More or less two or three weeks ago strange pop ups came up on my PC. Antivirus detected ga.js as virus. I thought it was a false positive. Then I've found that the thing somehow jumped on my phone. Every time I surf the internet, unwanted sites pop up. The thing is equally behaving on all browsers: native g3 browser, Mozilla and Chrome. I've tried almost everything:

  • Kaspersky free, McAfee security, and Malwarebytes
  • Delete Chrome cookies, block cookies, delete site data, delete cached data
  • Reset my router and clear the DNS cache.

Nothing. The thing goes undetected, same thing on the PC. Even surfing without the router my phone redirects every time I browse. I'm about to hard reset my phone but this evidently is a malware.

So how is it possible that it goes unnoticed?

My phone is not rooted and the sites I'm being redirected to are those reported here, amongst others. Anyway, I still don't see a solution to this problem.

  • A similar question was discussed here on Google Groups, though you might have already read it by now. I need to know, are you rooted? Besides, do you also face this redirection issue in Safe-mode too?
    – Firelord
    Commented Mar 26, 2015 at 10:10
  • possible duplicate of Malware adding code to ga.js opens up random ads/websites?
    – Andrew T.
    Commented Mar 26, 2015 at 10:27
  • I'm not rooted. What do you mean by safe-mode? How do I turn it on?
    – Muteking
    Commented Mar 26, 2015 at 10:33
  • @Muteking Please mention the user name too when you comment. It helps in receiving notifications. About safe mode, you can check this question. You need to find on Google how to enter into Safe mode in your device.
    – Firelord
    Commented Mar 26, 2015 at 10:39
  • 1
    @Izzy Even surfing without the router my phone redirects everytime -- I take this as mobile data as he might have meant router as wifi , though I can be wrong here.
    – Firelord
    Commented Mar 26, 2015 at 14:57

2 Answers 2


Ok, it seems I've found a solution.

  1. Disconnect internet;

  2. Go to Settings -> Applications. Clear every data (cache, history, modules, cookies) from Settings -> Applications -> Browser (Mozilla, stock browsers, Chrome)

  3. Open each browser and access the settings (in the top right) and delete upgrades, cache, modules, autocompletes, etc

  4. Close all applications

  5. Restart your phone, reactivate data connection and you should be clean.

I'm baffled on how updated antiviruses and anti-malwares can't detect such things.


There are a couple of DNS apps that will assist. they are named "" and "" they force use of those clean DNS sites. Personally next I would use a much more feature rich "Anti-Anti" tools. Virus - Malware tools. Free is not always a good idea, in my humble opinion IMHO. TrenMicro for Android and Malwarebytes also. You get some cross-protection, but in my 15 years of Android use, from Froyo 2.2 to xx 8.0 that isn't always a bad thing. Different signatures written by different vendors, in different geographic locations, in my experience are very effective! TrendMicro is based in Japan, MB is in the USA, Ireland and Estonia. Each has developers in different locations. This is important still today, as malware released in the wild, are found by different labs, different locals, with different solutions. Give my protocol a try. It has not failed me. NO Norton, malware is written to disable it first & foremost!

I tried to avoid Proper Names of solutions, but this answer relies on them.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .