Samsung Galaxy S4 Forum

Support Android Chrome Redirection Virus/Malware/Adware

Hi,

I had an issue crop up where whenever I would try to access a link or do a search in Google Chrome on my Samsung Galaxy S4 on Android, I would get redirected to a Malware/Adware type site.

Always starting with slimspot dot com, then redirecting to a pop up saying I've won an award or I have a dangerous virus that needs removing etc.

Anyway, there would be no way to go back and access the original site I was looking at or be able to use Chrome to search for anything because I'd constantly get redirected to this Malware and the only option was to close down Chrome and try again only to get same thing happen again etc etc basically rendering Chrome unusable.

I tried clearing cache/data in Chrome, restoring Chrome to factory default version etc. No luck...

Searched google relentlessly for a fix to no avail.

Tried every legitimate anti virus, anti malware/anti spyware program around, none could detect a problem.

Tried Firefox and that worked fine so I knew it was a problem with the Chrome browser specifically.

So then I figured it out and thought I would post solution on here for other poor suckers who go through the same thing and can't find a fix.

I almost couldn't be bothered but I want to try to be helpful :)

Anyway, connected phone to computer, went to Android folder, then data, searched for Chrome. One folder came up, I shift deleted it.

Voila. Simple as that, problem solved.

Hope this helps someone.

 

Related:

#1 Droidsta, Nov 1, 2014
That's pretty bizarre. Thanks for sharing.
 
#2 electricpete, Nov 2, 2014
No worries. Yeah, bug was obviously put into Chrome directory and not picked up by antivirus/Malware/Adware scans. Can't get rid of it by clearing data and no way to actually remove Chrome because it's a default app on Android can only restore to factory version. So have to manually delete directory.
 
#3 Droidsta, Nov 3, 2014
mate, you're a legend. thankyou, this has been bugging the hell out of me.
 
#4 apfelkooken, Nov 3, 2014
No worries! Yeah, really didn't want to switch to Firefox, chrome is defintely the best browser on Android IMO.
 
#5 Droidsta, Nov 3, 2014
What antivirus are you using that did not detect the virus?
 
#6 spman, Nov 5, 2014
Just had Zoner when I got it then also downloaded Avast and a bunch of others (all the top rated ones) and none picked it up in a scan.
 
#7 Droidsta, Nov 5, 2014
Thank you so much, this has been driving me nuts! Registered here just to say thanks.
 
#8 grumpyoldpom, Nov 5, 2014
No worries! Haha, figured it was only happening to me because I didn't find anything about it online!
 
#9 Droidsta, Nov 5, 2014
Hi mate?

Did as directed and deleted the file through my pc.
Still getting the slimspot pop up. Im one step away from restoring phone to factory but would like to avoid if possible.
Any ideas?
 
#10 crookedkiwi, Nov 9, 2014
Hi there, sorry that's the only solution I could come up with. Did you delete a file or the entire Chrome folder? I actually had a slimspot pop up today too! But it opened in another window like a pop up rather than hijacking my entire browser, but still gave me the creeps because I hadn't seen it at all since I deleted the chrome folder. Must have picked it up again from somewhere. It was after I accessed a link from Gmail actually so maybe the issue is with Gmail. Maybe try deleting the Gmail folder as well? Doubt you'll lose your emails because they will probably be on the server. Also, I restored the app to factory version and cleared all the data before permanently deleting the folder. Maybe do that for both Chrome and Gmail. Let me know if it works!
 
#11 Droidsta, Nov 9, 2014
Ok, it came back yesterday. Noticed it only does it if i click a link through from facebook. For example i like a site called watchtime, website about watches. If i click on the news feed in facebook, when i go to the site in chrome it happens. But, if i try to read the same article by just going to the website, it doesn't happen??
 
#12 grumpyoldpom, Nov 11, 2014
Yes, I noticed it through Facebook as well but nothing since then thankfully. The last few times it didn't hijack my browser anyway, just opened a pop up in a new window. I can deal with that! As long as I can use Chrome. If it keeps happening, I might delete Facebook, Chrome and Gmail and then just avoid clicking links, which is ridiculous but I want to avoid getting this again until Google get their act together.
 
#13 Droidsta, Nov 11, 2014
Go to settings in chrome. Content settings. Disable java..... pain in the ass having it disabled for legit sites. It's only a temporary fix.
 
#14 Mallywest, Nov 22, 2014
Agh, I'm having the same problem, but searching for Chrome doesn't find anything in Android/data/ ... so annoying!! And odd that no-one has commented on this since November ...

I also get the popup out of the blue when I'm playing words with friends standalone app, not even using the broswer.
 
#15 whitehawk, Dec 31, 2014
I know. I've been getting this all the time again. It's so frustrating. Only thing that gets rid of it is disabling Java in content settings but unfortunately so many things require Java.

 
#16 Droidsta, Dec 31, 2014
I too started getting the slimspot popup this week. (Coincidentally(?) with the new extended forum addresses.) It seems to get triggered when I come here to any one of my bookmarked forums from my mobile. It usually opens two or three new tabs and redirects to a game on Google Play.

Found this lengthy thread on Google Help forum, no solution yet it seems:
https://productforums.google.com/forum/#!topic/chrome/Q74jiLWfLdM[176-200-false]
 
#17 AnciusD, Jan 9, 2015 Last edited: Jan 9, 2015
Help! I have same problem. Chrome and opera does that popup shit. I have try many apps but nothing works. Only when i put javascript off it helps but many sites need that. I connected phone to computer but i didnt found any chrome files.
 
#18 toni kari, Jan 20, 2015
Sounds like it could be something to do with this....A Google ads problem.
http://androidforums.com/threads/android-forums-is-loaded-with-malware-ads.895112/
 
#19 mikedt, Jan 21, 2015
I dont know what exactly i did but now my and my girlfriend phones are fine. I just connected phone on the computer and i deleted hidden files. Now working even with javascript.
 
#20 toni kari, Jan 21, 2015
I had the same problem and try everything: clean cache, data, factory reset, delete folders etc. and nothing helped. Today malwarebytes on my PC pop up with warning of trojan called DNSChanger and then I checked my router setting and my primary DNS address was changed to 91.212.124.159. I changed it back to address from my provider and problem is gone. So everybody who have this problem try this solution.
 
#21 remini777, Jan 23, 2015
I found a huge adobe "looking" java in my Drive folder. Says my file was made by my wife. Don't know if this is possible or if it's wrong for me to have it? What do I do?
 
#22 H20nmud, Jan 26, 2015
Try this simple steps :

1. Open Chrome Browser app
2. Go to menu
3. Open Setting
4. Open Site Setting
5. Switch pop-ups setting to BLOCKED

After that you can try to open website again.

Please let me know if it's work for you.
 
#23 Rulianto Tegoeh, Jan 27, 2015
I am having the same issue but with Opera browser and thats the only one I use. Cleared outs cache but didnt help. Anyone please write a working Fix as its coming back again and again
 
#24 jjdoctor, Jan 30, 2015
Looks like this is an ongoing Google ads problem, but it apparently only hitting people in the US, AFAICT. The working fix for the moment seems to be is block Google ads, AdSense, AdMob, DoubleClick. Getting things like fake virus warnings, dating, pr0n, redirects to the Play Store, gambling, offshore pharmacies, penis & muscle growth pills, etc.
 
#25 mikedt, Jan 30, 2015 Last edited: Jan 30, 2015
This is not a problem with google ads nor has anything to do with your phone or any other device that you use. The issue is that the router has been attacked and the DNS has been changed.

Log on to your router and change the router settings to set the DNS settings to 'Obtain from ISP' or an equivalent option based on your router model. Alternately get the correct DNS value for your internet provider and enter those values for the DNS.

Regards,
Radnus
 
#51 radnus1987, Jun 5, 2015