How can I remove the "adnetworkperformance.com" malware?

[ronshulkin]

How can I remove the adnetworkperformance.com malware? I have already reset my phone and used the 360 Security app scans.

What happens: When using Facebook and clicking on a link, it goes to the link in question, then briefly shows the adnetworkperformance.com URL and then goes to a web page. This web page can be a notice like "Congratulations Your Droid Turbo device was chosen to be a tester..."  Or "Warning! This Motorola Droid turbo might be infected iwth (6) serious viruses that severely damage your battery..." That last one actually encourages me to install the 360 Security app.

I have reset my phone. I have actually downloaded and run the 360 Security app (just a coincidence (it is the most recommended anti-virus app).

Any suggestions on how to remove this problem?

Thanks.

Ron

[vzw_customer_support]

ronshulkin,

This is quite concerning & can understand why you have reached out to us. This is linked to an app that you do have on your phone. When you say you reset the phone. Do you mean you turn the phone completely off & back on? Or what sort of reset are you talking about that you did?

AliciaS_VZW
Follow us on Twitter @VZWSupport
If my response answered your question please click the �Correct Answer� button under my response. This ensures others can benefit from our conversation. Thanks in advance for your help with this!!

[ronshulkin]

I reset the phone using the phone's "Backup & reset" function. It backs up my data and performs an automatic restore when I click on "Factory data reset".   I thought that would have fixed the problem.  When it didn't I downloaded the 360 Security app and ran all its functions. The problem persists.

I think you're right that it is attached to an app. I haven't clicked on anything the malware has offered in the web pages it redirects to, so I'd like to think I haven't spread it further on the phone.

And I do have a long list of apps, although nothing exotic (social apps, office apps, etc.)

[vzw_customer_support]

ronshulkin,

Ok, I see what you’re saying. Let me continue to offer a lending hand. You will need to backup your phone using the free app called Verizon Cloud. Once that is done, you will need to do a full factory data reset by pressing on factory data reset. This will wipe your phone completely. Once the phone does come back on to re-activate, please do not download all the same apps. We suggest that you download just 2 at a time for half a day or a full day & test the phone out to narrow down what app is causing this.

AliciaS_VZW
Follow us on Twitter @VZWSupport
If my response answered your question please click the �Correct Answer� button under my response. This ensures others can benefit from our conversation. Thanks in advance for your help with this!!

[ronshulkin]

OK, good suggestion. This will obviously take some time, so I'll get back to you.

One question...when I identify the likley culprit app, is uninstalling it an adequate fix?  Or do I need to do another Factory Reset and just not use that app in the future?

BTW, For no reason in particular I have a hunch that the likely source is either Chrome or Firefox.

Thanks for your help.

[ronshulkin]

Really need your help.

I've reset twice since our last interlude.

The first time I downloaded Facebook first and Facebook acted normal, I was able to click on links without any redirects. Let's call that "the test".  I then downloaded Yahoo Mail, still no problem with redirects on Facebook.  Then I downloaded an app from my bank: First Midwest. The Facebook test began to redirect. So I uninstalled the First Midwest app and I uninstalled Facebook, turned the phone off and back on again.  I installed Facebook again, but the redirect problem persists during tests.

So I did another Factory Reset.  When the phone came back up, before I installed any apps, I opened Google, did a search, clicked on a link and it was redirected. I tried this several times by clicking on different links, and each one was redirected. I've attached a bunch of screen shots of what those web site redirects look like. When starting up the phone post reset, I started it as a "new phone" so no apps would be recovered and installed. I took a look at the list of installed apps and a bunch of apps are on the phone anyway.  Most of these are Google, Motorola and Verizon products. Here's what is installed automatically:

Under the category: "Updates"

Google Play Newstand

Google Street View

Motorola Camera

My Verizon Mobile

NFL Mobile

Verizon Cloud

Verizon Messages

These are also installed under the heading: "Recently updated"

Amazon Kindle

Amazon Music with Prime

Android System Webview

Audiobooks from Audible

Chrome Browser

Clock

Cloud Print

FamilyBase Companion

Gmail

Google

Google Drive

Google Keyboard

Google Play Books

Google Play Games

Google Play Movies and TV

Google Play Music

Google Talkback

Google text to speech

Google Translate

Google+

Hangouts

HP Print Service Plugin

IMDB

Maps

Moto

Moto Voice

Motorola Connect

Motorola Gallery

Motorola Migrate

Quickoffice

Verizon Support & Protection

VZ navigator

YouTube

Under the category: "Up to date"

Droid Zap

Motorola Help.

I haven't bothered to download Facebook to test seeing as the malware is present testing with Google links.

But this last effort basically makes our testing procedure invalid in a way, because if the malware is connected to an app, according to your thesis, then it is one of the apps automatically downloaded with a fresh reset recovery.

So I'm standing by for the next suggestion on how to troubleshoot this problem.

[vzw_customer_support]

ronshulkin,

This is definitely concerning & I appreciate the troubleshooting that we have done so far. I just want to make sure we’re on the same page with everything. When you did a factory data reset, can you please provide me the path that you took to do this? Also, you say you are using Firefox on the phone. Is this something that you downloaded? What happens when you only use Chrome that is on the phone? Are you able to uninstall Firefox?

AliciaS_VZW
Follow us on Twitter @VZWSupport
If my response answered your question please click the �Correct Answer� button under my response. This ensures others can benefit from our conversation. Thanks in advance for your help with this!!

[ronshulkin]

Alicia,

When you did a factory data reset, can you please provide me the path that

you took to do this?

I took the path led by the phone's settings. I've attached screen shots of

the four steps I took, but they're pretty straight forward. The only

modification I make to the standard settings, based on your advice, is to

turn off the "automatic restore". I'm not sure why all those apps were

present post restore, but I'm guessing they're all automatic from Verizon.

Also, you say you are using Firefox on the phone. Is this something that

you downloaded? Are you able to uninstall Firefox?

Yes I downloaded Firefox. I got a hunch it might be the source of all my

problems, so I really regret it. And I was unable to uninstall it. After

the intiial problem came up that was the first to go and hasn't been

installed since.

What happens when you only use Chrome that is on the phone?

This last reset Chrome is the only browser on the phone and I already

described how it was problematic with redirects right from the get-go

without any other apps being installed (except those that came

automatically as described).

I can see how another factory reset is in my future. Perhaps you can help

me with instructions on how to do it without any downloads of apps at all?

Another question is, if Firefox is the culprit, and is uninstalled, can it

still cause the problem? I ask because when I go into Google Play, it is

on a list of apps, not installed, but under "all", apparently a list of

apps I've installed in the past.

I'm standing by...thanks.

Ron

On Tue, Feb 23, 2016 at 3:09 PM, Verizon Wireless Customer Support <

[smith6612 · Accepted solution]

Is this problem only occurring on your home Wi-Fi? Try your mobile data. I've seen cases where home routers with old, compromised firmware can cause advertisements like this to be delivered. Sometimes malware from a PC or a phone can log into the router and change DNS Servers. A very common problem I saw in the early 2000s when .mp3.exe files plagued the now-defunct Limewire network. Firmware updates and locking down the web admin interface (after a factory reset, of course) are the two key ways to fix that sort of a problem. Turn off all web scanning functions on the router as well - these often become hopelessly abandoned and can become security risks themselves.

During your next phone reset, don't install any security software. Also, don't automatically restore any of your apps. At most, install MalwareBytes Anti-Malware from the Play Store, if you do question what the phone has on it. That is the most trustworthy application I can suggest at this time for Android.

When you begin to restore your apps (do it manually, don't restore from backup!), check for any app that asks for permission to draw over other apps, or runs at startup. These are two permissions most commonly abused for pushing ads to phones.

Finally, install Firefox and install the uBlock Origin extension to your device. If this problem is originating from an advertisement, whichever advertising network is serving up the problem ad/code deserves to be blocked.

[ronshulkin]

Sorry I took so long to respond. But you definitely solved this case for me.  I really appreciate it as it was a very frustrating episode.

Yes, my wifi router was the problem. It was older technology. There is a wifi router as part the Xfinity modem so I've switched to that.  I tried to reset the existing wifi, but it didn't help.  Logging off of wifi for a test, using only the 4G signal, the problem ceased. As I couldn't rid the old router of the virus with the resets, I've unplugged the sucker and put it back in its box.

I took a few days to do the switch, get everybody's devices onto the new wifi router (changing the name and password on that device just because suddenly I'm hyper security aware :-).  I reset my tablet as it was experiencing the same problem during this episode.

So, good job.  Thanks for your help.  And kudos to you for thinking outside of the box (or the phone in this case) to solve the issue.

Thanks,

Ron

[vzw_customer_support]

ronshulkin - You're welcome. We are all glad to hear everything is back to normal. Please let us know if there is anything else we can assist you with.
JacobV_VZW
Follow us on Twitter @VZWSupport
If my response answered your question please click the �Correct Answer� button under my response. This ensures others can benefit from our conversation. Thanks in advance for your help with this!!

[smith6612]

Glad to hear. As a cost savings advice, make sure you're not paying Comcast to rent those modems . $10/m+ for a Cable modem is pretty steep.