Virus on Samsung n4

[Anonymous]

Hi everyone I went knto Google today and this virus has come up on my phone saying I've been looking at ****** etc that involves children under the law act article 161 etc I must pay 100 pound to take virus off etc. Now I can't access Google as the message just keeps popping up over it. I've been trying to get the safe mode on this phone but nothing is working done what this website suggests etc . Any tips on how to access this or get virus off another way. Getting annoyed now . Thanks

[MI5]

It will likely just be a pop up rather than a virus.
Have you tried turning off all data connections to see if you can access the phone settings?
If you can get on Play download "airpush detector" and let it search for the app or file that's causing the problem.
As a last resort you may have to do a factory reset - hopefully you are all backed up already?

[MI5]

Just a thought.
How are you trying to enter safe mode?

[MI5]

To access Safe Mode on a Note 4, power down your phone completely (hold the power button, then select Power off from the menu).
Once the phone is off, press and hold the power button to turn the phone on and as soon as the "Samsung" logo appears on screen, release the power button.
Then press and hold the volume down button until the phone boots up completely.
You are now in Safe Mode and will be able to access the Application Manager to identify and remove the app causing this.

[MI5 · Accepted solution]

I'm not sure if @Anonymous has fixed this but if anyone else has the problem I'll post the fix.

This guide only applies to Android phones:

1 - You need to boot into safe mode. Google for how to do this for your individual handset.

2 - The "virus" (it isn't really a virus but we'll call it that for the sake of argument) is controlled by an app that has been installed and it sets itself permissions to write to your lockscreen, so when in safe mode, go firstly to

Settings, then click on Security and select Device administrators.

You will find at least one (maybe 2 or 3) apps ticked on the list.

Un-tick the apps and select "Deactivate"

3 - Next, go to Settings >Apps (or Application Manager) and scroll across to "Downloaded"

4 - This is where the detective work has to start.

You are looking for a suspicious, malicious app, but you don't know the name of it, so carefully read through your list discounting any that are familiar, such as Facebook, Twitter etc.

One common malicious app is called "BaDoink" but the scammers will frequently change the name, so be alert.

If there are any that you are not sure about, just Google the name, this will tell you if they are safe or not.

5 - Once you find the culprit it is simply a case of a)deleting cache b)clear data c)uninstall

6 - Reboot phone and voila, problem solved..........

Hopefully - However if the malicious app is “Adobe Flash Player“, then your Android phone is infected with the latest version of ScarePakage ransomware. This app will most likely will not allow you to uninstall it.
To remove it, some variants of ScarePakage (fake Adobe Flash Player app) will uninstall themselves if you enter a random, long-enough number to satisfy the MoneyPak (15-digits) demand. If this will not work, then you will have to factory reset the phone.

You will need to back up first or have everything sync'd to Google or it will be lost, so this just goes to highlight how important regular backups of any electronic device are.

Good luck

[jonsie]

Brilliant tip @MI5

I really think this needs a help topic of it's own though.....it will be a good addition mate!

[MI5]

Cheers jonsie.
I'll write it up

[jonsie]

Nice one

[Anonymous]

Thanks for your comment I was trying the power off mode and holding etc.