4

I have Xiaomi Mi3 and it's not rooted. Every time I open a web page, both on mobile data and WiFi, and even with different browsers, I get redirected to other pages with ads and pages like this:

http://mobiles.digital/IT/Sweepstake/LP/index.php?voluumdata=vid..00000004-4837-403c-8000-000000000000__vpid..ca8d4800-fd5d-11e4-88ba-7eef5f3eb726__caid..5422e033-3dc6-4996-b128-7bf07d491d19__rt..R__lid..19777e53-9ce2-45a2-8073-ce9466d65506__oid1..7756b6f2-77b0-4db4-8d79-0faa4854c67f__oid2..b504e00f-54b7-4fd2-99de-09a0e4919980__var1..425682__rd..www%5C.%5Cyouradexchange%5C.%5Ccom&SiteID=425682

I have tried:

  • Many antivirus (including AVG premium app which was free this weekend on Amazon app shop)
  • Factory reset: inside settings on my phone
  • Hard reset: deleted cache and installed app.
  • AdBlocker plus.

But nothing worked.

Here's the installed apps on my phone: https://drive.google.com/folderview?id=0B2cFQ2PnOtfNT0NsMnZJY1NiT1U&usp=sharing

Improve this question
10
  • 1) Is your phone rooted? 2) Have you tried an adblocker? 3) Can you share screenshots of the apps installed (if no privacy concern exists)? 4) Does it happen on Wifi , mobile data, or both?
    – Firelord ♦
    May 18, 2015 at 18:09
  • 1)No 2)Yes, ive tried adblock but 3) i'll share it asap 4) both thanks for good question gonna edit my post asap
    – Federico Ponzi
    May 18, 2015 at 18:32
  • 1
    Are you going to share screenshots (mentioned in the comment)?
    – Firelord ♦
    May 18, 2015 at 20:19
  • 1
    For me the album link don't work even logged into google plus. Are you sure it's public?
    – ares777
    May 19, 2015 at 5:29
  • 1
    It seems you're infected with YourAdExchange malware (note the URL at the end). However, I still haven't found any clue to clean it on Android.
    – Andrew T. ♦
    May 19, 2015 at 8:00

2 Answers 2

Reset to default
3

I'd like to get more information to help. Could you show the MIUI version of your phone? See it in Settings -> About Phone -> MIUI version. If you can use adb in your PC? I think It will be helpful if you can show the output of PC command "adb shell pm list packages" and the output of "adb shell ls -l /system/app /system/priv-app"

By the way, if a factory reset can not resolve the problem you can try a full ota update which will reformat the system partition. To do full ota update: Click the Updater app, and then click the menu button in the right top, then click the "Download update" item. !Remember to backup your files!

enter image description here

enter image description here

Improve this answer
4
  • The MIUI version is 4.10.17, android version 4.4.4 . When i try to Download update i get a "no update available "message, so i can't do it. Thanks anyway!
    – Federico Ponzi
    May 19, 2015 at 21:10
  • 4.10.17 is a beta version and is rooted by default. Did you get it from the MIUI's official website? (en.miui.com)
    – Juhu
    May 20, 2015 at 4:05
  • I actually brought it from xiaomi on Amazon
    – Federico Ponzi
    May 21, 2015 at 12:09
  • I think you can try to download a full ROM package to do an update and then do a factory reset. The official download website: en.miui.com/download.html
    – Juhu
    May 22, 2015 at 6:37
0

Try Avast free and Malwarebytes , one after another (not 2 installed in the same time).

Try to move the app masked as com.securitycore.miui_t to SD card, then scan your phone again.

Reasoning:

I removed an "insane" pop-up linker (no matter what browser I used) which, instead acting like an activity by default (a malware activity) just used text displayed on webpage ( reading html meta tags ) and added link with advertorial content (manipulating content by adding div contents) or opening random links even if I visited “legit” and “clean” sites.

I recommended Avast for it's heuristic engine (IMHO better than AVG). Malware bytes actually marks threats and help remove some “non-detectable” adware (details about heuristic engine vs. databases containing signatures of viral code is out of the scope here).

Having in fact an extended experience with those kind of threats, my advice is a first step for taking countermeasures against this malicious object (script). I also see the user has a strange object acting like overwriting content or redirecting page.

So, after scanning with those 2 tools, the user may come back telling: none worked. How we must interpret this second problem? I think the key in this case is thinking about “where” antivirus and other products used did not look. As obvious, there can be two major places: /data/ or /system root folders. So, in case we still have troubles after scanning with some tools the solution which comes to mind is to go in /data/ or /system folders and manually remove application which we suspect (browser application, in our case).

Being aware the user has a non-rooted device, a simple solution is to use another browser after deleting/uninstall browser app which caused trouble. I hope the user has original ROM by Xiaomi and not a "modified" one (there were rumors about malware packed inside 'Xioami' counterfeit rooms, even if the device looks legit).

Readings for reference:

Improve this answer
3
  • From the settings page of the app, i cant find move to sd options. Seems like Xiaomi dosen't support move to sd natively. en.miui.com/thread-12681-1-1.html
    – Federico Ponzi
    May 19, 2015 at 9:17
  • Try to disable/delete/uninstall com.securitycore.miui_t (do not reboot phone) and see if browser still acts strange. I think it should be enabled again on reboot. I doubt Malware bytes and Avast did not find anything strange...
    – ares777
    May 19, 2015 at 9:50
  • Can't disable/delete/unistall it! Removed the data but the adware is still there :(
    – Federico Ponzi
    May 19, 2015 at 21:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .