Help Malware Removal for Note 5

[USCRugbyNo1]

I get a popup a few times a day when surfing the web. I have installed several anti virus apps from the play store and nothing detects it. I have removed all data and cache from Internet Explorer or whatever is default for browsing. I do not want to use Chrome, I simply want to remove this malware/virus. I believe it's located in the "data" folder.

PLEASE help, I do NOT want to factory reset my phone.

See link for a picture of it.

https://www.dropbox.com/s/1pgiz8wu24hn40h/1.png?dl=0

 

[Hadron]

That looks like an advert rather than malware to me, albeit an annoying one. Are you by any chance a Time Warner cable user, and if so does it appear when you browse using mobile data or only on your home WiFi? If the latter it could be an ad script that's detecting your IP address as Time Warner and selecting that ad as a result? Just speculating.

When you say you think it is in "data", why do you think that? /data is the name of the storage partition where all apps and app data live. You can't browse it without root, and clearing the whole partition would be exactly equivalent to a factory reset, so stay away from that. Maybe clearing the system cache would help, but I'd have thought that clearing the app cache (which you've done) would clear anything downloaded by the browser.

I expect you are using Samsung's browser, which I have little experience with (Internet Explorer is Microsoft's Windows-only browser) . If it is just an ad then it may reappear if you use a different browser anyway, can't say for sure. Does the Samsung browser not have a setting to block pop-ups?

 

[USCRugbyNo1]

Yes, I am using the default browser. I should not have said IE. Yes, I use Time Warner Cable wifi at home, so i believe the script is finding the IP address and then displaying that message based on IP.

If you look at the screen shot, the path of the pop up leads me to data:text/html;base64

 

[Hadron]

Ah, didn't look at the address bar in the browser. But I don't think that's an address: I think that "data:" is like "http:", it's indicating the type of source and it's a coincidence that Android has a partition called /data in its file structure.

A quick search pulls up a Wikipedia article which describes this as "a way to include data in-line in web pages as if they were external resources", so I think it's telling us more about the structure of this pop-up page than where data are stored on your device.

What this also does is make it harder to tell whether the page is "legitimate" (insofar as any unsolicited pop-up deserves that title), since these things can be used to hide phishing attacks and other malicious sites (as well as an honest use to speed loading of a page).

 

[USCRugbyNo1]

Gotcha, I just figured it was coming from there. Any suggestions on how to remove this?

 

[Hadron]

An iptables-based ad blocker would do it just fine, but you need to be rooted for that. A VPN to disguise your IP would probably do it too, but that feels like a lot of faff. If this is a Time Warner campaign, as opposed to a phishing attack aimed at Time Warner customers, it will end at some point, but you don't want to wait for that. And reading the content of that page more carefully I have to say that I think it more likely it's a phishing attack: an offer of a (possible) prize with a time limit to answer seems designed to get people to click without thinking about whether they should, and that sets off several alarms. I would not follow this "survey", because my guess is that it's either a scam or a malware downloader.

Just to confirm: you have any popup blocking options in the browser settings enabled? Most browsers have this. It seems that there is an "adblock plus for Samsung browser", so you could try that. I was hoping I could find a good ad network detector, but most seem not to have been updated for a couple of years (when the main problem was "push advertising", which has now been removed from the Play Store). It may be that one of the security/"antivirus" apps that offers real-time web protection might block this, but I don't know whether they'd be effective: if you want to try this I'd stick to companies who have a reputation in this field (Avast, Kaspersky, etc), since some (e.g. CM Security) come from companies who are know to be data-miners themselves.

 

[Hadron]

I've just edited the post above with a Play Store link that may help. Posting this in case you read the post before the edit.

 

[USCRugbyNo1]

Per your instructions I have installed the adblock plus from Samsung browser. Will keep you updated and thank you.

 

[Hadron]

Good luck

 

[Jo Smo]

A week ago I switched from Iphone 6S to Note 7 (been an iphone user for 6 or 7 years) and I started to get this annoying popup on my new phone thru the Chrome browser. If anyone is able to remove this popup thru Chrome please let me know. Guess I'll have to use the stock samsung brower for now.

 

[AZgl1500]

go to https://play.google.com/store and download "Ghostery" browser.

that ought to fix you up.