How to remove adware (browser hijack or pop-up malware) from Android

The browser hijack style malware is getting pretty widespread on Android devices, especially the cheaper ones that can be purchased directly from overseas and come with pre-installed malware. Let’s see how to find the adware app that is causing the issue.

The symptom is usually the same: when the web browser is opened it is redirected to an unknown webpage advertising something totally useless. In some cases a virus infected APK Android package gets downloaded in the hope that it will get installed.

The app that is causing this issue is waiting in the background for the browser process (either Chrome or Android Browser) to start. When it does it asks it right away to display a webpage.

The intent

Android natively supports communication between apps, which in itself is very useful, for instance a webpage can be opened from the email client.
The code is pretty straightforward too:

Uri webpage = Uri.parse(url);
    Intent intent = new Intent(Intent.ACTION_VIEW, webpage);
    if (intent.resolveActivity(getPackageManager()) != null) {
        startActivity(intent);
    }

The default browser will catch this intent and execute it, open the webpage. As intents can be a good source of problems (for instance, misconfigured intents), the system generally logs them: what was the intent, and which UID sent it.

The UID is unique on the specific phone for each installed app’s and they are listed in

/data/system/packages.xml

Logcat

The first job is to try to consistently reproduce the browser hijacking. Usually force killing the browser, waiting a minute or so and restarting it will trigger the malware to try to hijack it again.

The second step is to install ADB tool on your computer, enable USB debugging on the phone, plug in to the computer and execute the following command:

./adb logcat > log.txt

This will dump thousand of system log messages to this text file. Now reproduce the browser hijacking and stop the logging.
In the log.txt file the interesting lines look like this:

...
V/ActivityManager(  729): notify app switch for new activity com.chrome.beta Where 0

I/ActivityManager(  729): START u0 {act=android.intent.action.VIEW dat=http://global.ymtracking.com/trace?offer_id=100678&aff_id=27742 flg=0x10000000 cmp=com.chrome.beta/com.google.android.apps.chrome.Main} from uid 10035 on display 0

D/ActivityManager(  729): notifyAppSwitch resumed: true; pkg:com.chrome.beta
...

The middle line is showing that the app under user ID 10035 asked the system to execute a specific URL, a well know malware site.

If the phone is rooted, run adb again in shell mode to have a look at the app database:

./adb shell
su
vi /data/system/packages.xml

And find the line that looks like this:

<package name="... ...version="4003006" sharedUserId="10035">

(if it’s not rooted, there are app that can map from UID to app name in the Play Store).

In my case it was a modified and virus infected YouTube app, but it can be anything. If it’s not a system app, simply uninstalling it from the apps it enough. If it is a system app and cannot be removed, it’s easy to disable the package so the system cannot execute it any more. Execute the shell again and disable the package:

pm disable com.package.name.that.is.infected

Reboot the phone and the popups should be gone. If they aren’t, maybe there is another app displaying ads, so repeat the above process and uninstall the other app too.

Why not just use a virus scanner?

While virus scanners are good at finding actual Android app that contain known viruses, a malware that is hijacking the browser and display popup ads not necessarily known as a virus. Maybe it was custom made for that phone and the wholesaler installed it to earn some extra revenue. Either way, run a virus scanner just to be sure. I’ve found that Nod32 and AVG work well, but only install them from the store! If they come pre-installed, they cannot be trusted.

Any comments? Please let me know.