[Gee-Bee]

Hi, I have a ransomware on my Nexus 7, running Android 4.4.4 which says, "The page at porncheckorg.com says: ATTENTION! Your mobile device has been blocked up for safety reasons. AUDIO AND VIDEO RECORDING IN PROGRESS. Amount of fine is £100. You can pay a fine Ukash or PaySafeCard vouchers. TYPE YOUR CODE (£100 Ukash or PaySafeCard). AND PRESS OK.

I was trying to log-in to my account at the Nationwide when it appeared.

 

It locks that tab on Chrome and means you can't close the tab or go into other tabs.

 

I can however go into and use Firefox and can use other Apps etc.

 

Please can anyone help me remove it.

 

Many thanks,

 

Gee-Bee

[Advertisements]

Hi Peter, thanks for that. I know how to do a Factory Reset, but not your second suggestion ("flash the stock ROM back onto your device") - how would I do that if it's needed? And I think MIGHT have fixed it anyway. I deleted the Chrome cache, closed Chrome and when I opened it up again I closed the offending tab the instant it started loading. It seems to have gone and neither Avast nor Malwarebytes finds the Malware - think it's gone? Or should I di anything else to check? Thanks, Gee-Bee

[Gee-Bee]

Hi Peter, thanks for that. I know how to do a Factory Reset, but not your second suggestion ("flash the stock ROM back onto your device") - how would I do that if it's needed? And I think MIGHT have fixed it anyway. I deleted the Chrome cache, closed Chrome and when I opened it up again I closed the offending tab the instant it started loading. It seems to have gone and neither Avast nor Malwarebytes finds the Malware - think it's gone? Or should I di anything else to check? Thanks, Gee-Bee

[Gee-Bee]

Hi Peter,

 

Many thanks for that.

 

I think my 'technique' described above seems to have sorted it, without having to flash the stock ROM back.

 

As I said, neither Avast, nor Malwarebytes find anything, but I can't help being nervous.

 

Any thoughts on what else I need to do to ensure nothing nasty is happening in the background without me knowing it? Without having to restore it to the factory settings?

 

Many thanks,

 

G

[Gee-Bee]

 

Hi Peter,

 

Many thanks for that.

 

I think my 'technique' described above seems to have sorted it, without having to flash the stock ROM back.

 

As I said, neither Avast, nor Malwarebytes find anything, but I can't help being nervous.

 

Any thoughts on what else I need to do to ensure nothing nasty is happening in the background without me knowing it? Without having to restore it to the factory settings?

 

Many thanks,

 

G

 

Well, that's great if things have fixed up I would say in future make sure that you don't install the apps from other third part sites other than Google PlayStore ! To make sure that you didn't do that by mistake I would say better option will be blocking the installation of apps from third party store by heading over to the settings>under security>Untick the Unknown Sources ! But still if you like getting app from another store I would say better be alerted and only download the apps from the store which has good standing and trust flow ! I guess it's enough to help you in keeping your device safe ! 

 

Hi Peter, yeah, i'll keep playing with it to check it's fixed, but fingers crossed!

 

And thanks again for your help - much appreciated, as well as for the advice re the Apps from other than Google Play Store - not sure if that's wher it came from, but it's a possibility.

 

Is there any anti-virus and / or anti-malware you'd particularly recommend for Android? I have Avast and have juszt instaalled malwarebytes after having this problem. Obviously Avast didn't stop it and I've been pretty please with Norton on my PC, but sometimes I guess particular software works better on different OS'?

 

Cheers,

 

G

 

Hi Peter,

 

Many thanks for that.

 

I think my 'technique' described above seems to have sorted it, without having to flash the stock ROM back.

 

As I said, neither Avast, nor Malwarebytes find anything, but I can't help being nervous.

 

Any thoughts on what else I need to do to ensure nothing nasty is happening in the background without me knowing it? Without having to restore it to the factory settings?

 

Many thanks,

 

G

 

Well, that's great if things have fixed up I would say in future make sure that you don't install the apps from other third part sites other than Google PlayStore ! To make sure that you didn't do that by mistake I would say better option will be blocking the installation of apps from third party store by heading over to the settings>under security>Untick the Unknown Sources ! But still if you like getting app from another store I would say better be alerted and only download the apps from the store which has good standing and trust flow ! I guess it's enough to help you in keeping your device safe ! 

 

[terry1966]

what you were seeing is a javascript popup on the web page you were visiting,

the clue is "The page at porncheckorg.com says" which means the warning came from the internet and that web page, it could say anything that will try and make you install an unwanted program/malware onto your device.

 

always be careful and ignore/backout of any such warnings and never click ok or do anything that will install something onto your device because of whatever the warning wants you to do.

 

your device doesn't have any malware on it causing those popups,

they are always a javascript on the webpage you've visited that causes the popup warning so are nothing to worry about just as long as you ignore backout of that web page and not follow the instructions on them to install anything.

 

one way to stop seeing any more popups like that is to disable javascript in your browser, of course this can cause more problems because genuine things that need javascript enabled to work won't now work.

 

more info here :-

https://blog.malware...n-of-infection/

http://www.onlinethr...w-spam-message/

 

Edited by terry1966, 21 January 2015 - 04:05 PM.

[terry1966]

 

Well, I would say the problem with the @OP has already been sorted out and I don't think he requires thing....... rather than now what OP has been looking for is way to safeguard his device in future from these type of attacks and I would say it would be much more helpful if you can guide us with the same !

 

 

peter it's a pity you don't know what your talking about.

 

try learning something instead of thinking only your posts are of help and telling other posters their replies are useless, this is not your first reply in a topic i've read where you think only your posts hold any meaningful content that the op might find useful info, and any other posts after yours offer nothing relevant to the topic and are a waste of time.

 

my post tells you exactly what i think the problem is, the cause of it and also reassures you it's nothing to worry about unless you install the malware onto your device the warnings are trying to get you too.

 

the problem was sorted out because it wasn't a problem in the first place, (his device wasn't blocked needing him to start in safe mode and follow this to remove the bad app :- http://www.wintips.o...id-koler-virus/ ) so there was no malware on his tablet/phone, he didn't need to do a factory reset, or re-install the os like you suggested, no virus causing the popup like you also said he must have gotten from an app installed from somewhere other than the google playstore, etc. etc.

 

my post tells you why he didn't need to do any of those things, where the popup actually came from and what the cause is, it also told you how to stop seeing those popups ever again, by simple turning off javascrypt in your web browser. 

 

so if that doesn't cover your "rather than now what OP has been looking for is way to safeguard his device in future from these type of attacks and I would say it would be much more helpful if you can guide us with the same !" statement, then i really don't know what does.

please don't take offence with this post, it was written rather tongue in cheek.

carry on helping out as best your able to on the forum but try and stop commenting on the usefulness or otherwise of other people's posts.

if they are wrong or you think the advice is bad then certainly comment and point it out.

just saying their posts offer no help to the op and are just a waste of time tho is nothing but rude and helps no-one while making you sound like a spoilt kid.

 

thanks for making me laugh tho and have a nice day,

 

 

more info here :- https://blog.malware...mac-os-x-users/

 

Q. Does this ransomware actually infect my Mac? Is it an exploit?
A. No, it does not. It is purely a simple piece of JavaScript that ‘locks up’ the browser.

same thing on android.

Edited by terry1966, 23 January 2015 - 04:23 AM.

[Gee-Bee]

what you were seeing is a javascript popup on the web page you were visiting,

the clue is "The page at porncheckorg.com says" which means the warning came from the internet and that web page, it could say anything that will try and make you install an unwanted program/malware onto your device.

 

always be careful and ignore/backout of any such warnings and never click ok or do anything that will install something onto your device because of whatever the warning wants you to do.

 

your device doesn't have any malware on it causing those popups,

they are always a javascript on the webpage you've visited that causes the popup warning so are nothing to worry about just as long as you ignore backout of that web page and not follow the instructions on them to install anything.

 

one way to stop seeing any more popups like that is to disable javascript in your browser, of course this can cause more problems because genuine things that need javascript enabled to work won't now work.

 

more info here :-

https://blog.malware...n-of-infection/

http://www.onlinethr...w-spam-message/

 

Hi Terry,

 

Many thanks for that info as well.

 

Can I check something please? When the page opened with the pop-up, I obviously didn't want to click on anything in case it downloaded a virus, trojan, etc.

 

It just had the wording: 'You can pay a fine Ukash or PaySafeCard vouchers. TYPE YOUR CODE (£100 Ukash or PaySafeCard). AND PRESS OK.'

 

Obviously I wasn't going to pay any Ukash or PaySafeCard, (not that I know what they are anyway ), but my issue was that, not wanting to click on anything, the page wouldn't let me click on the 'X' on the tab to close the page.

 

So I was stuck in a loop. It was only by shutting Chrome completely and then trying to re-open it, but as soon as Chrome was 'booting-up' / (? probably not the right  ) / loading, I tried to click immediately on the 'close tab' X.

 

At the 3rd of 4th attempt, I managed to close the page, which seems to have stopped the issue.

 

What should I have done when the pop-up appeared? Was my 'technique' the best way of doing it? (I suspect that if I'd clicked on 'OK' to the message about Ukash / PaySafeCard it would have just stuck in a loop about 'typing my code / PaySafeCard)

 

Was what I did the 'right' / best way of getting rid of it?

 

Many thanks again.

 

G

[terry1966]

to be honest i have no idea on what the best way is to get out of it, because i've never experienced it myself, i do know the javascript causes a loop that needs about 150 back button clicks to leave the page before it goes away.

 

these links are about apples os and not googles android os but they hold true for android anyway, because it effects both os in the same way, unlike windows where it can install malware with no user interaction, both apple and googles os need the user to be tricked (social engineered) into installing malware onto their devices first before it can get infected usually.

 

https://blog.malware...mac-os-x-users/

https://blog.malware...mac-os-x-users/

 

in that link with the safari web browser he says to just click reset browser to get out of it.

 

to be honest i don't think there is a wrong way to get out of it just as long as you do without falling for the scam and installing anything onto your device or paying the ransom.

 

as the q+a says no amount of anti virus software would stop the javascrypt so you didn't get that popup if you visit an infected site, unless the ip of said site was already blocked.

 

personally i don't use or think you need any anti virus software running on android devices, what you do need is someone like you who thinks before just clicking on or falling for such social engineering traps that may popup on ones device.

 

android needs the user to actually agree/want to install things, which is the users choice and is a multi click operation, so it is always the user who is the best defence against getting infected in my opinion.

 

bit old now but still holds true today in my opinion (i'm not a malware expert.). :- http://qz.com/131436...ble-to-malware/

 

Edited by terry1966, 24 January 2015 - 10:51 AM.

[terry1966]

 

[terry1966]

 

yep i do need to lose a few pounds.