Malware adding code to ga.js opens up random ads/websites? A friend of mine just handed me his tablet saying that everytime he open a webpage the browser redirects to several advertisement page (or, it "adds" advertisements on the page).

This happens both on Chrome and the stock browser.

I used USB debugging to look at the browser request and I think I found the culprit. When the browser loads http://www.google-analytics.com/ga.js the actual code is different. See this screenshot (the green line is where ga.js should
terminate):



(and the added code goes on...)

I initially thought that some malware changed the hosts file and assigned a different IP to the google-analytics website, but this is not the case since when I visit the above link directly I see the correct JS code.

How can I track which app is doing this?
I've encountered the above situation yesterday.
After lots of digging, got to this thread, and it led me to the solution.

Apparently, that one of the computers on the network I've visit, was exposed to a malware that modified the router settings.
The router was a D-Link 2760U/E with default  Admin / Admin login details.

Using the above credentials, the above malware has changed the "static routing tables" adding their servers to be a man in the middle.
All non SSL traffic had passed through their service which injected js into the page.
I've found  a GitHub page who shows the modifications and additions.

It took me a while to understand that all the traffic is coming from a DNS change attack - I have checked and verified that the computer is totally clean and no unknown process / services are running before and while the test.

One of the things they have done is to redirect all google-analytics.com traffic to their server, keeping them under the radar.

So how to resolve it:

Quick way:

Reset you router to factory settings - note it will erase all existing settings.

Long way:


Login into the routers web UI
Remove all unknown entries from the static routing tables
Change your login password for the router
Reboot your router.


I hope this post will assist someone.

Regards, 
Liron