1. Download our Official Android App: Forums for Android!

Support "Samsung Members" system notification popup - malware??

Discussion in 'Android Help' started by Android Question, May 18, 2016.

  1. Android Question

    Thread Starter
    Rank:
    None
    Posts:
    0
    Joined:

    Hi,

    A message popped-up today in the form of a system notification which invited me to supposedly download a "Samsung Members" app from Google Play. However the numerous spelling mistakes caught my attention and did not press on the relevant link. After searching the Play store no such app was found. I assume it may be some sort of malware but i have checked with numerous anti-malware/anti-virus apps with nothing popping up. Anyone else has had this? I am using a Galaxy S6 Edge if it matters.

    Thank!
     

    Advertisement

  2. Hadron

    Hadron  
    VIP Member
    Rank:
     #8
    Points:
    2,218
    Posts:
    21,703
    Joined:
    Aug 9, 2010

    Aug 9, 2010
    21,703
    14,894
    2,218
    Spacecorp Test Pilot
    Dimension Jumping
    It's safe to assume that any pop-up suggesting you install an app is spam of some sort.

    If you press and hold a notification it should tell you what app produced it, and depending on OS version may give you options to control notifications from that app. If I found one of my apps spamming via the notification tray I would get rid of the app.

    However, it probably doesn't need to contain anything a malware scanner would find in order to do this. If it can post notifications and then pass the link to a browser or download the target itself then that's all it needs. So the app responsible could just be a bit spammy, but the thing it tries to get you to install could be worse.

    Apps you've recently installed or updated are more likely suspects, but some apps are smart enough to wait a while after installation before spamming, to be less obvious.

    Cheetah Mobile, the Go app team and suchlike are infamous for spam, so if you've anything from them they would also be suspects, but I don't know about this particular spam.
     
    El Presidente and Kypros86 like this.
  3. Kypros86

    Kypros86 Lurker
    Rank:
    None
    Points:
    6
    Posts:
    5
    Joined:
    May 18, 2016

    May 18, 2016
    5
    1
    6
    Male
    Thank you for your detailed reply Hadron! I will do this next time it pops up (if it even does as it has only appeared once till now). I will also remove any recently installed apps and see how it goes!
     
  4. m_9195

    m_9195 Lurker
    Rank:
    None
    Points:
    15
    Posts:
    4
    Joined:
    May 22, 2016

    May 22, 2016
    4
    0
    15
    Male
    I just had this notification pop up on my phone within the last 30 minutes. I have no idea what is causing it. I deleted any apps/games that I've downloaded in the past week and this did nothing.

    When I held down on the notification to see what app was causing this, it says "software update" as the app name. It allows me to block notifications and hide content from the lock screen when I click on the "i" information button.

    I don't know if this is useful information, but when I went to application manager and looked at the list of apps, there are two apps named "software update" listed there. One is 1.1MB and the other is 7.55MB. I don't know if having two software update apps is normal or not, I'm just adding this incase it's useful information.

    Did you figure out what it was yet?
     
  5. liquoricetea

    liquoricetea Lurker
    Rank:
    None
    Points:
    5
    Posts:
    2
    Joined:
    May 23, 2016

    May 23, 2016
    2
    0
    5
    I just received this notification a few hours ago as well. When I hold down the notification I get the same thing, says "software update" as the app name. In application manager, I have 2 "software update" listed too. One is 860KB and the other 412KB. I hastilly clicked the link that was in the notification and got an error message from the app store. I have not pressed OK yet...

    Haven't downloaded any new apps lately. I purchased a Play Music 3 month trial that was on promo, and I then updated the app but that's it.

    I have a Galaxy S6 with Fido.
     
  6. SkyNet2x

    SkyNet2x Lurker
    Rank:
    None
    Points:
    15
    Posts:
    5
    Joined:
    May 23, 2016

    May 23, 2016
    5
    0
    15
    Male
    I just noticed this today myself. On further investigation, it is also coming from an app called "Software Update," and there are two in the app registry.

    If you look at the permissions for these two apps, one has a reasonable set of permissions and the other has UNLIMITED permissions that make no sense for an update service - unlimited access to text messaging, calls, device and account info, managing contacts, etc... basically, every permission in the book. This app can't be disabled, force stopped or uninstalled as far as I can determine. Antivirus apps don't detect it.

    Anybody with a rooted phone who's had this issue that can chime in on removal? I'm not a knowledgeable enough user to tackle it.
     
  7. andyroidForUm

    andyroidForUm Lurker
    Rank:
    None
    Points:
    5
    Posts:
    3
    Joined:
    May 23, 2016

    May 23, 2016
    3
    0
    5
    I got the same just an hour ago. Am having the exact same experience as outlined above. Only app I've recently download in the past week was Lichess which is a chess app with a 4.5 star rating so I doubt it's the culprit.

    Am using Samsung Galaxy S6.
     
  8. SkyNet2x

    SkyNet2x Lurker
    Rank:
    None
    Points:
    15
    Posts:
    5
    Joined:
    May 23, 2016

    May 23, 2016
    5
    0
    15
    Male
    The first responder mentioned "Cheetah Mobile" as a known culprit for spammy notifications... I just noticed an entry for "Cheetah Mobile CleanMaster" which I definitely never downloaded. Anybody else have this too?
     
  9. liquoricetea

    liquoricetea Lurker
    Rank:
    None
    Points:
    5
    Posts:
    2
    Joined:
    May 23, 2016

    May 23, 2016
    2
    0
    5
    Yep I just looked and I have this too!
     
  10. Alice Huang

    Alice Huang Lurker
    Rank:
    None
    Points:
    16
    Posts:
    4
    Joined:
    May 22, 2016

    May 22, 2016
    4
    1
    16
    Female
  11. mikedt

    mikedt 你好
    Rank:
     #7
    Points:
    2,238
    Posts:
    24,200
    Joined:
    Sep 22, 2010

    Sep 22, 2010
    24,200
    13,300
    2,238
    Teachaaa
    Jinan, China
    Did it read something like this?
    English might not be the best when it comes from Beijing, i.e. Cheetah Mobile most likely.




    Cheetah Mobile Clean Master SDK as a system app. All recent Samsungs have it. Samsung calls it Smart Manager, but it's definitely a version of Clean Master.

    http://www.androidheadlines.com/201...clean-master-technology-galaxy-s6-models.html
    Samsung And Cheetah Mobile Announce Partnership To Incorporate Clean Master Technology Into Galaxy S6 Models
     
    #11 mikedt, May 23, 2016
    Last edited: May 23, 2016
  12. Kypros86

    Kypros86 Lurker
    Rank:
    None
    Points:
    6
    Posts:
    5
    Joined:
    May 18, 2016

    May 18, 2016
    5
    1
    6
    Male
    Hello again, seems like this issue is getting more widely spread as time goes by. To provide some follow-up feedback on my experience, the pop-up message did not appear again until now (even after some restarts of the phone). However, I was not able to locate the cause - do you believe it is actually a system notification through Clean Master? From my perspective, the English used to write it are too poor to be the result of any app that is not "harmful" :) Has anyone had the notification pop-up multiple times?
     
  13. SkyNet2x

    SkyNet2x Lurker
    Rank:
    None
    Points:
    15
    Posts:
    5
    Joined:
    May 23, 2016

    May 23, 2016
    5
    0
    15
    Male
    The notification is still present on mine despite multiple restarts.
     
  14. Kypros86

    Kypros86 Lurker
    Rank:
    None
    Points:
    6
    Posts:
    5
    Joined:
    May 18, 2016

    May 18, 2016
    5
    1
    6
    Male
    Did you click on the OK button when it first popped-up? Regarding your previous reply, I can also confirm that I have two "Software Update" apps, with no option to disable either one, and with one of them having permissions to actually do anything with my phone content. As per the "Addons Detector" app, they have both been installed on 30th of April. I am not sure if that was the date there was an actual software update on my phone, is there a way to pinpoint this?
     
  15. Kypros86

    Kypros86 Lurker
    Rank:
    None
    Points:
    6
    Posts:
    5
    Joined:
    May 18, 2016

    May 18, 2016
    5
    1
    6
    Male
    Another thread discusses this issue as well:

    http://androidforums.com/threads/fake-information-message-notification-w-spelling-mistakes.1033113/

    It appears that a fellow Android user has contacted Samsung regarding this, who has replied that a patch may be issued for the problem (quoted below - submitted by user "coronos" which we thank for his/her input :)):

    "I just chatted with a Samsung customer service rep. She said that this is NOT from Samsung, and that they will issue a patch update to "resolve the issue". We will receive a notification on the phone when it is released. Hopefully it will be clear that it's from Samsung."

    Hope this clears the things up a bit!
     
  16. SkyNet2x

    SkyNet2x Lurker
    Rank:
    None
    Points:
    15
    Posts:
    5
    Joined:
    May 23, 2016

    May 23, 2016
    5
    0
    15
    Male
    I certainly installed no significant update on April 30. I'm glad to hear someone contacted Samsung, that was my next move.
     
  17. The_Chief

    The_Chief Accept no imitations!
    Moderator
    Rank:
     #10
    Points:
    2,043
    Posts:
    13,504
    Joined:
    Nov 17, 2009

    Nov 17, 2009
    13,504
    13,629
    2,043
    Male
    I'm retired: every day's a Monday :P
    Manchester, TN
    I love Samsung phones but I want NOTHING from Cheetah Mobile on my phone.
     

Share This Page

Loading...