m.novelcamp.net pop up s

[bud11]

6 hours ago, Brianwc said:

 

Not compatible with my devices

 

I can block those 2 domain with lumen. But, im just android noob, i dont know how to find the adware. I wish i could give my phone to you so you can inspect them

[Brianwc]

I disabled Chrome and seems to be less often but I have seen it open apps that can view web. Definitely something. Google both domains and you will see this is adware of some type and malwarebytes fails to find it

[Grimlich]

On 2/18/2019 at 6:55 PM, Brianwc said:

Anyone else getting this.? 

Yes. Any updates?

[mbam_mtbr]

Hi @Brianwc, @Grimlich, @bud11, @imma, @77Vero, @Mahadev,

I working hard to try to find a solution for all of you.  Looking at two different Apps Reports which list all the apps on a device, I'm not finding any red flags of your typical Adware.

Let's try a couple of things to see if it solves the issues.

1. Go to Settings > Apps > Chrome
   1. In the App info, go to Storage
      1. Press Clear Cache
         1. Press Manage Space
            1. Press Manage under All site storage, including cookies and other locally stored data
               1. Two options here:
                  1. Press Clear Site Storage... to clear all site data
                  2. Find the offending site(s) (m.novelcamp.net) and click on it in list
                     1. Press Clear & Reset

Let me know if this works for anyone.

Also, if you like to send me an Apps Report and already haven't, that would be very helpful.

To send an Apps Report with Malwarebytes for Android use the following instructions.

1.Open the Malwarebytes for Android app.

2.Tap the Menu icon.

3. Tap Your apps.

4. Tap three lines icon in upper right corner.

5. Tap Send to support

Choose an email app to send Apps Report.

Your email app will open with the Apps Report included. Send the Apps Report to create a ticket.

Private Message (PM) me the email used and/or the ticket number assigned.

I understand this is frustrating for all of you.  Trust me, it's frustrating for me as well, and I'm doing my best to find a solution.

Nathan

[Brianwc]

says no reply so I will do it here.    I uninstalled chrome and cleared everything in it. then the next day I reinstalled chrome.  updated it.    After a day or so it opened those pages people are saying. even if you were not using the Chrome browser. 

[Brianwc]

https://www.reddit.com/r/GalaxyS9/comments/ai98c0/novelcampnet_automatically_pops_up_in_android/

take a good look at this thread its widespread and the first company to find a cure wins

[mbam_mtbr]

Hi @Brianwc,

Yes, I've see the reddit thread as well.  Looking deeper into the thread, it appears that there is a connection with this app:

com.rahul.videoderbeta      Videoder Video Downloader 
 

I would try uninstalling this.  I'm going to do some deeper research into this app as well.

Nathan

[Brianwc]

yes I been wondering that too.   I have 2 devices both have videoder  I have the paid version but some of those in that thread did not use that AP and still have the issue

 

[mbam_mtbr]

@Brianwc,

Yeah, I saw that not everyone had exactly videoder, but they could have another third party app that has the same Ad SDK causing the issue.  I installed it onto a test device to see if the pop ups start.  I'll keep researching it.

Nathan

Edited February 22 by mbam_mtbr

[Grimlich]

I'm running videoder, too

[Brianwc]

Are you running the paid version I. Am

[Grimlich]

Yes, the pro version

 

[bud11]

i followed lumen recommendation to remove videoder, it seems the pop up now disappear (yeah!). im sure videoder is the culprit

[Brianwc]

Ok i updated malwarebytes in playstore as soon as I hit update my Samsung internet browser opened to appsquare again. So this is definitely something running an open any type of browser

[Brianwc]

1 hour ago, bud11 said:

i followed lumen recommendation to remove videoder, it seems the pop up now disappear (yeah!). im sure videoder is the culprit

I kinda hoping this is not true since I need the ap and paid to remove ads. I snt them an email too. But I will Prob Uninstall on one of my android phones and check results. Its funny the only pop those pages up every few days and it will use chrome or Samsung browser so far my case. 

[imma]

videoder is not the problem, because i have never had that app installed in my device and the pop ups continue...

[77Vero]

Bonjour à tous

 

12 hours ago, mbam_mtbr said:

@Brianwc,

Yeah, I saw that not everyone had exactly videoder, but they could have another third party app that has the same Ad SDK causing the issue.  I installed it onto a test device to see if the pop ups start.  I'll keep researching it.

Nathan

Bonjour

Voici ce qu'ont donné mes recherches ...

Cordialement

 

 

[Mahadev]

I haven't videoder app. And i sent app report to malwarebytes. Still not get any solution. Also did pm also to @mbam_mtbr

[mbam_mtbr]

Hi @Brianwc, @Grimlich, @bud11, @imma, @77Vero, @Mahadev,

So far, here are my findings.

It appears there is a correlation with the third party APK site en.uptodown.com.  Furthermore, m.novelcamp.net and other sites seen are all related to a the site BatMobi.  There is actually a direct reference to BatMobi in the app  package name: com.rahul.videoderbeta app name:  Videoder Video Downloader ( @Brianwc).  I was able to create a detection for this —  Android/Adware.BatMobi.NC. 

However, others don't have this app, and I have yet to find detections — don't worry, I'm working hard to find something.  In the meantime, if you have any of these apps, I suggest uninstalling to see if it fixes the issue:

com.snaptube.premium      Snaptube @imma
devian.tubemate.v3      TubeMate @Mahadev
Anything else downloades/installed from en.uptodown.com — especially under category Video and Audio Downloaders

If you are hesitate to uninstall, it also may be worth trying to clear the cache on these apps as they all have built in browsers.  This could explain why clearing the cache on Google Chrome doesn't work, because the stored info causing the pop ups may be within these browsers instead.  Worth a try!

I'll keep working away at this issue.

Please let me know if any of this works,

Nathan

Edited February 22 by mbam_mtbr

[mbam_mtbr]

Update.  I created detection Android/Adware.BatMobi.SnapMango for the following:

com.snaptube.premium      Snaptube  

It will be detected in future database versions.

Nathan

[Grimlich]

@mbam_mtbr Thanks for your efforts on this. I have uninstalled videoder and I'll report back on popups in a few days.

[mbam_mtbr]

Thanks @Grimlich!  I'll 98% sure that's the culprit.

Nathan

[Mahadev]

But i had tubemate app. Not videoder or snaptube app. And i uninstalled tubemate. Is it also related to batmobi and snaptube.

[mbam_mtbr]

Hi @Mahadev,

I'm still looking into your case, but yes, I would definitely either uninstall or try clearing it's cache.  I would be interested to see if just clearing the data/cache of this app does the trick.  However, I think there's probably Batmobi hidden somewhere in it's code, I just haven't found it yet.

Nathan

[Mahadev]

I have already uninstalled tubemate. But just now when i updated a app in play store. After update this link opened automatically in chrome.

https://m.novelcamp.net/?p=4A6B1E8774E25418B002835535545B52&geo=IN&sv=518&gaid=41eb1092-0dae-4314-bac3-5234a5df32ae&pbl=9E55C7D7B3524808BCD13C1FFF9B1FB0&sn=etap_5.1.8&flow=0&utm_source=201&url=m.novelcamp.net

Above link opens after redirect of this link looks like in this photo. I m unable to trace this link shown in photo. One time i stopped internet when this link opened. After search in my google this link looks like this. But it cannot be copied.