bud11 #26 Posted February 21 6 hours ago, Brianwc said: Not compatible with my devices I can block those 2 domain with lumen. But, im just android noob, i dont know how to find the adware. I wish i could give my phone to you so you can inspect them Share this post Link to post Share on other sites
Brianwc #27 Posted February 21 I disabled Chrome and seems to be less often but I have seen it open apps that can view web. Definitely something. Google both domains and you will see this is adware of some type and malwarebytes fails to find it Share this post Link to post Share on other sites
Grimlich #28 Posted February 21 On 2/18/2019 at 6:55 PM, Brianwc said: Anyone else getting this.? Yes. Any updates? Share this post Link to post Share on other sites
mbam_mtbr #29 Posted February 22 Hi @Brianwc, @Grimlich, @bud11, @imma, @77Vero, @Mahadev, I working hard to try to find a solution for all of you. Looking at two different Apps Reports which list all the apps on a device, I'm not finding any red flags of your typical Adware. Let's try a couple of things to see if it solves the issues. Go to Settings > Apps > Chrome In the App info, go to Storage Press Clear Cache Press Manage Space Press Manage under All site storage, including cookies and other locally stored data Two options here: Press Clear Site Storage... to clear all site data Find the offending site(s) (m.novelcamp.net) and click on it in list Press Clear & Reset Let me know if this works for anyone. Also, if you like to send me an Apps Report and already haven't, that would be very helpful. To send an Apps Report with Malwarebytes for Android use the following instructions. 1.Open the Malwarebytes for Android app. 2.Tap the Menu icon. 3. Tap Your apps. 4. Tap three lines icon in upper right corner. 5. Tap Send to support Choose an email app to send Apps Report. Your email app will open with the Apps Report included. Send the Apps Report to create a ticket. Private Message (PM) me the email used and/or the ticket number assigned. I understand this is frustrating for all of you. Trust me, it's frustrating for me as well, and I'm doing my best to find a solution. Nathan Share this post Link to post Share on other sites
Brianwc #30 Posted February 22 says no reply so I will do it here. I uninstalled chrome and cleared everything in it. then the next day I reinstalled chrome. updated it. After a day or so it opened those pages people are saying. even if you were not using the Chrome browser. Share this post Link to post Share on other sites
Brianwc #31 Posted February 22 https://www.reddit.com/r/GalaxyS9/comments/ai98c0/novelcampnet_automatically_pops_up_in_android/ take a good look at this thread its widespread and the first company to find a cure wins Share this post Link to post Share on other sites
mbam_mtbr #32 Posted February 22 Hi @Brianwc, Yes, I've see the reddit thread as well. Looking deeper into the thread, it appears that there is a connection with this app: com.rahul.videoderbeta Videoder Video Downloader I would try uninstalling this. I'm going to do some deeper research into this app as well. Nathan Share this post Link to post Share on other sites
Brianwc #33 Posted February 22 yes I been wondering that too. I have 2 devices both have videoder I have the paid version but some of those in that thread did not use that AP and still have the issue Share this post Link to post Share on other sites
mbam_mtbr #34 Posted February 22 (edited) @Brianwc, Yeah, I saw that not everyone had exactly videoder, but they could have another third party app that has the same Ad SDK causing the issue. I installed it onto a test device to see if the pop ups start. I'll keep researching it. Nathan Edited February 22 by mbam_mtbr Share this post Link to post Share on other sites
Grimlich #35 Posted February 22 I'm running videoder, too Share this post Link to post Share on other sites
Brianwc #36 Posted February 22 Are you running the paid version I. Am Share this post Link to post Share on other sites
Grimlich #37 Posted February 22 Yes, the pro version Share this post Link to post Share on other sites
bud11 #38 Posted February 22 i followed lumen recommendation to remove videoder, it seems the pop up now disappear (yeah!). im sure videoder is the culprit Share this post Link to post Share on other sites
Brianwc #39 Posted February 22 Ok i updated malwarebytes in playstore as soon as I hit update my Samsung internet browser opened to appsquare again. So this is definitely something running an open any type of browser Share this post Link to post Share on other sites
Brianwc #40 Posted February 22 1 hour ago, bud11 said: i followed lumen recommendation to remove videoder, it seems the pop up now disappear (yeah!). im sure videoder is the culprit I kinda hoping this is not true since I need the ap and paid to remove ads. I snt them an email too. But I will Prob Uninstall on one of my android phones and check results. Its funny the only pop those pages up every few days and it will use chrome or Samsung browser so far my case. Share this post Link to post Share on other sites
imma #41 Posted February 22 videoder is not the problem, because i have never had that app installed in my device and the pop ups continue... Share this post Link to post Share on other sites
77Vero #42 Posted February 22 Bonjour à tous 12 hours ago, mbam_mtbr said: @Brianwc, Yeah, I saw that not everyone had exactly videoder, but they could have another third party app that has the same Ad SDK causing the issue. I installed it onto a test device to see if the pop ups start. I'll keep researching it. Nathan Bonjour Voici ce qu'ont donné mes recherches ... Cordialement Share this post Link to post Share on other sites
Mahadev #43 Posted February 22 I haven't videoder app. And i sent app report to malwarebytes. Still not get any solution. Also did pm also to @mbam_mtbr Share this post Link to post Share on other sites
mbam_mtbr #44 Posted February 22 (edited) Hi @Brianwc, @Grimlich, @bud11, @imma, @77Vero, @Mahadev, So far, here are my findings. It appears there is a correlation with the third party APK site en.uptodown.com. Furthermore, m.novelcamp.net and other sites seen are all related to a the site BatMobi. There is actually a direct reference to BatMobi in the app package name: com.rahul.videoderbeta app name: Videoder Video Downloader ( @Brianwc). I was able to create a detection for this — Android/Adware.BatMobi.NC. However, others don't have this app, and I have yet to find detections — don't worry, I'm working hard to find something. In the meantime, if you have any of these apps, I suggest uninstalling to see if it fixes the issue: com.snaptube.premium Snaptube @immadevian.tubemate.v3 TubeMate @Mahadev Anything else downloades/installed from en.uptodown.com — especially under category Video and Audio Downloaders If you are hesitate to uninstall, it also may be worth trying to clear the cache on these apps as they all have built in browsers. This could explain why clearing the cache on Google Chrome doesn't work, because the stored info causing the pop ups may be within these browsers instead. Worth a try! I'll keep working away at this issue. Please let me know if any of this works, Nathan Edited February 22 by mbam_mtbr Share this post Link to post Share on other sites
mbam_mtbr #45 Posted February 22 Update. I created detection Android/Adware.BatMobi.SnapMango for the following: com.snaptube.premium Snaptube It will be detected in future database versions. Nathan Share this post Link to post Share on other sites
Grimlich #46 Posted February 22 @mbam_mtbr Thanks for your efforts on this. I have uninstalled videoder and I'll report back on popups in a few days. Share this post Link to post Share on other sites
mbam_mtbr #47 Posted February 23 Thanks @Grimlich! I'll 98% sure that's the culprit. Nathan Share this post Link to post Share on other sites
Mahadev #48 Posted February 23 But i had tubemate app. Not videoder or snaptube app. And i uninstalled tubemate. Is it also related to batmobi and snaptube. Share this post Link to post Share on other sites
mbam_mtbr #49 Posted February 23 Hi @Mahadev, I'm still looking into your case, but yes, I would definitely either uninstall or try clearing it's cache. I would be interested to see if just clearing the data/cache of this app does the trick. However, I think there's probably Batmobi hidden somewhere in it's code, I just haven't found it yet. Nathan Share this post Link to post Share on other sites
Mahadev #50 Posted February 23 I have already uninstalled tubemate. But just now when i updated a app in play store. After update this link opened automatically in chrome. https://m.novelcamp.net/?p=4A6B1E8774E25418B002835535545B52&geo=IN&sv=518&gaid=41eb1092-0dae-4314-bac3-5234a5df32ae&pbl=9E55C7D7B3524808BCD13C1FFF9B1FB0&sn=etap_5.1.8&flow=0&utm_source=201&url=m.novelcamp.net Above link opens after redirect of this link looks like in this photo. I m unable to trace this link shown in photo. One time i stopped internet when this link opened. After search in my google this link looks like this. But it cannot be copied. Share this post Link to post Share on other sites