start.infospace.com has hijacked my browser

[Tetractys]

When you try to set your home page (browser, settings, more, set home page) there is a choosable-but-not-writable selection called "Use Default." If you have the InfoSpace malware, this will read "w w w . searchmobileonline . c o m" with a "/?source_id=..." string following.
Navigating to that page reveals the fake Google site you see when you click the Search magnifier or try to load a hijacked browser.
I received it with Brightest Flashlight.
I cleared it by deleting the app and search icon, then force-stopping the browser and clearing all data.
So far, it hasn't returned.
I believe the code is more sophisticated than a simple "default home page" selection. It will, seemingly on a timer, overwrite a saved previous page and load InfoSpace instead after restarting the browser. If you navigate away from the browser with IMDB open, for example, and do other things for 10 minutes, when you return, IMDB is showing. After a half hour, InfoSpace is showing. If you shut the phone off for a while and then open the browser, InfoSpace comes up with the browser.
If you read the privacy policy for InfoSpace, they are aggressive about collecting information and sharing it.

 

[BobbyPhoenix]

I got it too, so I'm just subscribing to the thread. I did a manual reset of the home page. So far so good, and like others I only started seeing it after installing brightest flashlight.

 

[daj198]

I too got it from installing Brightest Flashlight. I've uninstalled it now and given it a bad review in the Market. I'd encourage others to do the same to prevent others doing the same.

 

[shadowpocalyps]

I was tinkering around w/ the settings in the web browser and realized how to remove it. Apparently it was added into it via "website settings". To uninstall, simply go to "Settings" in the stock browser and scroll down to "Website Settings" at the very bottom.

There you should only see 2 google website settings. If you see a "start.infospace.com" setting or any other setting, simply click on it. Then click on "clear data" or whatever the option is. Done.

It should no longer redirect you now. I have a Samsung Galaxy S2, stock rom, T-mobile. I mainly use Dolphin Browser which seemed unaffected. Only the stock browser was showing the redirect. Anyways this took care of it for me.

 

[breggyxo]

I have that blue icon on my phone. Today my android phone had software update and it restarted and then that's when the icon showed up.
my browser has changed its default homepage to searchmobileonline. i read it shows up after you restart your phone.... the thing is i rarely turn off my phone and i'm always installing and uninstalling any new apps i find so i have no idea what app came with the blue icon.
i already deleted most of my apps so i can't do the 'clear data before you uninstall' option... and i deleted some folders in my phone but it still didn't work. i also cleared my browsers data and default page is back to normal but the blue icon is still there after i restarted my phone. whenever i click it, it goes to searchmobileonline. it probably isn't doing anything now but i want it gone.

i'll probably just reset my factory data... and be careful of what apps install from now on.

i remember a month ago, a picture showed up in my gallery. i have no idea how it got there, i never downloaded it. it was an ad for an app i think. I didn't think much of it so i deleted it. i forget the name of the app...

+++edit+++ Before I reset my phone I tried the add on detector app and it didn't detect anything.

 

[Blueshirt35]

Also got this from installing Brightest Flashlight. Uninstalled the app (cleared data first) and then sent the shortcut to the trash. Hopefully that will take care of things. From what I could see, google was still showing as default so hoping it didn't get too far. One can hope.

Thanks for everyone who has chimed in...replies were helpful.

 

[Harry2]

I have that blue icon on my phone. Today my android phone had software update and it restarted and then that's when the icon showed up ....

Have a look at that article ... you should recognize that annoying blue search icon.
http://www.pcworld.com/article/245305/sneaky_mobile_ads_invade_android_phones.html

Move the blue search icon in the trash. That may be enough to get rid of this AirPush ad.
But if an app with an AirPush addon has placed this blue search icon on your home screen that app will do it again and again ...
So you have to find this app with 'Addons Detector'. Set the filter to "Push Notifications".

Harry

 

[gandhimaster]

Starlight live wallpapers and its other ones from same developer also did.this addons detector found them. Thank you for the heads up

 

[gandhimaster]

I emailed Lookout security (which i use) and they emailed back with advice how to remove it. The instructions were to get Addon Detector and detailed how to use and remove the offending apps.

I had enquired as to why Lookout did not flag these apps up at installation, or even picked them up during a scan.

Lookout security maintains these apps are not malware, but they are apps that install adverts which can be removed and do not do any harm.

I'm not sure i agree with this, as the ads are installed without permission but this is their response nonetheless.

 

[Harry2]

This blue search icon is on the Symantec page and might be an indication for malware on the phone ...
http://www.symantec.com/connect/blogs/androidcounterclank-found-official-android-market

If I had had such a icon on my home screen, I would look in the phone's log for that package "apperhand".
For to look in the log I would use 'aLogcat'.

EDIT: Ok, I've read an other article
Symantec calls it malware but Lookout says it's just an aggressive advertisement component

Harry

 

[dcadar]

I've also got that annoying search icon, together with my homepage changed to searchmobileonline.com. In my case the culprit was screenshot app, developed by KASTOR soft.

I don't understand why people are doing this. What can the company behind searchmobileonline can gain by this? Don't they realize that they will annoy people? And why the developers are so damn stupid to include such crap in their apps? Don't they realize that people will hate them for that and will stop using their apps?

I got rid of that crap with "Ad Detector" by TrustGo.

 

[animesux]

Hello,

I downloaded a phaser app last night (yes I'm a Star Trek geek) and found this troublesome little shortcut on my desktop. I uninstalled the app and installed airpush remover, to no avail. I couldn't remove it, nor could I remove any other icon. I found out that it was just a web shortcut. I tried wiping out my home screens, and all shortcuts with them. After wiping out all my icons I got rid of it but could still not add new shortcuts. I noticed that I could add things by clicking menu, then add. I clicked "more" and saw a "Lock Desktop". I had never used it before so I clicked on it and Lo! I can add shortcuts again. So after installing the app, it added a shortcut and then locked the desktop to try and prevent anyone from removing their shortcut. Ingenious in a way, as it simply changed some low priority settings and made it appear as though the phone was hacked. I am using cyanogenmod, and to be honest I only used the stock ROM for like, 4 hours before replacing it, so I'm not sure if this will apply to everyone or just cm users, but go ahead and try it out, if you're still having this issue.

 

[ceider]

I've also got that annoying search icon, together with my homepage changed to searchmobileonline.com. In my case the culprit was screenshot app, developed by KASTOR soft.

I don't understand why people are doing this. What can the company behind searchmobileonline can gain by this? Don't they realize that they will annoy people? And why the developers are so damn stupid to include such crap in their apps? Don't they realize that people will hate them for that and will stop using their apps?

I got rid of that crap with "Ad Detector" by TrustGo.

Working my way round this now-I made the mistake of installing this Kastorsoft Screenshot rubbish-without reading reviews first.

I've wiped all internet data, caches etc, and hopefully that'll shift it. Will have a look at the Ad Detector thing too, as others have said, Airpush did nothing. That's the first thing I tried when the searchmobile thing popped up.

The people who do this sort of thing are, quite frankly, scum

 

[Ex Donkey Man]

I've just caught this from the deal or no deal app! Sneaky thou, because I have 5 home screen pages and it was at the end of page 5.(It hasn't over run my browser yet) I moved it to the trash anyway, then I did -
Google - But go to home page (e.g. search for something)
Then bottom left button (On Samsung)
Down to settings
Right at the bottom is website settings - click on that
I found it in there, I did the bottom left button and cleared and deleted all data from that file. The info space junk was the only thing in there.
The moment I cleared it I got a notification about updates.

Will see how it goes!
P.s. I'd already uninstalled the deal or no deal app, but might not have cleared the data first.

 

[droidappfan]

When you try to set your home page (browser, settings, more, set home page) there is a choosable-but-not-writable selection called "Use Default." If you have the InfoSpace malware, this will read "w w w . searchmobileonline . c o m" with a "/?source_id=..." string following.
Navigating to that page reveals the fake Google site you see when you click the Search magnifier or try to load a hijacked browser.
I received it with Brightest Flashlight.
I cleared it by deleting the app and search icon, then force-stopping the browser and clearing all data.
So far, it hasn't returned.
I believe the code is more sophisticated than a simple "default home page" selection. It will, seemingly on a timer, overwrite a saved previous page and load InfoSpace instead after restarting the browser. If you navigate away from the browser with IMDB open, for example, and do other things for 10 minutes, when you return, IMDB is showing. After a half hour, InfoSpace is showing. If you shut the phone off for a while and then open the browser, InfoSpace comes up with the browser.
If you read the privacy policy for InfoSpace, they are aggressive about collecting information and sharing it.

I know your post was made a while back, but I literally registered just to thank you!!! I spent soo much time trying to find the solution on a samsung galaxy s3 and reading this post solved it!! Thank you!!!!