Help Can't get rid of malware and "ads by cloudscout" even after factory reset

[Daveal]

Hi guys, any help you could provide on this would be hugely appreciated.

I've picked up some kind of malware on my Samsung Galaxy S4 and can't seem to get rid of it. It is affecting Chrome, Firefox and the basic Internet browser.

It began with inpage ads being hijacked and changed to other ads with a little note on them saying "ad by cloudscout." A couple of days later it started with the popups and the browser redirects to pornographic and gambling, then it began bringing up the google App Store (or at least something that looks like it) trying to get me to install various gaming/gambling apps.

I did a scan with AVG mobile, AVAST antivirus & security, and finally malware bytes. None of these detected any problem.

So I factory reset. Then I installed the latest operating system through kies. I didn't put any of the data that I had backed up back onto my phone.

Within three days the same problems have returned.

The only apps I have installed are the following:
Firefox
Instagram
Facebook messenger
NAB (bank app)
Swype + dragon keypad/keyboard
TramTracker (local public transport app)
Whatsapp
And I updated YouTube

I installed all of these apps through the google play store

Also, in the past few days the phone has begun to turn itself off, even with a reasonably full battery.

I haven't rooted my phone, now or in the past.

Has anyone come up against this set of problems and does anyone know how to get it back to working order?

Again, any help would be greatly appreciated.

 

[EarlyMon]

Go to your app manager and clear data and cache on all installed browsers.

Hijacks seem to be living in /sdcard/Android/data and scanners aren't looking there, on some phones neither does a factory data reset. I've written Malwarebytes about it but haven't heard back.

Also try Addons Detector from the Play Store.

Make sure that the problem exists on mobile data, 3G or 4G either one. If not, your wifi router has been hijacked and you'll need to do a hard reset on that.

 

[Daveal]

Th

Go to your app manager and clear data and cache on all installed browsers.

Hijacks seem to be living in /sdcard/Android/data and scanners aren't looking there, on some phones neither does a factory data reset. I've written Malwarebytes about it but haven't heard back.

Also try Addons Detector from the Play Store.

Make sure that the problem exists on mobile data, 3G or 4G either one. If not, your wifi router has been hijacked and you'll need to do a hard reset on that.

Thanks for the quick reply mate. I'll give that a go now.

It's all been through mobile data, no wifi, if that makes any difference.

I'll let you know how I go, thanks again for your help.

 

[Dooganau]

Hi I have had the same problem, just did a factory reset this morning. So far no problems but I haven't installed new apps. In terms of your only apps I had previously, that you now do was :
Facebook messenger, NAB, messeger (google) and whatsapp.
You are also Australian obviously. May be a malicious Aussie website ad that's injecting malware. I'm using a nexus 5. I'm going to keep apps off the phone till I'm sure it's clear. Let you know

 

[Zegor]

Hi. I have the exact same problem.

I work in IT so know the basics about viruses and malware, and how to avoid getting them. Having said that, somehow I have this malware / adware issue on my Google Nexus 5. I haven't rooted the phone or anything. I haven't installed any dubious apps. I use Chrome. ...so I just don't know how I got this thing. Symptoms are exactly as described in the original post by Daveal.

When browsing in Chrome, links get underlined with a green icon / arrow near them and additional ads appear, such as "by cloudscout". When clicked, they take you to crazy places.

I had tried about five different anti virus / malware apps - AVG, kaspersky, etc. None found anything. I factory reset - all fixed. Now, about one week after the factory reset - it has started to occur again.

Any help would be greatly appreciated! This is driving me nuts.

 

[EarlyMon]

You want to go to the app manager, and clear data for all of your browsers.

They write data to the /sdcard and that's not getting cleared by the factory data reset.

 

[EarlyMon]

See also -

http://androidforums.com/threads/android-chrome-redirection-virus-malware-adware.878655/