1

I have some unwelcome behavior on my Samsung S4 AOS 5.0.1 (unrooted) phone. A few days ago I start to get attempts to open my web pages (up to 3 times a day so far) while my phone is idle. All cases have been bit.ly links for example:

http://bit.ly/2KG1tdA+ -- http://www.gohoi.com/jaguar-xj/
http://bit.ly/30muksQ+ -- http://www.gohoi.com/lincoln-mkz/
http://bit.ly/2nVdS4m+ -- https://t.co/leK1JpzypD
http://bit.ly/34WUUeL+ -- https://fb.itfactly.com/?url=https://l.facebook.com/l.php?u....

As I have no default browser I was able to capture URL and add "+" to end so I can get the detination URL on bitl.ly stats page as shown above in 2nd column. The first link went to at least 0.5 Million devices so somebody out there must have run into this phone abuse.

Is there anyway to trace what process is triggering the open web request (eg using logs, trace tools etc), so I can uninstall the app or disable it if it is builtin. Could it be "Peel remote".

Improve this question
2
  • 1
    @Scott: As you Android device is pretty old and therefore has multiple vulnerabilities keep in mind that the malware may have rooted your device and therefore it can be pretty hard (or even next to impossible) for you to remove it as you don't have root permissions. IMHO the best way to get rid of the malware is to root your device and then install the latest LineageOS release.
    – Robert
    Sep 29, 2019 at 11:10
  • @Robert you shouldn't be so quick to say that - I have a Xiaomi Mi A2, with security updates as current as 5 Sept 2019 - Android 9... and yet I'm getting this same behaviour! I too have Peel remote coincidently... I've now uninstalled it just to see if it stops. Scott R, I'll keep you updated if that helps stop them.
    – hazrpg
    Oct 5, 2019 at 19:46

0

Reset to default

Browse other questions tagged .