3

I have an Android (5.0.1 with December 2015 patches). My problem is with Chrome (latest version as per Google Play Store). Which has malicious redirect going on to hidcptqmerifcusymaqddcomolsujibeptsmycmqsrwgrcmywshgnfpjhcc.com

I have scanned the phone with both McAfee and Kaspersky security and no malware is detected. However The redirect is going on.

I suspect a JS file in the browser cache which after cleaning stops redirect for sometime (a day at best).

Any ideas how i can collect a sample before i reset my phone?

  • Are you using an open wifi or maybe a compromised network? Try connect via cellular or another wifi network. Also check if there's a proxy or VPN enabled. Try a different browser if all fails. – billc.cn May 24 '16 at 18:47
2

Firstly, go into Chrome -> Settings -> Search Engine and check the search engine. There is a malicious search engine bug that google is yet to fix involving JS execution via the Default Search Engines feature.

Then, grab everything from /data/data/com.android.chrome/. The chrome cache is in a directory named cache under this directory.

Next, wipe the entire directory from your phone manually and do a full factory reset.

  • Search engine is google.com I'm unable to view the folder using inbuilt file explorer (Samsung). I've enabled show hidden files and file extension both. Do I need to use ADB to view these? Only folder with com. Android.Chrome is under android directory and have no files (empty folders leading to download folder which is also empty.) – Parth Maniar Jan 15 '16 at 8:07
1

Are you facing this problem while using a wifi connection? If yes, please make sure other devices connected to the same wifi router are working properly. I am experiencing a similar issue in my home. My desktop computer with Fedora 23 is affected, together with all wifi devices sharing the same router. I have read in the avgforums that manually resetting the dns settings of modem resolves this issue, butI haven't tried it yet.

  • It wont help because this is not a DNS issue. DNS hijacks would return a false IP address for a requested url, such as google.com. But in this case here google.com is redirected to a different url. – Potaito May 24 '16 at 19:15
  • @potAito That doesn't rule out DNS-based attacks. An attacker could temporarily take control of a domain and issue a (permanent) redirection to another site. – Rob W May 25 '16 at 8:20
  • @RobW Hm you mean taking control of the name server responsible for a domain? – Potaito May 25 '16 at 14:18
  • That's a possibility, though it would be much easier (for an attacker) to have an open "free" WiFi network and handles DNS queries. – Rob W May 25 '16 at 23:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.