Why does Chrome open to a scam page

[Michelle Perez]

Hi All, hopefully I can shed some light on the issue. I too have the ANS UL40 and have been fighting the PUP that comes preinstalled on the phone since December. Why, doesn't matter anymore. Good news is I finally fixed it today but then didn't see this thread until after...sad, really want the other model now!

OK here's what's going on. In your app list if you select to show system apps, all the way near the end is the an app named "WirelessUpdate". Yup that's your bad guy. Well, really it's "PUP.Riskware.Autoins.Fota", but it's all part of that app running. It's too much to explain so here are some links.

1st is info on it. -
https://blog.malwarebytes.com/detections/android-pup-riskware-autoins-fota/

2nd is removal via CMD while connecting your device to ur PC. But if that's too technical (but much less than rooting or ROMing if that's a word), I'm sorry to tell you there isn't any other way to remove or disable. You can do what I've been doing and forcing it to stop. Which stops it until you open Chrome or connect to WIFI.
https://forums.malwarebytes.com/topic/216616-removal-instructions-for-adups/

Good Luck!!

 

[TexasGonzo]

Wow, what greedy providers won't do for a buck! Sounds like these guys definitely have that crap hard coded into the main ROM, which typically can't be changed without some serious skillz... even then it tends to be impossible without their proprietary software and or passwords for access.

Too bad there isn't a way to do with Android what I do with Windows.... install a Hosts file in the proper location that redirects annoyances like that to 255.255.255.0 (which goes nowhere)

I don't know if it'll help with the redirects or not, or if the OS will even allow it, but you might try using a different launcher. I replaced the stock [pos] TouchWiz with Nova Launcher (paid for the Pro version even, it rocks). Nova fixed a whole sleu of issues on several of my devices, including 2 tablets. DJI's UAV apps now run on everything I own for instance (before, forget it). A different launcher gives you tons of customization options, almost like its rooted (but isn't). Not to mention my Note4 is easily 4x faster opening apps, switching screens, etc..

There are several great launchers on the play store, simple as any other app to install, and just as easily undone if you don't like it. They're definitely worth a look at regardless IMHO. I'll certainly never run TouchWiz again!

Good luck all!

 

[Michelle Perez]

Wow, what greedy providers won't do for a buck! Sounds like these guys definitely have that crap hard coded into the main ROM, which typically can't be changed without some serious skillz... even then it tends to be impossible without their proprietary software and or passwords for access.

Too bad there isn't a way to do with Android what I do with Windows.... install a Hosts file in the proper location that redirects annoyances like that to 255.255.255.0 (which goes nowhere)

I don't know if it'll help with the redirects or not, or if the OS will even allow it, but you might try using a different launcher. I replaced the stock [pos] TouchWiz with Nova Launcher (paid for the Pro version even, it rocks). Nova fixed a whole sleu of issues on several of my devices, including 2 tablets. DJI's UAV apps now run on everything I own for instance (before, forget it). A different launcher gives you tons of customization options, almost like its rooted (but isn't). Not to mention my Note4 is easily 4x faster opening apps, switching screens, etc..

There are several great launchers on the play store, simple as any other app to install, and just as easily undone if you don't like it. They're definitely worth a look at regardless IMHO. I'll certainly never run TouchWiz again!

Good luck all!

Thanks. I'm good now but yeah a different launcher could work. Microsoft has a good one. Maybe folks can try that. One thing I did do in addition to force stopping the WirelessUpdate app again and again, is installed "BlockSite" app and added the gamebox, 178.128.221.39, etc. to the block list and it doesn't let those pages load at all. One thing tho is that Block Site has a pop up asking to unblock or return, which isn't great, but way better than the ads, which can inject other malware. And it could be asking to unblock based on my settings BC I never played around to see if I could address that. It does what it says, it blocks those sites period.

But given you all could complain and get a new phone, seems like the better way to go. Provided the new phone isn't loaded with malware too.

On a different note, I also found Google apps in particular and amazon to have ad URLs listed in the"Open by Default" settings, which you can't edit so I just disabled those too. So keep any eye out for that too.

 

[wholady]

Well, bad news on my end. The new phone (ANS L50) is now redirecting to the game sites just as before. It took a few days to do it, but it's there now.

I may see if I can figure out how to use a site blocking app such as BlockSite as @Michelle Perez suggested, but I don't think I am confident enough to try the removal of the PUP as outlined in the malwarebytes link given. Not only does it seem above my tech level, I'm not willing to risk damage to the system since I am getting these phones for free. However, I did look for the "wireless update" and force stopped it. In there is "advanced" and in that is a setting that allows it to "draw over other apps" so I turned that to NO instead of yes.
I'll try that and see what happens.

@Michelle Perez did you mean that if I force stop the wireless update before I go to chrome it will work for that session, but then I will have to force stop it again before my next browsing session?

I do want to know what I will be causing to happen by force stopping that system app, does "wireless update" do something I NEED my phone to do?

So far the new phone is not throwing up the error messages and no app crashing as the older model would eventually do, it would end up making the phone unusable.

Also so far, if I go to the Google search bar on my main screen and search for a site I want to go to, instead of opening chrome, it does not appear to redirect me to the game sites. So far. But it is a cumbersome way to browse, as I can't just go to chrome and use bookmarks.

I will report back my findings.

 

[Michelle Perez]

Yeah it does stop for a bit, but once the app runs again it'll restart the redirect to gamebox, etc.

BlockSite is really easy to use so it should help. And you won't be doing any harm to the phone by stopping the app bc Wireless Update isn't a legit system app, it installed as a system app so you can't disable or remove. But it's a very naughty app.

One other thought for your new phone, bc I was thinking of doing this if I couldn't get rid of it myself, was to try Staples or Best Buy tech services or GeekSquad to see if they can do the advanced removal process. Maybe they can help???

 

[Dannydet]

I would just install an ad blocker, such as Adguard, which is in the play store.
And yes, it does work with Chrome or any browser....
Works fine for me and no ads or redirects

 

[wholady]

@ dannydet thanks, but I tried the adguard. It makes you install either yandex or samsung internet browser. I did not see an option to make it work in chrome. I did install the samsung browser for it, it didn't help though, the same pages just come back after opening the internet a few times.
I tired "clean master lite", same result.

I will look at it again and see if I can get it to work with Chrome, maybe I missed something. If it was as easy as installing an adguard, I doubt that malwarebytes would have to come up with complicated ways to remove it though. Since this appears to be a PUP (potentially unwanted program) attached to a system app, it is not just an ad, so presumably why an ad blocker doesn't stop it.

So far, since yesterday, force stopping the wireless update system app has worked, no redirects. Fingers crossed.

 

[Michelle Perez]

Yeah Adguard or BlockSite only block the popups, they don't remove it tho. That's why the complicated removal process, since everything is pretty much locked out. To be honest tho, it was pretty easy to fix IF you're familiar with CMD prompt. I just copied and pasted the commands malwarebytes provided, then added in the specifics to the PUP.
Did anyone try using the Google Search widget instead as suggested above? If I recall I think I saw in the code that the popups are set to happen when opening Chrome so think that's a great suggestion. Might be the fix without adding any anything.
BTW, thanks for the clarification on the WU app, I must've read wrong as I thought it wasn't a real system app. Sorry for the confusion everyone.

I do know this is all great information tho bc ANS isn't the only phone with preinstalled adware. I learned it's most cheap phones as a way to make $.

 

[bubbascoo]

Hi I got a free ANS L50 about a month ago and have the same problem. what Ive come to realize is the game redirect comes from google, its a file named gamesnet2,jpg (this time, it changes at random). any what works is deleting that file, and chromes cache, It'll work for a few log ins but keeps returning ! yarrg! also have had mystery files that wouldn't allow deletion, then I had to start back at the beginning and reset chrome. next phone will be an I phone when I can afford it!

 

[wholady]

Well I am back again with an update on the issue, and much has changed.

The new ANS L50 phone Assurance Wireless sent me does still redirect to the scammy pages, not as often at first but eventually it does it every time the browser is opened. Yes, I can close that page and go on about my browsing, but next time it's back.

Then it started doing other odd behaviors, like sometimes the red light that shows it charging would stay on after fully charged, even after removing the charger. Before, the light would change to green when fully charged, and would go out when the charger was removed. Sometimes it shows only a small percent of charge, even after hours of charging, but when I remove the charger it does indeed show 100% charge.

Ads started showing up on my home screen. No adguard type program I tried has any effect on the browser redirect or on the home screen ads.

Sometimes when picking up the phone first thing in the morning it will be off, even though I had not turned it off.
Sometimes when turning it on it freezes on the Assurance wireless splash screen, trying again and again it usually comes back on. Once I had to do a factory reset from the startup recovery menu to get it to come on.

Then, every few days there would be a new app on my phone that I did not install.
Also, default apps like facebook will not stay disabled after I disable them.

To be clear, I am not installing any apps that could cause this, the latest phone I got I only used the default apps for a while before installing an app of my own, and still the problems came up. (I only installed one app this time, a solitaire game from the google app store that I have used on other phones without issue.)

I do not browse to scammy websites that could cause the problem (other than the scammy sites that pop up when I first open chrome, and I close them right away without clicking on them.)

For the record, I did try all the helpful suggestions given in this thread, (other than removal of the PUP as outlined in the malwarebytes link given above) and though they might work for other phones they did not work on this phone. Some methods did work for a few days, but the problems always return.

The latest problem was when I found my phone was off when I picked it up this morning, and when I turned it on it would not progress past the Assurance wireless splash screen no matter what I did.
After all the proper troubleshooting steps (turn phone off and on again, do hard reset, take out battery to turn phone off, then replace and turn back on, go into recovery menu and try to update phone, try clearing cache and data, try factory reset); when I called tech support at assurance they agreed to send a new phone.

(Bizarrely, after talking to tech support, I left the phone turned on, and several hours after that it suddenly went from the assurance wireless splash screen into factory reset on it's own. I followed along with it and it did get back to where I can at least use the phone while waiting for the new one.)

What the tech told me this time is they are aware the ANS phones can have scammy malware built in, and that the ANS phones often "go haywire" so this time they are going to send me a Unimax phone. He did not say what model, just that it is the latest one they have.

As soon as I get the new phone I will report here what it's like.

I encourage anyone still having problems with the ANS phones, whether the UL40 or the L50, to call the customer support and ask for a replacement. You may need to ask to be transferred to a higher level tech support agent. With me today, when I told the first agent all the troubleshooting steps I had already tried, they did transfer me up the line to the one who suggested they will send me a phone.

Good luck!

 

[Lucky Lucy]

I had this same vexing problem with Assurance Wireless phone. The ONLY way to fix it, is Phone Settings> Apps> Chrome> Storage> Clear Cache> Now:click Manage Space> Free Up Space> Then, Clear All Data. Now, when you try to open Chrome it will ask you to sign in to Chrome again. DON'T! The horrible adware is pre-loaded on the phone. You will have to get used to using another browser. <3

 

[BluSpirit75]

I have the newest phone offered by Assurance Wireless. It's a UMX 683CL. It seems that this is an ongoing problem that they do not intend to address. I am not willing to risk bricking my phone by removing any system files and would probably void any chance of getting a replacement by doing so. Tempting as it is.. I find it pretty disgusting that this is buried deep in the OS on the devices that they are offering and the average person isn't going to know what is really going on, especially since most google searches will lead people to believe that they themselves have caused the problem by downloading shady apps or visiting shady websites. I have seen many report that the ads were coming straight out of the box but in my case it took a couple of weeks for it to start. I am sure this is done on purpose to support the theory that the user has downloaded something harmful and not that the phone is infected from the get go. Of all the low down, dirty deeds. Seriously. I knew what I was getting into when I agreed to receive a free government service, I think most people do, but I really feel for those who don't. Preying on the elderly and disabled is just disgusting. I've heard some say that the ads somehow help the companies pay for the phones but somehow I feel that is not the case. I think it is more likely that the shady companies that are refurbishing the phones are the ones getting paid for the clicks. I've seen a lot of suggestions on how to deal with the problem. Use another browser, (I tried 3 different browsers, clearing caches etc the hijacker persisted) disable bloatware ( I disabled everything not essential to the basic functions of my phone), and the ads persisted. In my case the only thing that worked was turning off wifi. Since I only use the phone for talk and text that is really not a problem for me. I have access to a computer so I don't need to use the phone for that purpose. I would imagine that would not be an option for a lot of people. I had a tracfone with AW for years, never had an issue. It also did not have any internet capabilities other than checking my account balance so that is the difference. When it gave up the ghost I was excited that I qualified for an upgrade to a smartphone. I had no idea it would be a constant battle with full screen ads that prevent me from answering incoming calls, notification banner ads, browser hijacker ads, a "lock screen" app that would take over my home screen and constantly uninstalling apps that would magically appear on my phone. One of those apps appeared today, named 'Quen" which I could not find in the Play Store or anywhere on the internet for that matter. It had access to email, contacts, phone among other permissions. That should be concerning to users of these phones. I saw somebody suggested downloading Clean Master? Well that just happens to be one of the apps that keeps appearing on my phone so I'm not sure if I would trust this app. I saw a lady on YouTube who was happy she only had "some malware' after complaining to AW and doing a factory reset. Wow, really? She followed the advice that is given to every person that complains about this problem: "Please perform a factory reset" and she was able to get rid of 'some' of it. That's not a solution, that's just making the problem less obvious to the user while the malware goes on doing its thing in the background. I hope that a solution is found but in the meantime the only choice for me is to deny the thing internet access as much as possible.

 

[wholady]

BluSpirit75 you are so right! My 2nd replacement UL50 back in Feb. **(see edit below) worked without a problem until just recently and now it is installing apps by itself, popping up scam lock screens, and opening chrome to the scam sites again.

This is beyond discouraging. As before, I have not been browsing unsafe sitesor clicking links, and have not installed any apps. This has to be deep in the phone where we have no way to stop it once it starts. I could insist on a new phone, but I can be fairly sure it won't be a new one, it will be something somebody else already had a problem with.
Resetting the phone to factory defaults may work but usually the problem returns.

I have recently found and uninstalled some apps that I did not install myself. You go to settings, applications, and scroll through the whole list of apps. Uninstall anything you don't recognize and be sure to scroll to the end, as there could be an app at the bottom of the list that doesn't even have a name. If uninstall is not an option see if disable is an option. (Default apps that the phone actually needs to run properly will not have these options. Default apps that the phone doesn't need but they preinstall on the phone like facebook can be disabled but not removed.) Turn the phone off and on again after making the changes. I also went into settings/applications/chrome/storage and cleared cache. (not clear data)
This helps for a time.

Check in the security settings, under device administrators, and disable anything it lets you disable. In my case, "find my device" and "google pay" both had administrator privileges it didn't have before, and I didn't give it. Turning these off removed the bogus lockscreen that had turned up.

I am hoping I can keep on top of it by uninstalling things and checking security settings periodically. We should not have to do this, we should be able to have a phone that is safe.

**EDIT: I don't know what I was thinking when typing this post, my current phone is NOT the ANS L50 it is a newer Unimax and it had no problem whatsoever until recently. They replaced the L50 with a Unimax U683CL just like the bluSpirit mentioned.
I will update here again if the problems turn up again.

 

[Lucky Lucy]

Hi-I got this same phone It is so easy to fix! Just go into apps and DISABLE Online Plus. It does not interfere with any operating system. It is the source of all the nonsense. If that doesn't fix everything after restarting, then do a factory reset and as soon as the phone reboots, then go in and disable Online Plus. Good luck!

 

[Lucky Lucy]

Hi-I got this same phone It is so easy to fix! Just go into apps and DISABLE Online Plus. It does not interfere with any operating system. It is the source of all the nonsense. If that doesn't fix everything after restarting, then do a factory reset and as soon as the phone reboots, then go in and disable Online Plus. Good luck!

 

[Rickkrockstar]

The ads are built into launcher, replace launcher with ad free launcher on play store, the problem is will stop. Hope this helps.