VirginMedia distributing viruses!

[Lil-Squabbit]

As the title says.

VirginMedia are now distributing malicious malware/ viruses via their Telly Tablets. The viruses in question are:

• COM.WAGD.SMARTER
• COM.WAGD.XIAOAN
• COM.WAGD.GEM

Apparently, this is due to an infection on one of their update servers which hard codes the malware into the system software. This means that even if you do a hard reset on the device, the malicious products will be reinstalled too.

What are VirginMedia doing about this as I am sure we cant be the only people that are having this issue.

This is worrying that a major broadband supplier is letting these malware/viruses run rampant through their products. Bad form VirginMedia, bad form!

What are you going to do about this? 

[Tigratone]

Well if Gigaset can acknowledge and sort out the problem with a software update then virgin media could potentially do the same.

Upto now they have not even acknowledged that there is a problem,  so a fix at the moment is unlikely. 

Maybe virgin will not acknowledge the problem till they have a fix, but knowing that gigaset have done it gives us a little hope.

Just wish virgin would be more open and let us know what is happening. 

[Tigratone]

Been retrying flashman68's workaround. I have had contrasting results. The first couple of times I tried it,  it did not work. 

Tried again this morning and 8 hours later I have had no pop ups or unwanted apps.

The only thing I did differently was turning the tablet on and disabling WiFi. Then rebooting the tablet so that when it restarts it starts without WiFi. Then after this I followed flashman68 instructions. 

Before doing this I also used an app to clean up the storage of the tablet.

Also I have not run any virus checks on the tablet. It seems strange but I always seemed to get the problems returning after running  a virus check. Could it be after a virus scan it reawakens the malware and then causes problems. Seems unlikely but at the moment I have no other explanation.

[whonickedmyname]

Hi 

The only way we've had success in removing the pop-ups etc is by following this: 

https://blog.malwarebytes.com/android/2021/04/pre-installed-auto-installer-threat-found-on-android-m... 

You have to perform the following command for every user or it will reactive:   

adb shell pm uninstall -k --user 0 com.redstone.ota.ui 

BUT I don't trust the fix - it's a temp workaround (we've noticed that tablet is still mucking about with the volume and setting things to Do not disturb - and we have had it try to install other apps too, but MalwareBytes blocked it). 

[MazDaz9]

Hi Flashman68

Thanks for useful tip, giving it a go. Sorry, not very tech savvy, where do I turn off Automatic System Updates?

Many thanks

[Flashman68]

Hi there. You need to activate developer options first. Have a look at my previous reply to Lill-Squabbit, as it tells you how to do it. If you can't find it, I'll just post it again. It is only a work around though, until Virgin fix it.

[MazDaz9]

Hi Flashman

Yes that was what I was following, everything fine and developer options activated as per your step by step guide, just cannot find that one option to turn of automatic system updates. When I went under system updates actually shows me there's one there to install. 

When I used it yesterday though I didn't get any pop ups and no more rogue apps appeared, nice even just for a little while!

Thanks for sharing your workaround and hopefully virgin will come up with something more permanent. 

MazDaz9

[Flashman68]

Hi there. It's in developer options, the 9th one down. Just click the button to It's right. Also the system updates in "running services" need stopping. After you've done this, you have to update manually from Play Store. I just do it every couple of days. 

With any luck, Virgin will get it fixed soon! 

[BlackSheepWall]

Just bought this tablet a couple of days ago, same problems that everybody reported. The way I see it, either release a new update that wipes the previous one, or do a step by step guide on how to downgrade to a previous version (before this infected update). I think the later would be quicker but Virgin should say something regarding this. This problem, from what I gathered is affecting everyone owning this tablet, its a major breach in security.

[hmfc4eva]

This page is ironic considering only Virgin can fix the issue:

https://www.virginmedia.com/help/malware-alert

[Lil-Squabbit]

---

@whonickedmyname wrote:

Hi 

The only way we've had success in removing the pop-ups etc is by following this: 

https://blog.malwarebytes.com/android/2021/04/pre-installed-auto-installer-threat-found-on-android-m... 

You have to perform the following command for every user or it will reactive:   

adb shell pm uninstall -k --user 0 com.redstone.ota.ui 

BUT I don't trust the fix - it's a temp workaround (we've noticed that tablet is still mucking about with the volume and setting things to Do not disturb - and we have had it try to install other apps too, but MalwareBytes blocked it). 

---

I wouldn't have a clue how to do this. It sounds way complicated 😑