Full screen ads - Android Shell app, other apps linked to ad networks

  • Replies:16
  • OpenNot stickiedUnanswered
  • Forum posts: 5

Jul 5, 2017 2:34:54 PM via Website

Hi All,

Hoping for advice, suggestions, or at least some enlightenment on annoying full screen ads I'm experiencing on my Android cellphone.

First things first, phone details:
Doogee T5S (Chinese origin, I believe), not rooted (unless it comes like that in the box), USB debugging disabled
Baseband version DOOGEE-T5. 2016/12/10, Kernel version 3.19.19
Android 6.0 - build number DOOGEE-T5-Android6.0-20161210
Country - Namibia, service provider - MTC

Secondly, my problem:
I'm experiencing more and more full screen pop-up ads at random times. Sometimes I'm in an app, sometimes I just tapped to open an app and other times it just happens from the anywhere. I don't have terribly many 3rd party apps and I've uninstalled some since the ads are appearing more frequently, so not quite sure where this is coming from.
It started with one particular ad, APD News, which wants to install an app with the same name from an unknown source. But lately it's a variety of ads promoting local TV stations, a Final Fantasy game, a mug press (!?!), etc., with a little (i) in a corner that says Ads by Google when clicked on. Also, when I hit the button to display all open apps while an ad is displaying, the app handling the ad is apparently [Android] Shell. I intended to add some screen grabs, but seems the ability is not yet available.

Remediation actions taken:
Searching the internet for similar problems did not provide much help, among the few suggestions I did find, were to factory reset the phone and remove all 3rd party apps. Not quite there yet, and it does not really identify or address the root cause.
So I installed Kaspersky Internet Security and MalwareBytes Anti-Malware (unpaid versions), but scans with those always come out clean and didn't curtail the ads.
I stumbled across an app called AppBrain Ad Detector on Google Play store. Not sure exactly what all it's supposed to do, but one of the features highlights ad networks and shows which apps are linked to those. Admob seems to be the main culprit, and has 10 apps associated with it - Google, Google Play Store, com.android.snap and Shell (these came with the phone, I didn't install any of them) and 6 other apps I got from the Play Store. I swear when I checked over the weekend Google, Google Play Store and com.android.snap were not on the list.... There's also MoPub and InMobi, but those have 2 and 1 app (respectively) associated with them. Interestingly, Shell is the only app that is associated with all 3 ad networks.

Questions:
1) I understand that 3rd party apps may come with ads, but shouldn't that be within the app and not the full screen type I'm experiencing. Any other ideas how I can ascertain what the heck is causing this annoyance?
2) I checked in Settings - Apps and I have the option to uninstall Shell. I'm seriously considering that, since it's apparently the app handling the ads and is associated with 3 ad networks. Is this a good idea, though? It seems to be a system app and came with the phone, so what will happen if I remove it?

Apologies for the long post, trying to include as much relevant detail as possible, and thanks if you read all the way to down here. Hope someone has some ideas!

Cheers,
L.

  • Forum posts: 4

Jul 6, 2017 12:54:18 PM via Website

Not any help but can confirm very similar problem with a THL T6C that have owned for 9 months or more.
Just started getting the APD news full screen ads, trying to install from unknown source etc.
No new apps for months, and coincided with an update via google for 4 apps, all well known, all uninstalled.
Now uninstalled almost all, if i get anywhere i will post back.

— modified on Jul 7, 2017 6:20:21 PM

  • Forum posts: 5

Jul 7, 2017 6:06:09 PM via Website

Update

OK, so not much luck yet with finding where exactly the problem lies and eliminating full screen ads completely. But does seem like they don't pop up quite as often anymore. Debatable at best, though, just when I believe there are fewer ads a new one pops up :?

For what it's worth, I did the following:

  • On the phone, go into Settings - Google - Ads and turn on Opt out of Ads Personalisation. In here you should also note your advertising ID, needed in one of the later steps.

  • In the Google menu again, tap Personal info and privacy, scroll down and tap Ads Settings. This will open your browser and have you log onto your Google account. After logging in, turn off Ads Personalization, scroll down to the bottom and tap the link to OPT OUT OF MORE ADS. This opens a new tab and takes you to the DAA's Webchoices page, follow the prompts to have a scan done and opt out of all the networks that are found.

  • Open your browser on your phone and go to www[dot]airpush[dot]com/optout/. There are 3 big blue buttons in the
    body of the page, click each and follow the steps described. First button has on option for manual opt-out by providing your device's IMEI/MEID/ESN, I didn't do that. 3rd button is where you'll need the advertising ID obtained in first step above.

  • Search the Play Store for an app called TRUSTe, installing it also allows for opting out of some ad networks

More than anything these seem to address ad personalisation, not really getting rid of the ads completely. But at least it feels like I'm doing something!!

  • Forum posts: 4

Jul 7, 2017 7:06:50 PM via Website

Hi,
Going back to your original question 1, I think you are right: the Ads should be within the App you are using not popping up randomly regardless of the App in use; I had the Ad appearing even when using the built in camera! At this point a large square Ad (From APD always from them) appeared over the view finder, followed by a bar along the bottom of the screen. Clicking the cross in the corner of the Ad starts the install process for Their news reader. Thankfully it cannot install as I have the 'use trusted sources' or Google play store only set.

Steps I have taken include:

un-installing firstly the updated apps that coincided with the appearance of the Ad

un-installing third-party 'free' apps that despite have no ads in them 'might' have a problem however unlikely.

Trying to ascertain the app that created the Ad (hold finger on the Ad to reveal its creater) - this hasn't worked on the full screen Ad but sometimes I get a notification from 'launcher3' the built-in launcher that came with the phone (this just popped up as I was writing!!!) - how can this happen?!?

App by app removing permissions to 'draw over' and 'peeking'
Where possible setting 'block all notifications' though I think I left 'launcher3' since it is the desktop.
I have installed things like 'airpush', Malwarebytes, Adaware and none found a problem except Malwarebytes:
It found a trojan it named as 'trojan_guerrilla_ae' which I removed: searching on the net this 'guerrilla' is a pretty nasty piece of work and maybe, just maybe this is the source of all my woes?

Whereas I am only seeing ads from APD and getting a dodgy installer, yours seems more widespread.
I have just tried 'Appbrain Ad detector', whilst using it I was spammed again with Ads for APD news LOL!!! full screen ad followed by a banner ad along the base of the screen. The only Ad networks found were within Google Playstore.
This was 'Admob' which a quick search shows something how it works and the ability to 'full screen' an ad however, it would seem this should only happen within using the app itself so I do not believe this is the cause.
It did identify 'Package Assistant' as a potential source which I think I uninstalled already - I am currently looking into this.

I am on the verge of doing a hard reset as I cannot waste anymore time on this - if that doesn't do it I'm going back to my old Nokia c2 and forget smart phones!

  • Forum posts: 4

Jul 9, 2017 2:26:40 PM via Website

An update that might be of interest to you, I decided on doing a hard reset yesterday, and guess what? The ads starting appearing again almost immediately: I had installed Firefox only at this point. I did another hard reset and installed nothing, just accessed the stock browser and other tools including visiting google playstore without installing anything and still I had the pop up ads (some full screen and some that sit middle of screen)
It would seem therefore the adware / malware has gotten itself into the base system folders where they are not removed, how this could occur without the phone being rooted I do not know.
Although initially I was ready to take a hammer to the phone I'm now sufficiently interested in the problem I'm messing about looking at rooting it / installing a custom recovery rom / installing a new rom and even seeing if I can trace the offending app / software once rooted.
I have managed to use USB debugging with ADB shell to see the base protected files and folders but have yet to ascertain the culprit: would be so nice if they named the offending file 'annoying ads app' or something.
Also attempting to flash the rom using SP Flash but come up against some problems.

Hope you fix your problem soon!

  • Forum posts: 4

Jul 11, 2017 6:59:26 PM via Website

The ads. are gone, finally! Here's what I did..
No amount of virus / malware software could find the culprit: (AVG, Malwarebytes, Adbrain Addetect)
I was unable to 'root' my phone (THL T6C): tried Kingroot
I was unable to install a custom recovery: Tried to follow instructions for TWRP but SP flash came up with a DRAM error.
I found a full firmware image for the exact model of my phone on the Chinese THL site (near 500MB) which I downloaded and tried again with SP Flash and this time it worked, but the ads still persisted!
This left two possibilities: one the ad was embedded in the firmware, or there were still files and directories that remained in the flash memory which I suspect were protected files but I cannot confirm this since I never found the offending files.
I decided to look into formatting the device, this in turn I discovered causes issues with removing the phones IMEI number(s) and also removing the embedded fixed mac address of the wifi card (not a problem particularly)
For my hardware there were a number of apps to enable resetting the IMEI (MTK Engineer mode) so within SP Flash I ran the format routine and then re-flashed the entire image again, I think in download only mode as the other modes then threw up errors.
It's all working again except I haven't fixed the mac address issue yet but I'm pleased to be rid of the ads.
Hope this helps someone.

  • Forum posts: 5

Aug 17, 2017 7:43:52 PM via Website

@kent lad - somehow I missed your post of 11 July, only seeing this now. Apologies for not replying sooner.

I'm not at all keen to format entire phone, the recovery process slightly above my level of expertise. Considering factory reset, but even that seems like a lot of effort, so I haven't done it yet.

I have, though, identified the "what" of my issue, but not yet the "why/how".
The main culprit app on my phone is Shell, I have no doubts about that. Another one two or more com.android.xxx apps were also to blame, com.android.snap was one and I can't recall what the other was. (The com.android ones brought even another dimension to the ads, just a banner in the centre with rest of screen greyed out.) Strangely enough I didn't explicitly install either of these and at least one appeared in my list of apps by itself. The other may have come with the phone, but I won't be surprised if it snuck in too somehow.

Another byproduct of the ads seemed to be stages (2-4 days) where my phone would constantly shut down WiFi by itself. No rhyme or reason, when I checked the phone WiFi would be off, I'd turn it on again but within minutes it would be off again. Intensely frustrating!.....

Since my problem started, I knew that Shell handled the bulk of the full screen ads by pressing and holding my home key to show all running apps. Did the same to find out which app did the banner-greyed-out ones, so uninstalled the com.android ones and they stopped immediately and sorted out the WiFi-shutdown issue too. Initial full screen ones persisted and I wasn't sure what repercussions uninstalling Shell would have. Eventually I got so fed up I uninstalled it in fit of ad-fueled rage (angry)
Fullscreen ads disappeared - joy of joys! Also seem to have better battery life and less data usage after this. (Sounds like a virus or malware, doesn't it, but still Kaspersky and Malwarebytes detect no issues after many many scans.)

However, this is not the end....
1) Came across 2 probable results of uninstalling Shell - videos in Firefox would have sound but no imagery; one morning my phone did not wake up at the scheduled time nor did the alarm go off. Not 100% sure these are directly related to removal of Shell, but they certainly overlap.
2) Shell has since magically reappeared without me installing it. Of course the ads too, but much less frequent than before. I have severely toned down on installing apps (never was a rabid app installer to begin with), only installed & uninstalled Facebook to check something. There have been several app updates, I don't know if somehow it came back with that.

In short, uninstalling Shell (and suspicious com.android apps) gets rids of the ads, but only temporarily.

  • Forum posts: 4

Sep 25, 2017 6:00:54 AM via Website

SUGGESTION:
Let's try finding the problem App another way.
List the Apps on your phone. After a few people list theirs, we'll have the culprit nailed.
HOPEFULLY your list are not too long.
1. Keep my notes
2. Alcohol Calculator
3. Drawing Pad
4. QuickMemo+
5. eBay Mobile Web
6. Talkatone
7. Estate Sales
8. Garage Sales by Map
9. Twitter
10. Solitare Free Pack
11. Barcode Scanner
12. Adblock Browser
13. GasBuddy
14. The Weather Channel
15. DailyRoads

  • Forum posts: 2

Sep 26, 2017 8:42:54 AM via Website

Hi there,
I use the DOOGEE X5 and I have the same problem. Every once in a while the app SHELL appears in my list, and the ads you describe appear.
I keep uninstalling the app (never hesitated once I realised that SHELL sende the ads), but it keeps coming back. I do not use an of the apps fm00078 has on the Phone, so I think there must be another sourceefor the app.

  • Forum posts: 1

Sep 26, 2017 9:37:37 AM via Website

Same here on Doogee F7 pro, found the process name by pressing the home button to reveal running apps.
Shell keeps coming back, I have now stopped and removed three applications that I think are related (not installed by me)
But the apps have good reviews and I don't see a popup add connection, I seem to have no more adds, maybe post date and time if it happens to see if i is a push to all message?
Also no scanning tool found anything.

Apps>sprocket icon (=configure apps)> change system configuration> then deny system rights to:

DG Xender ,more info To prevent spam in our forums, new users may not post links to external sites.
Parrallel Space ,more info To prevent spam in our forums, new users may not post links to external sites.

Launcher3 ,? more info: To prevent spam in our forums, new users may not post links to external sites.

— modified on Oct 8, 2017 9:37:55 AM

  • Forum posts: 2

Sep 26, 2017 11:32:18 AM via Website

Both Apps have already been deactivated, but now I also removed the permissions to change settings. I hope that will help.

  • Forum posts: 4

Sep 26, 2017 3:18:10 PM via Website

OK, this helps me tremendously. Its possible a past uninstalled App may have left this problem.

It appears I'll need to a factory reset but I've read elsewhere this didn't help some.

I hope we can find this irritating issue, I also hope this isn't collecting personal data.
THANKS

  • Forum posts: 5

Sep 27, 2017 11:27:00 AM via Website

Shell definitely to blame. It appeared again by itself and the ads got progressively more annoying, until I uninstalled it again this past weekend. Not a single ad since then and it hasn't reappeared yet.

Let me rephrase, it seems I have no app named Shell......in my 'regular' apps list. However, if I'm in Settings --> Apps and I hit the 3 vertical dots top right of screen or button to the left of home button at the bottom and choose to Show System, I once again see Shell as a system app.
So I think it's safe to say that if at any time you come across Shell in you regular apps list, uninstall it immediately and ads will go away. I have not yet found anyone that can tell me what exactly this app does and how vital it is to the rest of the phone's operation, but sure seems like all it does is annoy people by handling the ads. I'm not so sure anymore that it has anything to do with scheduled power on and making the alarm work when the phone is shut off.

@fm00078 - I have none of the apps you list, doubt any of them are to blame.

@Ma De - DX Gender and Parallel Space comes with the phone, I've had those two disabled since day one.

  • Forum posts: 5

Sep 27, 2017 12:14:32 PM via Website

Forgot to mention - I had a spell where allow installation of apps from unknown sources was on without me having turned it on. I had to turn it off twice within the same week, but since then it's always been turned off when I checked.
I'd say it's a good idea to check this regularly and always have it turned off. You'll find it in Settings --> Security.

Also, MalwareBytes and Kaspersky found one or two viruses/malware items in the many scans I've run, so I don't think it's bad to have those two (or similar) and run scans regularly.

  • Forum posts: 4

Sep 27, 2017 3:35:54 PM via Website

** _ _ _ UPDATE: _ _ _ **
Now going on 9 days and no FULL SCREEN POPUPS.
I've opened every downloaded App and let run for a few minutes each.

More Net search results.
FLV Player sends a hidden ADVERT pack when you accept their terms. This I didn't know, shrewdly they hid that info during install. (angry)



Malwarebytes, found nothing. Installed "Anti Adware" & so far 24 hrs no Full Screen Ads.(FSA).
Found 5 issues, removed 2, 'The Weather Channel' and "FLV Player".

Glad to read some have found their problems but this leads me to believe this FSA issue is deeper.
IF I had easy access to our court system, I'd be FILTHY RICH. Also (hopefully) many problem making folks REALLY POOR...or in jail.

— modified on Oct 6, 2017 5:29:48 AM

  • Forum posts: 1

Nov 13, 2017 2:57:12 PM via Website

Wow, well done. I am now at the hammer point! Could you please explain what you did step by step for someone who is a bit clueless? I'm sorry to be a nuisance but I think it would be a great help to lots of people. Many thanks.

  • Forum posts: 4

Nov 14, 2017 6:01:15 AM via Website

FIONA:
IF you're asking me, it was the 'FLV Player' (read my post above).
To this day, no Full Screen Adverts.
BUT, maybe I should reload FLV Player and see if it comes back?