Preinstalled Adware?

Shentao

After 2 Months of usage suddenly the Umi Phone starts showing Chinese Ad Popups. Malwarebytes detected finesearch.apk but i cannot delete it because it came preinstalled. This really sucks! How do I remove this?

Shentao

Thank you for the info and your help!

Chundoundo

\n\n
Just the same adwares in firmware even afrer SPFT updated from 160719 to 160826.
I found this apps not safe (as it connected to chinese IPs):

s=system, a=app, p-a=priv-app
/s/p-a/Launcher3.apk - built-in launcher - Trojan.Android.Agent.dqfsll
/s/a/FineSearch.apk - chinese fake search Cooee - Android-PUP/Cooee.197d1 \ not-a-virus:HEUR:AdWare.AndroidOS.Coee.a
/s/a/FineVideoPlayer.apk - built-in chinese videoplayer - Android/Inmobi.D
/s/a/webcore.apk - fake Opera Store
/s/a/AdupsFota.apk - OTA
/s/a/LovelyFonts.apk - chinese fonts
/s/p-a/LovelyFontsService.apk - the same
/s/p-a/SystemUI.apk - modified System interface that try to connect to chinese IP and load ads and make strange folder bcjwq Andr/Dropr-FY
- you can't  delete SysUI, but can block with firewall

cn adware

cn adware

SystemUI try connect to cn IP

SystemUI try connect to cn IP

Check this IPs from SystemUI:
http://geoiplookup.net/ip/103.235.47.74
http://geoiplookup.net/ip/106.39.162.36
http://geoiplookup.net/ip/114.55.145.117
http://geoiplookup.net/ip/120.55.179.179
http://geoiplookup.net/ip/121.69.49.133
http://geoiplookup.net/ip/122.224.95.58
http://geoiplookup.net/ip/180.76.153.60
http://geoiplookup.net/ip/180.97.33.30

bencebacsi

Hi,
You'd need root access to remove that app but even without root you can just disable it.
Go to Settings --> Apps, tap on the 3-dot menu button at the top right corner of the screen and select 'Show system'.
Scroll down until you find an app called just Search and select it. The version number should be 1.0.38359.20160708 but it might be a newer one. Tap on FORCE STOP, then DISABLE and you're done.

Shentao

Hm, I have deactivated that app, but still receive pop-up ads from time to time (sometimes banner at the bottom of the screen, sometimes almost full-screen banner). Is there an easy way to root the phone to remove this ad? Or could you please provide an update with removed adware?

bencebacsi

There's a thread here about rooting but most probably those adds are run by an app that you installed later, not by a system app. If you disable an app, that won't run or do anything anymore.
Link: http://community.umidigi.com/thread-2962-1-1.html

ernest

\n\nHi
i'm having the exact same issue. After two months some chinese ads starts showing up.
I'm positive there are no apps installed by me that could cause this. I have only the google basic stuff.
I've rooted and delete the 'Search' app but the ads keep coming.

Any idea?
I keep seeing stuff like this

ernest

\n\n
Also, I've noticed the firmware seems not to be the latest one (should't be from august the latest one)?
I'm now unsure if burning the latest firmware will bring less or more ads...

Shentao

Yes, I had 20160719, too and even after deleting the search.apk, the ads kept popping up. I ran some malware scans and one App detected something in the Updater-App (Airpush Adware I think) so I removed that, too - but even that didn't help.

Then I wanted to update to the firmware 20160826, but I failed in doing so while using  SPFT (forgot to uncheck Preloader). Now I am desperate to get a correct Preloader in order to get the digitizer/touch to work again...

ernest

do you know if I can generate it from my phone and send it to you?

Shentao

Hi ernest,

I have described the problem in detail here a bit more.

http://community.umidigi.com/thread-4989-1-1.html

Usig SPFT, one should be able to extract the current, working Preloader with the "Readback"-function, but since I have overwritten mine, I cannot really test this >_<