7

I've recently bought a new Android smartphone. After setting it up and loading my contacts onto it I thought that would be it.

Now after some days, every time I unlock the phone it takes a few seconds before it opens the default browser and opens some spam website. I tried to see what was causing it. I removed any apps I didn't know I could trust, but the problem persisted. After trying to solve it for some time I gave up and reset the phone to factory default. Now after having it reset to the default it ran without issues for roughly a week before the problem reappeared.

I tried to uninstall some apps in order to see if they were to cause of it, but nothing changed after doing so. However I did notice that if I turn off the wifi it won't even try to open the browser (I haven't tried mobile data since I don't have a bundle). This makes me feel like it might be related to something on the network but that wouldn't explain why only that phone would have the issue when there are at least 6 android phones on that very same network.

I hope that there is someone who can help me find the cause of this issue and help me solve it.

TL;DR When unlocking my phone, it opens the browser and tries to open a spam website. But only does so while connected to the wifi.

Things I've tried so far:

  • Factory reset (only helped for a limited time)
  • Clearing the browser cache and all related data
  • Removing any app I don't know to be reliable
  • Attempting to find what triggers it (seems like some type of internet connection is required??)

The device is the Doogee Shoot 1. As for the browser, the default is set to be the Android browser, but if I change the default it would use Chrome just as well. It seems to really just use the browser that is set to default.

  • @beeshyams i have tried to clear the browser data a few times, and if clearing that didnt do it then the factory reset should have solved the cookies but it simply came back some time after. – maam27 Jul 7 '17 at 11:38
  • 2
    @beeshyams the malware not necessarily made it into a system app (eg. that wouldn't explain why it took a week after the factory-reset for the problem to pop up again). I'd check for apps with listeners to the screen unlock broadcast to narrow down candidates (see: detect phone unlock event, the best candidate seems to be Intent.ACTION_USER_PRESENT). – Izzy Jul 7 '17 at 11:55
  • @izzy: Valid point. Thanks. Doesn't it mean he will have to uninstall all user apps as an easy way to isolate after backing up data? – beeshyams Jul 7 '17 at 12:13
  • 1
    @beeshyams I didn't say "uninstall" – I wrote check for apps having such a listener established, and then first deal with those explicitly. Take a look at Applications Info (Playstore / FDroid / screenshot, check "Receivers" here). – Izzy Jul 7 '17 at 13:46
  • 1
    @Izzy would it be possible to go to a chat and see if we can find the problem by doing so? since it would also keep the comments a bit shorter – maam27 Jul 7 '17 at 14:01
13

Based on the troubleshooting OP did following my advices, the culprit appeared to be a system app as a malware named System Locker with package name com.tihomobi.lockframe.syslocker. The issue appears to be a result of a system update, per some users of the device.

As usual with a system app, if you get to use the Disable option under Settings → Apps → System apps/All apps → the culprit, than by all means, do disable that app, force-stop it or reboot the Android. The issue should stand resolved until you factory reset the device.


Troubleshooting #1

Here's how I found out the culprit. The in-built Android tool dumpsys inter alia shows which app was called by which other app. The caller is referred to as Calling Package.

Provided that you have setup and successfully in the PC and Android device, do the following:

  1. keep the device connected to PC
  2. reboot the device or force-stop that default browser app
  3. let the malware do its job, that is, have the browser be launched automatically
  4. as soon as the browser is launched, do nothing with the device physically, but run the following adb command on PC:

    adb shell dumpsys activity activities
    

Here's the output from OP's device:

ACTIVITY MANAGER ACTIVITIES (dumpsys activity activities)
Display #0 (activities from top to bottom):
  Stack #1:
    Task id #2
    * TaskRecord{8190ba1 #2 A=android.task.browser U=0 sz=1}
      userId=0 effectiveUid=u0a64 mCallingUid=u0a26 mCallingPackage=com.tihomobi.lockframe.syslocker
      affinity=android.task.browser
      intent={act=android.intent.action.VIEW dat=http://im.apostback.com/click.php?c=362&key=9wl83884sg67y1acw3z56z90&s4=8%2FdNwcNuQFEjjaucho5IqA%3D%3D flg=0x10000000 pkg=com.android.browser cmp=com.android.browser/.BrowserActivity}
      realActivity=com.android.browser/.BrowserActivity
...
...
Hist #0: ActivityRecord{66cd59b u0 com.android.browser/.BrowserActivity t2}
          packageName=com.android.browser processName=com.android.browser
          launchedFromUid=10026 launchedFromPackage=com.tihomobi.lockframe.syslocker userId=0
          app=ProcessRecord{5ad1810 4337:com.android.browser/u0a64}
          Intent { act=android.intent.action.VIEW dat=http://im.apostback.com/click.php?c=362&key=9wl83884sg67y1acw3z56z90&s4=8%2FdNwcNuQFEjjaucho5IqA%3D%3D flg=0x10000000 pkg=com.android.browser cmp=com.android.browser/.BrowserActivity }

In the output: :

  • com.android.browser is the package name of stock Android browser in your device
  • com.tihomobi.lockframe.syslocker is the package name of the malware app and is referred as calling package.

If you've found the malware, avoid next troubleshooting and skip to the heading Nuke the malware.


Troubleshooting #2

(In response to a duplicate posted here -- the culprit app was Farming Simulator 18)

In certain circumstances, aforesaid troubleshooting may not be able to help, such as when calling package name is the package name of the browser itself shown in dumpsys output. In that case, prefer . Setup logcat like this:

adb logcat -v long,descriptive | grep "dat=http"   # you can grep anything from URL too. It is purely up to you.
adb logcat -v long,descriptive > logcat.txt        # alternative; if grep is not installed in your OS. You need to search into that file now.

Now unlock the device and let the browser with that URL be launched automatically. Also, press Ctrl with C if you are saving the output into a file.

The output we're seeking would look akin to:

[ 11-27 16:03:22.592  3499: 6536 I/ActivityManager ]
START u0 {act=android.intent.action.VIEW dat=https://livemobilesearch.com/... flg=0x10000000 pkg=org.mozilla.firefox cmp=org.mozilla.firefox/.App} 

from uid 10021
...

[ 11-27 16:03:22.647  3499:15238 I/ActivityManager ]
START u0 {act=android.intent.action.VIEW dat=https://livemobilesearch.com/... pkg=org.mozilla.firefox cmp=org.mozilla.firefox/org.mozilla.gecko.BrowserApp} 

from uid 10331

See the two highlighted UIDs 10021 and 10331. One of them (they would be different in you case) is for the browser app launched, and one of them is malware app requesting that URL. So, how to find what is what?

If you've root access, simply do:

adb shell su -c 'ls -l /data/data/ | grep u0_a21'
adb shell su -c 'ls -l /data/data/ | grep u0_a331'

Output would be like:

drwx------  5 u0_a21    u0_a21    4096 2018-01-01 10:31 com.android.chrome
drwx------  5 u0_a331    u0_a331    4096 2018-01-01 10:31 com.tihomobi.lockframe.syslocker

If you don't have root access, do:

adb shell dumpsys package > packages_dump.txt

Now search for the line with your UIDs such as "userId=10021" and "userId=10331". The line above the line searched would give you the package name, and may look something like this:

Package [com.android.chrome] (172ca1a):
    userId=10021
...
Package [com.tihomobi.lockframe.syslocker] (172ca1a):
    userId=10331

The two package names are com.android.chrome (for Chrome browser -- certainly not a malware) and com.tihomobi.lockframe.syslocker. To know the app's name from package name, use my answer here.


Nuke the malware

Now that you know the culprit, you can disable it through GUI as stated above. If that is not possible, do:

adb shell pm disable-user PKG_NAME  # disables the app
adb shell pm uninstall --user 0 PKG_NAME # removes the app for primary user
adb shell am force-stop PKG_NAME # only force-stops the app

Replace PKG_NAME with package name of the malware you noted in the troubleshooting above.

That should do the trick. Furthermore, you can also consider removing the malware app permanently for all users, but that requires root access though.

  • 1
    Thanks for taking over the chat where I had to leave – and great analysis, +1! Learned a new thing about dumpsys that way :) – Izzy Jul 10 '17 at 8:56
  • @Izzy I'm glad you like it. :) – Firelord Jul 10 '17 at 14:39
0

Slightly more information needed to solve the issue, although I will attempt to find the possible problems. Which browser? What phone model? Was it purchased from official sources?

In theory factory reset should have helped you with the issue. Since it didn't, there are a couple more places where you can get some form of adware. First of all, you said uninstalling some apps? Which apps in particular? Did it appear after installing a particular piece of software?

Is it your wifi or are you using a public one? If its public one, usually companies send app install and advertisements requests through wifi relatively often. If you live in/near a busy area, wouldn't be surprised if that would be just someone using to advertise their product. Try using different wifi or someone else's wifi, see if the problem persists. If it doesn't. It is an issue with the network you are using, which means you are most likely going to need to change. You could try contacting your provider to help you with that (Had an issue like that before, my ISP providers helped me after contacting support). Also, see if the mobile network shows the same problem. If it doesn't, then your option would be to change the network you are currently using.

  • The apps i meant were all installed from the appstore but I do realize that not all of them can be safe at all times and sometimes things get past the security of it. so I tried to remove some that i didn't know if they were completely safe or not. as for the internet, it is a private network and I dont live in a crowded area. But since im using a Pre-Paid card would mean trying the mobile data becomes expensive. I might try something using the pc as a hotspot see if that has any diffrence from the wifi directly. – maam27 Jul 7 '17 at 11:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.