1

Recently some app started opening new firefox tabs with the adress 'livemobilesearch.com'. I uninstalled the most recentently installed apps, but the problem still persists. I assume the pages get opened when I unlock my phone from standby, because sometimes after I unlock the phone the screen flashes for a second and if I open the firefox after that, a new tab with said webpage is open. I already deleted the 'cache' and 'data' of the firefox app but nothing changed. Also I tried an anti virus and malware software called "Malwarebytes Security: Virus Cleaner, Anti-Malware", but it didn't find anything. I have two ideas / questions to find out what causes this problem:

  1. Does the firefox app have a logfile that tracks from where pages are openend?
  2. Is there a way to see a list of receivers that are 'subscribed' to the SCREEN_ON Event?

If anyone has another idea to how to fix my problem I'd be glad to hear it.

Thanks in advance.

EDIT: I've read and followed the instructions of the related articles from the comments. dumpsys activity activities shows the following:

* TaskRecord{3bf05cb #1075 A=com.android.chrome U=0 StackId=1 sz=1}
  userId=0 effectiveUid=u0a103 mCallingUid=u0a103 mUserSetupComplete=true mCallingPackage=com.android.chrome
  affinity=com.android.chrome
  intent={act=android.intent.action.VIEW dat=https://livemobilesearch.com/?utm_campaign=dist&utm_source=foobar flg=0x14002000 pkg=com.android.chrome cmp=com.android.chrome/org.chromium.chrome.browser.ChromeTabbedActivity}
  realActivity=com.android.chrome/org.chromium.chrome.browser.ChromeTabbedActivity

....

* Hist #0: ActivityRecord{bbeee47 u0 com.android.chrome/org.chromium.chrome.browser.ChromeTabbedActivity t1075}
      packageName=com.android.chrome processName=com.android.chrome
      launchedFromUid=10103 launchedFromPackage=com.android.chrome userId=0
      app=ProcessRecord{408bf79 18941:com.android.chrome/u0a103}
      Intent { act=android.intent.action.VIEW dat=https://livemobilesearch.com/?utm_campaign=dist&utm_source=foobar flg=0x14002000 pkg=com.android.chrome cmp=com.android.chrome/org.chromium.chrome.browser.ChromeTabbedActivity (has extras) }
      frontOfTask=true task=TaskRecord{3bf05cb #1075 A=com.android.chrome U=0 StackId=1 sz=1}
      taskAffinity=com.android.chrome
      realActivity=com.android.chrome/org.chromium.chrome.browser.ChromeTabbedActivity

The way I understand the output is, that the tabs were opened from chrome. I've disabled chrome for now, as I can't uninstall it.

EDIT 2: The problem still persits. Even though I followed the steps in the similar thread in the comments, the unwanted page still gets opened. I can't uninstall Chrome since it is a system app (I have a sony xperia x compact on Android 8.0.0).

After I disabled Chrome the unwanted page is still opened. It now states in the dumpsys: "launchedFromPackage=org.mozilla.firefox". It would appear, that the solution form the comments is in my case not working.

Any advice would be much apreciated.

KArlk.
  • 19
  • 3
  • Hi. Can you do this? Connect the phone to PC, start saving output of logcat command into a file through adb logcat -v long,descriptive > logcat_output.txt, unlock the screen and wait for the browser with that URL to be launched, and when done launching, press ctrl + c to exit saving the logcat's output. After that, share the logcat file with us using "github paste" or pastebin website. // Logcat is a very important tool to troubleshooting issues with Android. – Firelord Nov 27 '18 at 14:41
  • I've put the logcat here: https://pastebin.com/VZHXFeNW You can search for "livemobilesearch" to find the place where the page gets opened. – KArlk. Nov 27 '18 at 15:16
  • Can you give me the output of adb shell dumpsys package > dump_pkgs.txt or alternatively, adb shell 'dumpsys package | grep -B1 -e 10331 -e 10021'? Also, tag me with @Firelord to notify me of your comment. Thanks – Firelord Nov 27 '18 at 17:15
  • @Firelord here is the "dumpsys package": https://gist.github.com/KArlkackt/5bc56b4b627bcd1772ec73d7c4d42420 – KArlk. Nov 27 '18 at 19:27
  • Can you disable or uninstall the Farming Simulator app in your device and see whether the browser is still launched with that URL automatically upon unlocking the device? It is identified by some anti-malware programs as potentially malicious. See https://www.hybrid-analysis.com/sample/f11ee8a9522d73c8af296a3eca21a7487db48923ae8bdccabef919651bc4c592?environmentId=200 for more – Firelord Nov 27 '18 at 19:39
  • @Firelord After uninstalling the farming simulator, the problem went away. Thank you so much! I thought, because I paid for the app, the developer would not place malware in their product, but as it turns out I was wrong. Lesson learned. If you post an anwser I will mark it as the solution. – KArlk. Nov 28 '18 at 09:37
  • I'm glad we were able to work this out. However, I cannot post an answer here because the question is still a duplicate to that question. I've, however, added my findings from this answer into my other answer, so that it benefits people who would be spammed, like you, in future. If you intend to vote, which is voluntary, you may upvote it there. Thanks! – Firelord Nov 28 '18 at 11:15

0 Answers0