Removing redirect link malware

Question

I have Xiaomi Mi3 and it's not rooted. Every time I open a web page, both on mobile data and WiFi, and even with different browsers, I get redirected to other pages with ads and pages like this:

http://mobiles.digital/IT/Sweepstake/LP/index.php?voluumdata=vid..00000004-4837-403c-8000-000000000000__vpid..ca8d4800-fd5d-11e4-88ba-7eef5f3eb726__caid..5422e033-3dc6-4996-b128-7bf07d491d19__rt..R__lid..19777e53-9ce2-45a2-8073-ce9466d65506__oid1..7756b6f2-77b0-4db4-8d79-0faa4854c67f__oid2..b504e00f-54b7-4fd2-99de-09a0e4919980__var1..425682__rd..www%5C.%5Cyouradexchange%5C.%5Ccom&SiteID=425682

I have tried:

Many antivirus (including AVG premium app which was free this weekend on Amazon app shop)
Factory reset: inside settings on my phone
Hard reset: deleted cache and installed app.
AdBlocker plus.

But nothing worked.

Here's the installed apps on my phone: https://drive.google.com/folderview?id=0B2cFQ2PnOtfNT0NsMnZJY1NiT1U&usp=sharing

1)No 2)Yes, ive tried adblock but 3) i'll share it asap 4) both thanks for good question gonna edit my post asap — Federico Ponzi, May 18 '15 at 18:32
Are you going to share screenshots (mentioned in the comment)? — Firelord, May 18 '15 at 20:19
For me the album link don't work even logged into google plus. Are you sure it's public? — ares777, May 19 '15 at 05:29
@FedericoPonzi I agree with user3344236. The permission to view the album by others isn't granted yet; Please change it to public. — Firelord, May 19 '15 at 06:59
It seems you're infected with YourAdExchange malware (note the URL at the end). However, I still haven't found any clue to clean it on Android. — Andrew T., May 19 '15 at 08:00
Andrew T. this can be a false assumption also. I think the correct title should be: removing redirect link malware on Android phone. :) — ares777, May 19 '15 at 08:43
@user3344236 fair enough since I couldn't find any clue related to that malware on Android. — Andrew T., May 19 '15 at 09:33
Recently there's a similar issue related to YourAdExchange. I'm not really sure if your case is the same as that, but you might be interested to try the answer before flashing the ROM. — Andrew T., May 22 '15 at 07:34

score 3 · Accepted Answer · answered May 19 '15 at 13:43

3

I'd like to get more information to help. Could you show the MIUI version of your phone? See it in Settings -> About Phone -> MIUI version. If you can use adb in your PC? I think It will be helpful if you can show the output of PC command "adb shell pm list packages" and the output of "adb shell ls -l /system/app /system/priv-app"

By the way, if a factory reset can not resolve the problem you can try a full ota update which will reformat the system partition. To do full ota update: Click the Updater app, and then click the menu button in the right top, then click the "Download update" item. !Remember to backup your files!

enter image description here

answered May 19 '15 at 13:43

Juhu

46
3

The MIUI version is 4.10.17, android version 4.4.4 . When i try to Download update i get a "no update available "message, so i can't do it. Thanks anyway! – Federico Ponzi May 19 '15 at 21:10
4.10.17 is a beta version and is rooted by default. Did you get it from the MIUI's official website? (en.miui.com) – Juhu May 20 '15 at 04:05
I actually brought it from xiaomi on Amazon – Federico Ponzi May 21 '15 at 12:09
I think you can try to download a full ROM package to do an update and then do a factory reset. The official download website: http://en.miui.com/download.html – Juhu May 22 '15 at 06:37

score 0 · Answer 2 · edited May 19 '15 at 12:50

Try Avast free and Malwarebytes , one after another (not 2 installed in the same time).

Try to move the app masked as com.securitycore.miui_t to SD card, then scan your phone again.

Reasoning:

I removed an "insane" pop-up linker (no matter what browser I used) which, instead acting like an activity by default (a malware activity) just used text displayed on webpage ( reading html meta tags ) and added link with advertorial content (manipulating content by adding div contents) or opening random links even if I visited “legit” and “clean” sites.

I recommended Avast for it's heuristic engine (IMHO better than AVG). Malware bytes actually marks threats and help remove some “non-detectable” adware (details about heuristic engine vs. databases containing signatures of viral code is out of the scope here).

Having in fact an extended experience with those kind of threats, my advice is a first step for taking countermeasures against this malicious object (script). I also see the user has a strange object acting like overwriting content or redirecting page.

So, after scanning with those 2 tools, the user may come back telling: none worked. How we must interpret this second problem? I think the key in this case is thinking about “where” antivirus and other products used did not look. As obvious, there can be two major places: /data/ or /system root folders. So, in case we still have troubles after scanning with some tools the solution which comes to mind is to go in /data/ or /system folders and manually remove application which we suspect (browser application, in our case).

Being aware the user has a non-rooted device, a simple solution is to use another browser after deleting/uninstall browser app which caused trouble. I hope the user has original ROM by Xiaomi and not a "modified" one (there were rumors about malware packed inside 'Xioami' counterfeit rooms, even if the device looks legit).

Readings for reference:

From the settings page of the app, i cant find move to sd options. Seems like Xiaomi dosen't support move to sd natively. http://en.miui.com/thread-12681-1-1.html — Federico Ponzi, May 19 '15 at 09:17
Try to disable/delete/uninstall com.securitycore.miui_t (do not reboot phone) and see if browser still acts strange. I think it should be enabled again on reboot. I doubt Malware bytes and Avast did not find anything strange... — ares777, May 19 '15 at 09:50
Can't disable/delete/unistall it! Removed the data but the adware is still there :( — Federico Ponzi, May 19 '15 at 21:07

Removing redirect link malware

2 Answers2

Linked