VirginMedia distributing viruses!

[Lil-Squabbit]

As the title says.

VirginMedia are now distributing malicious malware/ viruses via their Telly Tablets. The viruses in question are:

• COM.WAGD.SMARTER
• COM.WAGD.XIAOAN
• COM.WAGD.GEM

Apparently, this is due to an infection on one of their update servers which hard codes the malware into the system software. This means that even if you do a hard reset on the device, the malicious products will be reinstalled too.

What are VirginMedia doing about this as I am sure we cant be the only people that are having this issue.

This is worrying that a major broadband supplier is letting these malware/viruses run rampant through their products. Bad form VirginMedia, bad form!

What are you going to do about this? 

[SalemsLady]

This is what is running. 

Settings

Malwarebytes

Bluetooth share

Google services

Virgin TV go

Google Keyboard

Android Services Library

Nothing else. 

Automatic system updates was turned OFF after a reboot with WiFi off. 

Once I done the original steps WiFi was turned back on, the tablet run super smoothly for an hour. Then the pop ups started again. 

I know it's in the updater and that's why it'll keep happening, but I'm just furious at VM for ignoring the pleas of so many people. Absolutely right if it were a broadband issue they'd be tearing around trying to make sure their name wasn't tarnished in the media. 

[Flashman68]

That's the point. Just don't reboot it. If you really have to, as you've already said and I did 3 weeks ago, turn the WiFi off before you reboot it and stop system updates when you have. I've had no malware for  a few weeks,but still holding my breath for Virgin to hurry up and fix it. They won't.

[SalemsLady]

Right so after following the previous post it seems I went to the wrong 'running' section, followed steps via apps and 'Show system', found system updates but it's already stopped from the last time I stopped it, it hasn't restarted and all greyed out options. Yet still redownloading the malware. 

[Flashman68]

I've just rebooted mine.

Just do this. 

Turn your WiFi off. 

Make sure all the dodgy apps gave been uninstalled.

Reboot it.

Go into Developer options.

Make sure Automatic System Updates is turned off.

Go into Running Services (in developer options). 

Click on System updates. Click Stop on both boxes. Go back and System updates will have disappeared from Running Services. 

Turn your WiFi back on. That should do it.

[Flashman68]

 This is the system updates you need to stop.

 click both stop boxes.

---

@SalemsLady wrote:

Right so after following the previous post it seems I went to the wrong 'running' section, followed steps via apps and 'Show system', found system updates but it's already stopped from the last time I stopped it, it hasn't restarted and all greyed out options. Yet still redownloading the malware. 

---

[SalemsLady]

Yes, they have been, hence why they don't show up in that section for me. Only the above that I listed. 

I can find the actual program going via the app show system section, but as explained, it's already been stopped when I did the steps mentioned previously. It hasn't restarted but it hasn't stopped the malware from downloading. 

I have followed each and every step. The tablet has not been rebooted, turned off at all since following the steps. (And not at all since turning off system updater and returning to using WiFi AFTER all steps followed) And again, it was fine and dandy for an hour, but back in full swing since then. 

[hmfc4eva]

Hi Salemslady,

Sorry that's got me stumped, I assume it is the same Malware XIAOAN and Smart that is being installed?

Out of interest you do only have one user set up on the tablet? you can check in settings -> users .

I only have 'You (Owner)' and 'Guest'

[SalemsLady]

Yep, me too. I'm pretty good with computers and it's frustrating as heck that even after everything it's still happening. 

Yes, same malware, it downloads the same 4 or 5 things in rotation, smart included. 

Let's hope VM rolls out something soon. -_-

Thanks for trying to help anywho.

[hmfc4eva]

Hi,

It might be worth installing AVG (Free) and running a scan and report the results, 

When I ran it it would find 3 threats  XIONAN, Smart as well as System Update, 

Since I removed System Update and uninstalled the malware mentioned above it now report 0 threats 

(It did still report System Update as a threat before I uninstalled it even when stopped, though I wasn't getting any problems when ir was stopped)

[MC001]

I had another look for dodgy looking packages last night and found these games:

/data/app/com.pgsoul.toponsdk.basketball-1/base.apk=com.pgsoul.toponsdk.basketball

/data/app/com.taieapps.stack-1/base.apk=com.taieapps.stack

/data/app/com.zyxapps.happyduck-1/base.apk=com.zyxapps.happyduck

So uninstalled them. Then found com.roco.autogen - which is mentioned here: NEWS: Android Firmware Vulnerabilities - November 2019 | Kryptowire

Might be unrelated, but binned it anyway - lets see what happens now!