Solved Google search bar redirect on note 5

[Holyeffenwow]

My wife is having an issue with her note 5 whenever she clicks a link from the Google search bar on her home screen. Any link she clicks refills in a pop-up from ninaxu.com telling her she she has 13 viruses. If she opens chrome and and searches within the browser it only happens about half the time.

I've tried everything to fix it with no results and malware bytes and Antivirus don't see it. I'm out of ideas, can anyone help?

Sent from my SM-N920V using Tapatalk

 

[CJM]

Try going to settings/Apps/Google app & disable it to see if it keeps doing it

Tapped from a Nexus 6

 

[leeshor]

That's scareware crud. See if installing Malwarebytes from the Store will find the problem. It's probably coming from a free app you installed. You also may want to check AirPush Detector

 

[Holyeffenwow]

It seems to stop with the Google App disabled

Sent from my SM-N920V using Tapatalk

 

[Holyeffenwow]

As stated above neither malware bytes or Antivirus pick it up

Sent from my SM-N920V using Tapatalk

 

[leeshor]

Try clearing the cache in the Google WebView app.

 

[CJM]

Maybe try going to the Chrome browsers settings & see what the search engine is set to

Tapped from a Nexus 6

 

[FoxKat]

This is an infiltration of the known Ninaxu.com virus (ransomware). There are several sites that describe the process of removal of this ransomware and of viruses and the like in general. I have linked two sites below. Note: I have not tried either but I've read through the processes and they appear to be honest and reliable.

I would suggest that you carefully follow the instructions for removal listed on the first site, but I would proceed with caution regarding the installation and use of the anti-virus app they recommend. I did review the app and with over 100,000 reviews it has a rating of 4.6 out of 5 (92%), which is very high. That said there are almost 4,000 who rated it a 1 (20% or less in rating), by just under 3% of the rating public. I generally consider something that has a rating in the mid to high 4s to be reliable. Your results may vary.

In regard to the second site, it recommends another anti-virus app which is widely recognized as a leader and also carries a high rating, AVG, with nearly 5 million downloads, and also with an average 4.6 approval rating, but with just under 4% rating it a 1 out of 5. You need to use your own discretion.

There was mention in the second site that the anti-virus app AVG didn't detect the infiltration, however this shouldn't necessarily be construed as an inexcusable failure by AVG. It could be due to any number of reasons, but most likely one of two, either the offending app itself blocks detection by an anti-virus app, a common method of remaining difficult to remove, or the anti-virus app doesn't yet have a signature of the offending app, perhaps because it's so new. I will say that in any case with Android and viruses/spyware/ransomware, if you delete the offending app(s), before you run the anti-virus app(s), you will have greater success.

Finally, neither I nor the DroidForums.net forum either condone or attest to the accuracy of any information provided by other sources referenced herein.

Ninaxu.com Android "Virus" pop up Removal - Mobile Security Zone

Remove virus from Android phone (Pop-up Ads and Adware)

 

[Sajo]

This is just me and my thoughts, but I would have already done a FDR on the phone and then very carefully & selectively installed only the bare minimum apps that I required. I have not had luck in the past with Android malware / virus removal apps.

Sent from my XT1585 using Tapatalk

 

[FoxKat]

This is just me and my thoughts, but I would have already done a FDR on the phone and then very carefully & selectively installed only the bare minimum apps that I required. I have not had luck in the past with Android malware / virus removal apps.

Sent from my XT1585 using Tapatalk

There is no doubt that a Factory Data Restore (FDR), is the most complete solution to the problems many phones suffer, and especially for those problems related to corrupted files, viruses, spyware, and ransomware. Once done your phone is restored to an "out of the box" state, and should be free of any possible infection.

The only cases where this may not be true are when the phone has been rooted and then the possibility exists for either corruption of the actual OS, or through installation of a third party ROM the infection is actually baked into the OS.

Still, most people would rather not have to go through completely resetting their phone, which entails first backing up ALL pertinent data, pics, media and other files, then after resetting requires restoring the phone and all apps, accounts, logging into all external sites (of course assuming you remember your passwords), and getting it back the way you like it.

Wherever possible I try to provide solutions that avoid an FDR, unless there are no known options left. Also, I believe this particular infestation can be irradiated without the use of an antivirus application. Simply stop the offending app or apps, uninstall them and clear cache and you should be fine. Still, for those who would rather take the fast road to a full restore followed by a longer road to getting there phone back the way you like it, I say go for it, but remember... BACK UP YOUR DATA!


Sent from my XT1585 using Tapatalk

 

[Holyeffenwow]

it looks like I was successful in clearing the "virus" using your advice and the links above. Many thanks to all of you from my wife and I!

Sent from my SM-N920V using Tapatalk

 

[FoxKat]

it looks like I was successful in clearing the "virus" using your advice and the links above. Many thanks to all of you from my wife and I!

Sent from my SM-N920V using Tapatalk

I'm very pleased to hear of your success. Thank you for reporting since not only does the information make us all happy for you, but it also confirms my suspicions and that this solution is successful in irradicating the issue. Now if others suffer this kind of infection we can be confident in recommending this same process to them as well.



Sent from my XT1585 using Tapatalk