BeiTa Plugin

[DannyDemonic]

A friend messaged me this morning with a problem on her phone. She's trying to remove a plugin called BeiTa Plugin and thinks it may be malware, but she hasn't been able to remove it with any malware removers from the Playstore. She says it's a virus or trojan, but I can't find much, if any, info on this online.
Any suggestions on how to remove or identify this?

 

[Dannydet]

What phone, carrier?

 

[DannyDemonic]

What phone, carrier?

Sorry, she's on ATT with a Samsung 8S

 

[Dannydet]

https://www.techtimes.com/articles/...as-push-notifications-how-to-disable-them.htm

Looks like ads with push notifications preloaded.

 

[Hadron]

I've found reports of Windows malware called "android.beita", but of course Windows malware can't infect a phone.

Otherwise I've found a description of a really old malware called "beita" at https://www.symantec.com/security-center/writeup/2013-110111-1829-99. But I think this predates plugin frameworks on android, and would be amazed if anything this old was capable of infecting a modern phone (and more so if no apps can remove it). Can you give us any more information on it and on what measures she's tried?

 

[DannyDemonic]

I've found reports of Windows malware called "android.beita", but of course Windows malware can't infect a phone.

Otherwise I've found a description of a really old malware called "beita" at https://www.symantec.com/security-center/writeup/2013-110111-1829-99. But I think this predates plugin frameworks on android, and would be amazed if anything this old was capable of infecting a modern phone (and more so if no apps can remove it). Can you give us any more information on it and on what measures she's tried?

She's not able to see it in the app management. She's assuming it's a virus or malware because it pops up ads when she gets a text, phone call, or does any browsing. I've walked her through the Samsung Game Launcher from the link above, but it wasn't on. I had her turn the Game Launcher on and follow the instructions to disable the ads, but she said that option was already turned off too.

 

[Hadron]

So where did she get the name Beita from?

 

[DannyDemonic]

She sent me this screencap. The other image pops up every time she finishes a phone call

 

[DazDilinger45]

My wife is having the exact same issue. This will bring up random adds in the middle of phone calls, when her alarm clock goes off or anytime she uses any other function o her phone. We are unable to find any other information on this. It is extremely annoying and almost making her phone unusable.

 

[Mikestony]

I think you guys have some app installed that has permissions to download/install some undesirable popups like that.
The problem is finding out which app that is by doing some investigative work on recently installed apps. Google the apps, find user feedback, check out permissions about the app. Even go so far as clearing the app's data and cache, force stop it, then uninstall to see if the issue persists.

 

[Hadron]

It's the "plugin" bit that bothers me. This could explain no malware scanner finding it: if it's using plugin technology then the installed app itself may appear harmless, because the actual adware or malware is downloaded and installed on the fly when used.

I'm not having much luck finding how to forbid such things globally. You can turn off "instant apps" from your Google settings on the phone (on my Pixel that's Settings > Google > Google Play Instant, but it will probably be different on a Samsung), and I'd be tempted to do this and see if it helps (actually I turned it off on my phone as part of the initial setting up - I didn't like the sound of allowing things to run on my phone without my actually installing them). But I suspect that it's using some different plugin service.

Back in the days when "push notifications" were the adware scourge du jour I installed an app called "Addons Detector", and you could use this to search for any apps using plugin services: install, scan, click on the "addons" button and then search for "plug" or "plugin". Of course there are legitimate apps that use plugins of different types, so the fact that an app appears in the list doesn't mean it's guilty (I have 2 which show up this way, both of which I'm sure are safe). But if you are lucky this might narrow down the list of potential culprits.

 

[Wilbr101]

I was having the same problem with this plugin. Ads would always pop up when I used most apps including Google maps even whilst I was driving. I realised it was the Beita plugin when i went to close all active apps via the left button next to the home button on my Samsung s7. I could not find anything on the net to remove it so i decided to reset my phone. I backed up everything except the apps to my sd card via smart switch. When the reset was complete the problem was solved, no more annoying pop ups . My original apps were reinstated via my Google account. Phone also works faster now that the plug in is gone.

 

[jp89kg]

It is a fake name of an app doing that. But it has the same logo of an app Drink Water. I deleted that app and all god for now.

 

[jp89kg]

She sent me this screencap. The other image pops up every time she finishes a phone call

Just see what app in your device have the same logo and delete that app

 

[Mark Curry]

My wife just experienced the same issue, if she would plug in her charger or right in the middle of playing a game she would get pop up ads. I noticed when I looked at the running apps I saw one named BeiTa Plugin and using Lurker suggestion found the app with the same logo, deleted it and the ads stopped popping up. Some app dealing with screen color changing.
Thanks for the info...

 

[Arlin Koch]

Mine came from a Smart radio fm app...

 

[kim a height]

Mine came from an app to create logos. Uninstalled it, and the plug in was gone.

 

[mlrosborough]

How do I remove BeiTa Plugins from my Galaxy S9 ?

 

[Mikestony]

How do I remove BeiTa Plugins from my Galaxy S9 ?

Hello! Welcome!
I've merged your thread that talks about the same issue as the OP's issue. Hope some of the info posted here will help

 

[Doe From Prover]

Just see what app in your device have the same logo and delete that app

-Mine matched to app "Phone Color Screen". Deleted and will report success/failure...

 

[Hadron]

So the conclusion is that there are a number of apps out there that are feeding ads from this plugin.

So if you don't see one that you have installed named here, you should consider anything that you installed or updated shortly before this started as a suspect.

 

[jsmith76112]

It is a fake name of an app doing that. But it has the same logo of an app Drink Water. I deleted that app and all god for now.

Just see what app in your device have the same logo and delete that app

this worked. thank you so much. the app on mine was smart fm radio app.

 

[Doe From Prover]

-Mine matched to app "Phone Color Screen". Deleted and will report success/failure...

Update: 24 hours after deletion and problem seems to be gone...

 

[Jan Dettke]

I have the same problem with the application ManFIT. The advertisments pop up in all places even when the app is not running. Any ideas how to avoid it?
I would have thought that this behavior is against the Google playstore rules, isn't it?

 

[Hadron]

If that app is the source of the ads, get rid of the app. That's the solution.

There are indeed rules in the Play Store for advertising behaviour. I don't have time to locate them now, but some sorts of advertising tools have been banned before now. You could try reporting the app to Google.