Full screen ads - Android Shell app, other apps linked to ad networks

  • Replies:6
  • OpenNot stickiedUnanswered
  • Forum posts: 3

Jul 5, 2017 2:34:54 PM via Website

Hi All,

Hoping for advice, suggestions, or at least some enlightenment on annoying full screen ads I'm experiencing on my Android cellphone.

First things first, phone details:
Doogee T5S (Chinese origin, I believe), not rooted (unless it comes like that in the box), USB debugging disabled
Baseband version DOOGEE-T5. 2016/12/10, Kernel version 3.19.19
Android 6.0 - build number DOOGEE-T5-Android6.0-20161210
Country - Namibia, service provider - MTC

Secondly, my problem:
I'm experiencing more and more full screen pop-up ads at random times. Sometimes I'm in an app, sometimes I just tapped to open an app and other times it just happens from the anywhere. I don't have terribly many 3rd party apps and I've uninstalled some since the ads are appearing more frequently, so not quite sure where this is coming from.
It started with one particular ad, APD News, which wants to install an app with the same name from an unknown source. But lately it's a variety of ads promoting local TV stations, a Final Fantasy game, a mug press (!?!), etc., with a little (i) in a corner that says Ads by Google when clicked on. Also, when I hit the button to display all open apps while an ad is displaying, the app handling the ad is apparently [Android] Shell. I intended to add some screen grabs, but seems the ability is not yet available.

Remediation actions taken:
Searching the internet for similar problems did not provide much help, among the few suggestions I did find, were to factory reset the phone and remove all 3rd party apps. Not quite there yet, and it does not really identify or address the root cause.
So I installed Kaspersky Internet Security and MalwareBytes Anti-Malware (unpaid versions), but scans with those always come out clean and didn't curtail the ads.
I stumbled across an app called AppBrain Ad Detector on Google Play store. Not sure exactly what all it's supposed to do, but one of the features highlights ad networks and shows which apps are linked to those. Admob seems to be the main culprit, and has 10 apps associated with it - Google, Google Play Store, com.android.snap and Shell (these came with the phone, I didn't install any of them) and 6 other apps I got from the Play Store. I swear when I checked over the weekend Google, Google Play Store and com.android.snap were not on the list.... There's also MoPub and InMobi, but those have 2 and 1 app (respectively) associated with them. Interestingly, Shell is the only app that is associated with all 3 ad networks.

Questions:
1) I understand that 3rd party apps may come with ads, but shouldn't that be within the app and not the full screen type I'm experiencing. Any other ideas how I can ascertain what the heck is causing this annoyance?
2) I checked in Settings - Apps and I have the option to uninstall Shell. I'm seriously considering that, since it's apparently the app handling the ads and is associated with 3 ad networks. Is this a good idea, though? It seems to be a system app and came with the phone, so what will happen if I remove it?

Apologies for the long post, trying to include as much relevant detail as possible, and thanks if you read all the way to down here. Hope someone has some ideas!

Cheers,
L.

  • Forum posts: 4

Jul 6, 2017 12:54:18 PM via Website

Not any help but can confirm very similar problem with a THL T6C that have owned for 9 months or more.
Just started getting the APD news full screen ads, trying to install from unknown source etc.
No new apps for months, and coincided with an update via google for 4 apps, all well known, all uninstalled.
Now uninstalled almost all, if i get anywhere i will post back.

— modified on Jul 7, 2017 6:20:21 PM

  • Forum posts: 3

Jul 7, 2017 6:06:09 PM via Website

Update

OK, so not much luck yet with finding where exactly the problem lies and eliminating full screen ads completely. But does seem like they don't pop up quite as often anymore. Debatable at best, though, just when I believe there are fewer ads a new one pops up :?

For what it's worth, I did the following:

  • On the phone, go into Settings - Google - Ads and turn on Opt out of Ads Personalisation. In here you should also note your advertising ID, needed in one of the later steps.

  • In the Google menu again, tap Personal info and privacy, scroll down and tap Ads Settings. This will open your browser and have you log onto your Google account. After logging in, turn off Ads Personalization, scroll down to the bottom and tap the link to OPT OUT OF MORE ADS. This opens a new tab and takes you to the DAA's Webchoices page, follow the prompts to have a scan done and opt out of all the networks that are found.

  • Open your browser on your phone and go to www[dot]airpush[dot]com/optout/. There are 3 big blue buttons in the
    body of the page, click each and follow the steps described. First button has on option for manual opt-out by providing your device's IMEI/MEID/ESN, I didn't do that. 3rd button is where you'll need the advertising ID obtained in first step above.

  • Search the Play Store for an app called TRUSTe, installing it also allows for opting out of some ad networks

More than anything these seem to address ad personalisation, not really getting rid of the ads completely. But at least it feels like I'm doing something!!

  • Forum posts: 4

Jul 7, 2017 7:06:50 PM via Website

Hi,
Going back to your original question 1, I think you are right: the Ads should be within the App you are using not popping up randomly regardless of the App in use; I had the Ad appearing even when using the built in camera! At this point a large square Ad (From APD always from them) appeared over the view finder, followed by a bar along the bottom of the screen. Clicking the cross in the corner of the Ad starts the install process for Their news reader. Thankfully it cannot install as I have the 'use trusted sources' or Google play store only set.

Steps I have taken include:

un-installing firstly the updated apps that coincided with the appearance of the Ad

un-installing third-party 'free' apps that despite have no ads in them 'might' have a problem however unlikely.

Trying to ascertain the app that created the Ad (hold finger on the Ad to reveal its creater) - this hasn't worked on the full screen Ad but sometimes I get a notification from 'launcher3' the built-in launcher that came with the phone (this just popped up as I was writing!!!) - how can this happen?!?

App by app removing permissions to 'draw over' and 'peeking'
Where possible setting 'block all notifications' though I think I left 'launcher3' since it is the desktop.
I have installed things like 'airpush', Malwarebytes, Adaware and none found a problem except Malwarebytes:
It found a trojan it named as 'trojan_guerrilla_ae' which I removed: searching on the net this 'guerrilla' is a pretty nasty piece of work and maybe, just maybe this is the source of all my woes?

Whereas I am only seeing ads from APD and getting a dodgy installer, yours seems more widespread.
I have just tried 'Appbrain Ad detector', whilst using it I was spammed again with Ads for APD news LOL!!! full screen ad followed by a banner ad along the base of the screen. The only Ad networks found were within Google Playstore.
This was 'Admob' which a quick search shows something how it works and the ability to 'full screen' an ad however, it would seem this should only happen within using the app itself so I do not believe this is the cause.
It did identify 'Package Assistant' as a potential source which I think I uninstalled already - I am currently looking into this.

I am on the verge of doing a hard reset as I cannot waste anymore time on this - if that doesn't do it I'm going back to my old Nokia c2 and forget smart phones!

  • Forum posts: 4

Jul 9, 2017 2:26:40 PM via Website

An update that might be of interest to you, I decided on doing a hard reset yesterday, and guess what? The ads starting appearing again almost immediately: I had installed Firefox only at this point. I did another hard reset and installed nothing, just accessed the stock browser and other tools including visiting google playstore without installing anything and still I had the pop up ads (some full screen and some that sit middle of screen)
It would seem therefore the adware / malware has gotten itself into the base system folders where they are not removed, how this could occur without the phone being rooted I do not know.
Although initially I was ready to take a hammer to the phone I'm now sufficiently interested in the problem I'm messing about looking at rooting it / installing a custom recovery rom / installing a new rom and even seeing if I can trace the offending app / software once rooted.
I have managed to use USB debugging with ADB shell to see the base protected files and folders but have yet to ascertain the culprit: would be so nice if they named the offending file 'annoying ads app' or something.
Also attempting to flash the rom using SP Flash but come up against some problems.

Hope you fix your problem soon!

  • Forum posts: 4

Jul 11, 2017 6:59:26 PM via Website

The ads. are gone, finally! Here's what I did..
No amount of virus / malware software could find the culprit: (AVG, Malwarebytes, Adbrain Addetect)
I was unable to 'root' my phone (THL T6C): tried Kingroot
I was unable to install a custom recovery: Tried to follow instructions for TWRP but SP flash came up with a DRAM error.
I found a full firmware image for the exact model of my phone on the Chinese THL site (near 500MB) which I downloaded and tried again with SP Flash and this time it worked, but the ads still persisted!
This left two possibilities: one the ad was embedded in the firmware, or there were still files and directories that remained in the flash memory which I suspect were protected files but I cannot confirm this since I never found the offending files.
I decided to look into formatting the device, this in turn I discovered causes issues with removing the phones IMEI number(s) and also removing the embedded fixed mac address of the wifi card (not a problem particularly)
For my hardware there were a number of apps to enable resetting the IMEI (MTK Engineer mode) so within SP Flash I ran the format routine and then re-flashed the entire image again, I think in download only mode as the other modes then threw up errors.
It's all working again except I haven't fixed the mac address issue yet but I'm pleased to be rid of the ads.
Hope this helps someone.

  • Forum posts: 3

Aug 17, 2017 7:43:52 PM via Website

@kent lad - somehow I missed your post of 11 July, only seeing this now. Apologies for not replying sooner.

I'm not at all keen to format entire phone, the recovery process slightly above my level of expertise. Considering factory reset, but even that seems like a lot of effort, so I haven't done it yet.

I have, though, identified the "what" of my issue, but not yet the "why/how".
The main culprit app on my phone is Shell, I have no doubts about that. Another one two or more com.android.xxx apps were also to blame, com.android.snap was one and I can't recall what the other was. (The com.android ones brought even another dimension to the ads, just a banner in the centre with rest of screen greyed out.) Strangely enough I didn't explicitly install either of these and at least one appeared in my list of apps by itself. The other may have come with the phone, but I won't be surprised if it snuck in too somehow.

Another byproduct of the ads seemed to be stages (2-4 days) where my phone would constantly shut down WiFi by itself. No rhyme or reason, when I checked the phone WiFi would be off, I'd turn it on again but within minutes it would be off again. Intensely frustrating!.....

Since my problem started, I knew that Shell handled the bulk of the full screen ads by pressing and holding my home key to show all running apps. Did the same to find out which app did the banner-greyed-out ones, so uninstalled the com.android ones and they stopped immediately and sorted out the WiFi-shutdown issue too. Initial full screen ones persisted and I wasn't sure what repercussions uninstalling Shell would have. Eventually I got so fed up I uninstalled it in fit of ad-fueled rage (angry)
Fullscreen ads disappeared - joy of joys! Also seem to have better battery life and less data usage after this. (Sounds like a virus or malware, doesn't it, but still Kaspersky and Malwarebytes detect no issues after many many scans.)

However, this is not the end....
1) Came across 2 probable results of uninstalling Shell - videos in Firefox would have sound but no imagery; one morning my phone did not wake up at the scheduled time nor did the alarm go off. Not 100% sure these are directly related to removal of Shell, but they certainly overlap.
2) Shell has since magically reappeared without me installing it. Of course the ads too, but much less frequent than before. I have severely toned down on installing apps (never was a rabid app installer to begin with), only installed & uninstalled Facebook to check something. There have been several app updates, I don't know if somehow it came back with that.

In short, uninstalling Shell (and suspicious com.android apps) gets rids of the ads, but only temporarily.