I have an Android (5.0.1 with December 2015 patches). My problem is with Chrome (latest version as per Google Play Store). Which has malicious redirect going on to hidcptqmerifcusymaqddcomolsujibeptsmycmqsrwgrcmywshgnfpjhcc.com

I have scanned the phone with both McAfee and Kaspersky security and no malware is detected. However The redirect is going on.

I suspect a JS file in the browser cache which after cleaning stops redirect for sometime (a day at best).

Any ideas how i can collect a sample before i reset my phone?

  • Are you using an open wifi or maybe a compromised network? Try connect via cellular or another wifi network. Also check if there's a proxy or VPN enabled. Try a different browser if all fails.
    – billc.cn
    Commented May 24, 2016 at 18:47

2 Answers 2


Firstly, go into Chrome -> Settings -> Search Engine and check the search engine. There is a malicious search engine bug that google is yet to fix involving JS execution via the Default Search Engines feature.

Then, grab everything from /data/data/com.android.chrome/. The chrome cache is in a directory named cache under this directory.

Next, wipe the entire directory from your phone manually and do a full factory reset.

  • Search engine is google.com I'm unable to view the folder using inbuilt file explorer (Samsung). I've enabled show hidden files and file extension both. Do I need to use ADB to view these? Only folder with com. Android.Chrome is under android directory and have no files (empty folders leading to download folder which is also empty.) Commented Jan 15, 2016 at 8:07

Are you facing this problem while using a wifi connection? If yes, please make sure other devices connected to the same wifi router are working properly. I am experiencing a similar issue in my home. My desktop computer with Fedora 23 is affected, together with all wifi devices sharing the same router. I have read in the avgforums that manually resetting the dns settings of modem resolves this issue, butI haven't tried it yet.

  • It wont help because this is not a DNS issue. DNS hijacks would return a false IP address for a requested url, such as google.com. But in this case here google.com is redirected to a different url.
    – Potaito
    Commented May 24, 2016 at 19:15
  • @potAito That doesn't rule out DNS-based attacks. An attacker could temporarily take control of a domain and issue a (permanent) redirection to another site.
    – Rob W
    Commented May 25, 2016 at 8:20
  • @RobW Hm you mean taking control of the name server responsible for a domain?
    – Potaito
    Commented May 25, 2016 at 14:18
  • That's a possibility, though it would be much easier (for an attacker) to have an open "free" WiFi network and handles DNS queries.
    – Rob W
    Commented May 25, 2016 at 23:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .