Monthly Archives: January 2014

Warning! Your phone has (13) Virus! pop-up ads

Warning! Your phone has (13) Virus! are misleading pop up ads that lead users to a scam virus check. Users are reporting the issue with fake warning on eBay, NHL and other popular website. Of course, it doesn’t mean that those sites are trying to install some shady apps on your phone or tablet. They are likely having problems with their ad providers and hopefully will kill the offensive ads as soon as possible. However, if you keep getting Warning! Your phone has (13) Virus! and similar pop ups on pretty much every site you visit then your phone could be infected with adware.

Here’s an example of the offensive ad:

Warning! Your phone has (13) Virus!
The Virus may corrupt your data.
Please follow the instructions to remove the Virus.

kingmoible.com pop up

Then there’s a fake system notification with the steps on how to remove the supposedly detected virus.

Step 1: DOWNLOAD and INSTALL 360 Mobile Security Antivirus App!
Step 2: Open the App and Remove ALL Viruses

Your Phone has (13) virus! warning

If you click Download Here button you will be redirected to another websites to download an antivirus app called 360 Mobile Security Antivirus. It is developed by Qihu 360 Software Co., LTD based in China, I wrote about this app in my previous post. The fake pop-ups came from kingmoible.com.

I also noticed that scammers are using different virus warnings to scare users. Here’s yet another faker virus scan page.

WARNING: YOU MAY BE AT RISK!
COMPLETE : (7) THREATS
(3) MALWARE APPS
(2) VIRUS THREATS
(1) VS. 2.3 UPDATE
(1) SECURITY UPDATE

warning you may be at risk pop up

Although the fake ads are slightly different they all redirect users to either fake sites or Google Play to download shady apps. If you got any of these pop ups, close them immediately and do not download anything. Just close it or hit back button. In case you are constantly getting fake Warning! Your phone has (13) Virus! pop-ups on your phone or tablet, go to device’s Settings menu > Apps or Application manager (this may differ depending on your device). Uninstall apps that may display these pop-ups (recently installed). Most likely, your device is infected with adware. Also, scan your computer with reputable antivirus app.

Further useful reading: Smartphone Security – Best Practices.

Trojan:MobileOS/Tapsnake virus pop up – how to remove

Trojan:MobileOS/Tapsnake is a malicious app that can track your phone’s or tablet’s location and send it to a remote server or directly to a person who tries to spy on you. This Trojan horse is quite dangerous but the good news is that it was detected and removed from app markets very quickly. It’s not a very widespread threat now. However, I recently stumbled upon a few fake pop ups that were using this threat to scare users into thinking that their Android devices were infected with Trojan:MobileOS/Tapsnake. It’s not the first time when scammers use existing threats to trick users into installing fake or useless antivirus apps. The virus warning is fake. I got this fake pop up warning from mobile.alert.secure-intl.com:

ANDROID VIRUS DETECTED

A site you recently visited has infected your phone with (Trojan:MobileOS/Tapsnake).

Press OK to remove the threat.

mobile.alert.secure-intl.com virus warning

As I said, it’s fake. Your smartphone or tablet is not infected. Just close the pop up and do not download anything.

Then, I found another scam related to Trojan:MobileOS/Tapsnake. It was a fake virus scanner. Here’s the screenshot:

WARNING: Virus Detected!
VIRUS NAME: TAPSNAKE
Infected File: /os/apps/snake.icv
Description: Steals passwords and credit card information.
ACT NOW (HIGH RISK)

tapsnake virus warning

This security warning looks like the real thing. It mimics real antivirus scanners and it does this really well. Not too tech-savvy users can be easily tricked into installing fake antivirus app. If you got one as well, take a deep breath and don’t panic. Your device is not infected.

Once the scan is finished, the fake web page redirects users to Google Play to install an app called Armor for Android. It might be different for you. Or instead of download it from Google Play it may redirected you to androidsecurityfree.org web page which will display yet another fake virus warning.

If you got the same fake warning do not click on the pop-up box or anywhere in it. Just close it or hit back button. In case you are constantly getting fake Trojan:MobileOS/Tapsnake pop-ups on your phone or tablet, go to device’s Settings menu > Apps or Application manager (this may differ depending on your device). Uninstall apps that may display these pop-ups (recently installed). Most likely, your device is infected with adware. Also, scan your computer with reputable antivirus app.

Further useful reading: Smartphone Security – Best Practices.

Google-android-safe.com virus warning pop ups on Android

Beware of new misleading pop ups from http://update.google-android-safe.com that have recently started to occur on eBay. I bet similar misleading virus pop ups will occur on other websites as well but probably with slightly modified or completely different warnings. The latest pop ups say that your phone or tablet is infected with viruses. Here’s an example:

Warning:Your phone has (13) Virus!

The Virus may comput you date .

Please follow instructions to remove Virus

update.google-android-safe.com pop up

It’s nothing new really and it even has typos. The main goal of this fake virus warning is to scare you into thinking that your phone is infected with viruses. If you click OK you will be redirected to Google Play to download a security app called 360 Security. It’s a free antivirus app developed by Qihu 360 Software Co., LTD based in China. Of course, it doesn’t mean that other users will be redirected to the same product but at least for me it was the 360 Security app. The app was recently updated and even though it has many positive reviews, more than 40,000 gave it 1-2 starts rating complaining about memory usage, unethical advertising and some users even say it’s a fake app. Since it’s promoted in such a questionable way, I wouldn’t use it. Besides, there are many great apps from well known and trusted antivirus vendors.

In case you are constantly getting fake update.google-android-safe.com pop-ups on your phone or tablet, go to device’s Settings menu > Apps or Application manager (this may differ depending on your device). Uninstall apps that may display these pop-ups. Most likely, your device is infected with adware that displays fake virus warning from google-android-safe.com.

Further useful reading: Smartphone Security – Best Practices.

Mobile.alert.secure-intl.com virus warning on Android

Beware, it’s a fake virus warning that attempts to scare you into thinking that your phone or tablet is infected with malware, for example Trojan:MobileOS/Tapsnake. Scammers didn’t made it up, such infection exists and it’s pretty nasty. It can track your location and do other malicious stuff. However, in this case, scammers are only using it to scare you. They may use other threat names in the future. The fake mobile.alert.secure-intl.com pop up virus warning says:

ANDROID VIRUS DETECTED

A site you recently visited has infected your phone with (Trojan:MobileOS/Tapsnake).

Press OK to remove the threat.

mobile.alert.secure-intl.com virus warning

If you click OK you will be redirected to another fake page that says “ANDROID WARNING”, then there’s an Android logo and a big button to REMOVE VIRUS.

fake android warning

Then you will be redirected to yet another page which pretends to scan your phone or tablet for virus: http://mobile.alert.secure-intl.com/detection.html. It’s not a pop up but a fake virus scanner. Just like the previous pop up it basically says the same thing – your computer is infected with Trojan:MobileOS/Tapsnake but this time in a more fancy and convincing way. The fake scanners says that Tapsnake virus scan steal your password and credit card information. Basic stuff actually, nothing really interesting or new. But, unfortunately it might work because it’s a new platform and users may not be aware of such things.

At the end, it says that you need to install an antivirus app to remove found malware from your Android device. At this point, users can be redirected to different fake antivirus apps. They usually promote more than one app. It could be Armor for Android or something different. The most important thing is to hit back button as soon as you get such fake pop-ups and do not install anything on your phone. It won’t hurt scanning your phone with reputable antivirus app from Google Play.

In case you are constantly getting fake mobilekd.com pop-ups on your phone or tablet, go to device’s Settings menu > Apps or Application manager (this may differ depending on your device). Uninstall apps that may display these pop-ups. Most likely, your device is infected with adware that displays fake virus warning from mobile.alert.secure-intl.com.

Further useful reading: Smartphone Security – Best Practices.

Mobilekd.com – your device is infected pop-up

I recently encountered another misleading pop-up alert saying that my Android device is infected. I just clicked on a link and it immediately took me to mobilekd.com with the fake pop-up message. The screen shot is here:

The page at ‘http://mobilekd.com’ says:
[Date] ALERT! Your [Device model] is INFECTED. Please INSTALL to continue.

It’s a simple JavaScript file that identifies device model and displays it in the fake pop-up, probably to make it look more realistic and trick users into downloading malicious or useless software from untrusted sources. If you got the same message do not click on the pop-up box or anywhere in it. Just close it or hit back button. If you haven’t noticed any unusual activity on your phone or tablet then you are most likely fine. However, if you think that something could have been installed without your interaction then perform a scan with free antivirus app, keep an eye on your account and just in case , change your password. But as I said if you haven’t noticed any weird activity then your phone or tablet is probably fine.

In case you are constantly getting fake mobilekd.com pop-ups on your phone or tablet, go to device’s Settings menu > Apps or Application manager (this may differ depending on your device). Uninstall apps that may display these pop-ups. Most likely, your device is infected with adware.

‘Check your Android NOW for a Virus!’ pop-ups and intrusive ads

‘Check your Android NOW for a Virus!’ is a fake pop-up message trying to trick you into downloading some fishy apps, very often from places other than the Google Play. Most of the these are just annoying ads for questionable apps but keep in mind that they can also redirect you to exploit kits that may install malware on your phone or tablet. Don’t take the risk and close such fake message immediately or press back button.

check your android now for a virus

Internet is full of such false ‘antivirus check’ pages, which push you to supposedly scan your phone for malware or install useless apps, for example free system cleaners that will later display more ads on your device. Such fake message can come from websites and apps but if you have been getting them for a couple of days or even weeks then your Android device is probably infected with some sort of adware. However, it this happens on a particular website only then report the issue to webmasters and clear browser cache. Open web browser, go to Settings > Privacy and Security and then tap Clear cache (this may differ depending on your device).

If you still get the ‘Check your Android NOW for a Virus!’ message then there’s probably an app on your phone that displays it. If so, go to device’s Settings menu > Apps or Application manager (this may differ depending on your device). Touch the app you’d like to uninstall. If you can’t decide if it is a legitimate app, search in Google play and search in Google for reviews.

You could also scan your phone with antivirus app to make sure no malicious apps were side-loaded from untrusted sources. If none of this helps, you can always reset your phone to factory settings. This will delete all your personal data and apps from the phone, so make sure your important data is backed up.

False positive from Avast Mobile Security labeled genuine apps as malware

Lots of Avast Mobile Security users were getting false warnings about Trojans and Potentially Unwanted Programs, such as Android:SMSSend-DC[trj], Android:Gappusin-CD [Trj], Android:GinMaster-ABD [Trj], Android:GinMaster-CO[Trj], ELF:Lootor-C [PUP] on their mobile phones and tablets. Don’t worry, it’s an Avast problem, your device is not infected. It was confirmed by one of the Avast support members here.

unfortunatelly wrong virus definitions have been released for a brief amount of time. We are working on a fix and once it is released, I’ll let you know (so you can manually check for updates and don’t have to wait for the automatic process to kick in).

false avast mobile security

As you can see, Avast Mobile Security falsely detected Android system files and apps like Google Plus as malware. Some users couldn’t user their phones properly because of of the false warnings Avast was constantly giving. The Avast team released a fix a few hours ago. If you are still getting those false warnings, please update Avast manually.

Open Avast Mabile Security -> Settings -> Update -> and tap “Check for updates” to receive working definitions version 140109-01. You may still see “Malware found” on dashboard for some time after updating but it will clear itself once all the apps are re-scanned.

There’s no need to uninstall the app.

Important: hackers sometimes try to exploit such false positive and may offer “solutions” for the problem. For example, by using shady techniques, hackers manages to get infected webpages high in the search rankings if you hunt for information on the Avast Mobile Security false positive, including falsely reported malware names, let’s say Android:SMSSend-DC[trj].

Fake boostyourwifi.com pop-up ads and virus warnings on Android

Today I found a few more websites that display fake pop-up ads and virus warnings on Android devices, one of them is boostyourwifi.com. It uses almost exactly the same method as lovelinks.us but the fake scanner pages are a lot more sophisticated. They clearly try to mimic antivirus apps.

The first fake virus warning page says that your Android might be at serious risk. It supposedly scanned your Android device and found 3 viruses in the system folder and 3 more in downloaded files folder. It also found 5 apps that are probably malicious. Scan results are completely false. Besides, this fake virus scanner lists the same number of infections for every single visitor which means it doesn’t actually scan the device.

boostyourwifi-com

Here’s the second one, titled Android Mobile Security, warns you that your phone’s memory is running low. Only 8% left. To solve the issue it recommends you to install some kind of antivirus app.

boostyourwifi memory low

The third fake warning asks you if your phone is running slow and reports once again you are running out of memory. Recommendation is the same – download antivirus app.

boostyourwifi android slow

And the last warning says that your Android is running low on memory. Only 8% left, install recommend app to clean your phone.

android running low

All these pop-ups and fake scanners promote an app called Clean Master. It’s available on Google Play and it’s free. Developer is KS Mobile. The app has lots of downloads, likes and positive reviews. Maybe it’s a good app, I don’t know. But the way it is being promoted makes me skeptical about this app. Of course, those who promote apps in such a shady way can redirect users to random apps. Today it’s a Clean Master, tomorrow could be something else. Be careful and choose wisely what to install on your Android phone or tablet. Sometimes pop-ups and fake scanners appear only on certain websites. If so, then there’s nothing to worry about. But if this has been happening again and again then it’s an adware issue. In such case, you need to uninstall suspicious apps from your device and run an antivirus app.

How to remove lovelinks.us pop-up ads on your phone and tablet

If you start seeing pop-up advertisements from lovelinks.us on your mobile phone or tablet then it could be that it’s infected with adware. There are quite a few pop-up ads, one of them says “WARNING! Your battery is too heat!” and another one says that your mobile device is infected.

(1) Virus Found

Download, Install, & Run a Complete Threat Scan Now.

lovelink.us pop-up

One more saying that you supposedly need to update your app store.

Warning!!! Your APP store need update immediately.

lovellinksus-fake-update

All these pop-ups are fake. A simple web page can not scan your phone or tablet for viruses and it certainly can not check battery temperature. If you got any of these, simply close the pop-up or press the back button. Sometimes the pop-ups appear only on certain websites. If so, then there’s nothing to worry about. But if this has been happening again and again then it’s an adware issue.

Lovelinks.us pop-ups offer different apps for different users. It can be apps from Google Play or from third party websites. Most of the time, it offers Android cleaners, Ram Booster and battery saving apps but it could be a ransom app from other stores too. From what I’ve seen so far none of these apps can actually make your phone or table run better or save battery life. Besides, very often such apps are free for a reason – then display ads. As far as I know only Android users are getting lovelinks.us pop ups. Please correct me if I’m wrong. It’s very unlikely that iPhones could be targeted as well.

To remove the pop-up ads you need to uninstall an app or apps you’ve installed around the time that they started. Let’s say a wallpaper app or maybe a game. Go to device’s Settings menu > Apps or Application manager (this may differ depending on your device). Touch the app you’d like to uninstall. It might be a good idea to scan your device with antivirus app. Choose one from Google Play or download from the official site. Most of them are free.

Antivirus apps available on Google Play: https://play.google.com/store/search?q=antivirus&c=apps