on and affecting a lot of people.

The message that is seen on your screen is generated from the browser...so...the browser is generating the download...if the browser wasn't generating the download, you wouldn't see the message....so 99% chance that closing all the browser tabs will fix the issue...

However, there could be an app on your phone which is causing a tab to open in your browser, also causing the prompt

You might want to try downloading the app "network connections" , it will give you an idea what apps are sending out data to where.

https://play.google.com/store/apps/details?id=com.antispycell.connmonitor

Another thing you might want to try is "clearing the defaults" for the browser in the application settings screen(settings>apps>chrome>clear default), this way you would be prompted with what app "you want to complete the action" with, it might point you in the right direction.
sdrawkcab25 is offline  
Last edited by sdrawkcab25; November 15th, 2013 at 01:31 PM.
Reply With Quote
The Following 2 Users Say Thank You to sdrawkcab25 For This Useful Post:
GuitarG20 (November 15th, 2013), Metroid Prime (November 15th, 2013)
Old November 15th, 2013, 05:05 PM   #17 (permalink)
Oil Can!!! Oil Can!!!
 
Metroid Prime's Avatar
 
Join Date: Feb 2012
Location: Land Of Metal
Gender: Male
Posts: 9,106
 
Device(s): Samsung Galaxy SIII
Carrier: AT&T

Thanks: 2,080
Thanked 2,922 Times in 1,883 Posts
Default

^ +1 Yes, clearing the data on chrome should hopefully be a fix for this as it will go back to the way it was when you first opened chrome and since the app keeps trying to download that apk doing that should stop it. Go to Settings > Applications > Chrome Browser and hit clear data. It really beats doing a factory reset and starting fresh.
Metroid Prime is offline  
Last edited by Metroid Prime; November 15th, 2013 at 08:32 PM.
Reply With Quote
Reply

Samsung Galaxy S4
Current Rating:
Rate this Phone:

The all-new Samsung Galaxy S4 is all but guaranteed to be the next top-selling device. The new device is dubbed the "Life Companion" due to its intuitive features. The Galaxy S4 sports a 5-inch 1080p Super AMOLED display, an awesome 13 MP... Read More

Tags
malware, mobo, mobo market, mobogenie, spyware


Go Back   Android Forums > Android Phones > Samsung Galaxy S4
Thread Tools

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On



All times are GMT -5. The time now is 02:12 PM.
Powered by vBulletin® Version 3.8.7
Copyright ©2000 - 2014, vBulletin Solutions, Inc.