Signature-based detection has an obvious weakness against adware: the families rebuild constantly. A new package name, a new signing key, a slightly different payload, and the app is "unknown" again. Meanwhile the user is still getting a full-screen ad every few minutes.
While building Impossible Adware Remover we ended up leaning on a much simpler signal: which app is putting windows on top of the screen, and how often.
The signal
An adware pop-up has to become the foreground window to be seen. On Android, an accessibility service receives window state changes along with the package name of the app that owns the new window. Most of those events are boring: the launcher, the app the user just tapped, the keyboard. Adware stands out because it takes the foreground when the user didn't ask for it, repeatedly, often right after unlock or on top of another app.
So the core logic isn't a database lookup. It's bookkeeping:
- Track which package takes the foreground, and in what context (user launched it, or it appeared over something else).
- Ignore the expected ones: launchers, the current foreground app's own windows, system UI, the keyboard.
- When the same package keeps appearing over other apps without being launched, flag it. In practice about two pop-ups is enough.
Things that complicate it
- Wrapper apps. Adware often lives inside an app that also does something useful, so the package name looks legitimate. Behaviour doesn't care what the app is called.
- Delays. Many families wait days before the first ad, which defeats "uninstall what you installed today" advice but not a watcher that's always on.
- Fighting back. Some adware throws windows over the uninstall dialog itself. We added a short-lived shield that keeps the system uninstall confirmation on top while the user decides.
- Notification ads. Ads delivered as notifications are a different channel; there you can see which app posted, but not (and you shouldn't read) the content.
Privacy constraints we kept
The service only needs package names and timestamps. It never reads screen content, takes screenshots or performs taps, and it never uninstalls anything itself: it opens Android's own uninstall dialog and the user confirms.
Signatures still help
Behaviour catches the unknown; a signed list catches the known before they show a single ad. We publish ours openly: the Android adware list covers 470 apps from published campaigns plus 98 confirmed adware builds, with a JSON download for anyone who wants to use it.
Top comments (0)