Malware on my tablet. :( - Page 1
Forum section: electronics / general

author: electrolux
author_rank: Regular Contributor
timestamp: July 28, 2015, 07:32:21 pm
content: So, on my tablet a purely nasty piece of software is installed called DU Speed Booster, I didn't install it just appeared on there one day. I've tried resetting twice after which it seems worse. It installs plenty of rogue apps which are called many weird and wonderful names to make them sound trustable to a true noob. It has placed an unwanted search bar in my pull down alert list, opens random tabs when I'm browsing and tries to download files through the browser.Understandably I want to get RID of it. The question is, how? As I mentioned I have tried resetting, and disabling it from the app setting to no avail, so I come to EEV. How do I get rid of it?

author: Mechanical Menace
author_rank: Super Contributor
timestamp: July 28, 2015, 10:06:56 pm
content: Windows tablet?

author: microbug
author_rank: Frequent Contributor
timestamp: July 28, 2015, 11:13:38 pm
content: Buy an iPad?

author: PedroDaGr8
author_rank: Super Contributor
timestamp: July 28, 2015, 11:18:48 pm
content: Go to a site like GeeksToGo.com or BleepingComputer.com they have trained helpers that will help you get rid of even the most nasty stuff for free (you can donate to the helper if you wish but is no way required). These guys go through hardcore training and are good at removing even the MOST difficult stuff.Cheers!EDIT: Just saw this was a tablet, what OS is it running?

author: MikeW
author_rank: Regular Contributor
timestamp: July 28, 2015, 11:23:30 pm
content: Nuke it from orbit.It's the only way to be sure.

author: Mechanical Menace
author_rank: Super Contributor
timestamp: July 29, 2015, 01:02:34 am
content: Quote from: wilfred on July 29, 2015, 12:32:18 amThere is a Windows malware calling itself DU Speed Booster, it has no relation to the Android one which is actually a generally respected app. Some OEMs have even licensed the code for their phones built in optimisers.

author: Throwaway
author_rank: Newbie
timestamp: July 29, 2015, 01:58:24 am
content: Try to enter into the bootloader/recovery, Google around since the procedure is different for every phone/tablet out there. Usually it's something like completely powering down the device (after disabling any power-save/fast boot features in settings), then powering up the device while holding the volume down button.Once in the bootloader you should be able to select something like reset/restore factory defaults (there's no touchscreen so the volume buttons are used to select entries, and the power button to confirm). You'll loose all your files, but it's the only way to be sure**even then, in theory the malware could write itself to the recovery partition, meaning that the only way to get rid of it would be to flash a clean ROM from a computer

author: Halcyon
author_rank: Unknown
timestamp: July 29, 2015, 05:28:42 am
content: Quote from: microbug on July 28, 2015, 11:13:38 pmNo he said he wanted to getridof malware, not install IOS on it ;-)Quote from: Throwaway on July 29, 2015, 01:58:24 amAs far as I know this isn't possible on Android. To write to the "ROM" or Recovery Partition, you need to invoke a special mode upon boot. Even the host operating system can't write to it when it's booted and operating in normal conditions. Regardless of whatever elevated privileges this malware might have, it still can't touch the recovery partition or boot loader. Android automatically restores the boot loader from the ROM upon a reboot.Firstly, you've done well to get malware on your tablet. But yes, a factory reset is needed and the OS needs to be re-installed from ROM. What make/model tablet is it?Secondly, let me just reinforce the point that antivirus should be running on every 'smart' device you own, PC, phone, tablet... regardless if you run Windows, Apple or Linux OS. You're asking for trouble if you don't.

author: Mechanical Menace
author_rank: Super Contributor
timestamp: July 29, 2015, 01:36:41 pm
content: Quote from: Halcyon on July 29, 2015, 05:28:42 amThat depends on the device. Most are set up to protect from bricking so only enough is protected to always get back into DFU mode. Just think about it, if you couldn't touch any of that from within the OS how could you do OTA updates?QuoteMy main way into most is to install a custom recovery from within Android and get the phone to boot into recovery mode. Temporary privilege escalation is generally enough for that*. It's generally the OS install that restores the recovery image on boot. Sometimes you don't even need to unlock the bootloader, you're just stuck with using an OEM signed kernel then.*I've got to admit though it's rarely easy if possible to make this process "silent."

author: electrolux
author_rank: Regular Contributor
timestamp: July 29, 2015, 04:37:31 pm
content: Quote from: Mechanical Menace on July 28, 2015, 10:06:56 pmAndroid.

author: electrolux
author_rank: Regular Contributor
timestamp: July 29, 2015, 04:38:13 pm
content: Quote from: microbug on July 28, 2015, 11:13:38 pmVery funny.

author: electrolux
author_rank: Regular Contributor
timestamp: July 29, 2015, 04:41:19 pm
content: Thanks for the replies, I've got rid of it now by installing NoBloat Free and forcibly uninstalling it.

author: electrolux
author_rank: Regular Contributor
timestamp: July 29, 2015, 04:48:15 pm
content: Quote from: wilfred on July 29, 2015, 12:32:18 amAs I mentioned I've got rid of it now, but for the benefit of anybody else, one of the rogue apps was called Baidu Browser, and some others which I can't remember. I factory reseted it. Not pin resetting.

author: Jeroen3
author_rank: Super Contributor
timestamp: July 29, 2015, 05:04:46 pm
content: You'd need to reïnstall the firmware to be sure it's gone. Reïnstall using the recovery bootloader, which is most likely called when holding some button when booting.Meanwhile, you'd still better buy an iPad.http://fortune.com/2015/07/28/stagefright-google-android-security/

author: Bob F.
author_rank: Regular Contributor
timestamp: July 29, 2015, 05:05:34 pm
content: Baidu Browser is not malware, and neither is DU Speed Booster (they are however both sh*te).What you describe sounds more like a normal "free" app popping up adverts (as that is how the developers make money on them) for other apps like Baidu Browser which you then clicked on and they were therefore installed at your request. Baidu Browser then pops up more adverts while you use it as that is the way they monitize it.All you probably had to do was go to Settings -> Apps, select the apps you didn't like from the list and uninstall them from there. "Resetting" your tablet will not uninstall anything - until you hit the Nuke button and did a full factory reset of course - at which point you lost all your personal settings too.Oh, and malware does not bother popping up adverts - that went out in the 90's - they steal your private data, IMEI number, passwords and everything else they can QUIETLY in the background.

author: electrolux
author_rank: Regular Contributor
timestamp: July 29, 2015, 06:39:19 pm
content: Quote from: Jeroen3 on July 29, 2015, 05:04:46 pmI don't think I'll bother doing the firmware bit (partly cos I don't know how to). As for the Ipad give me the dosh and I'll get it. :p

author: electrolux
author_rank: Regular Contributor
timestamp: July 29, 2015, 06:41:29 pm
content: Quote from: Bob F. on July 29, 2015, 05:05:34 pmI did do a factory reset which does uninstall all the apps and files, as for the second bit, perhaps I should rephrase it to 'adware'.

author: Halcyon
author_rank: Unknown
timestamp: July 29, 2015, 07:17:29 pm
content: Quote from: Mechanical Menace on July 29, 2015, 01:36:41 pmEven when doing an OTA update, the system reboots into a mode where it can be installed. It generally isn't done while the OS is running.

author: Mechanical Menace
author_rank: Super Contributor
timestamp: July 29, 2015, 08:23:53 pm
content: Quote from: Halcyon on July 29, 2015, 07:17:29 pmWhich boots the recovery partition, which can be overwritten from within the running OS, and isn't checked again until the OS boots if that isn't patched or replaced.

author: bingo600
author_rank: Super Contributor
timestamp: July 30, 2015, 09:14:42 pm
content: Quote from: Jeroen3 on July 29, 2015, 05:04:46 pmI have a couple of Android Tablets wo. GSM installed.I'd expect they're "good" as receiving a MMS isn't possible. Or ??Ohh and i just did install a Custom Rom on one of them (Ionik) , as the delivered Android was lousy (as in factory defaulting when booted).After the new Rom , now it's actually a quite nice Retina Quad core for 80€But i do run AWG on my Androids./Bingo

author: Jeroen3
author_rank: Super Contributor
timestamp: July 31, 2015, 06:50:20 am
content: Remember those annoying pre-roll ads you cannot skip?