Good evening all. I have a sort of complicated, long story but I'm hoping someone here with the knowledge to help me would do me a solid and save me a lot of additional heartache. Over the past several months, I have noticed done strange things in my android phones...3 different phones to be exact. My husband and I were sharing a phone for a while because he destroyed his. I started noticing that I couldn't access certain files...everything was encoded that I didn't recognize so I couldn't read things...Google wouldn't allow me into certain features.....he denies having anything to do with it and calls me crazy. Today I found partitions that are encrypted....apps I can't access....different ports and things of that nature on my phone and I cannot either open the files or read the weird code. It's pictures and contacts and apps he swears he knows nothing about. I'm no developer....far from it. Really, I'm here to find out what is on my phone. I need to see whatever these hidden things are so that I can bring hard evidence to the table....otherwise, he calls me crazy, denies knowing anything and I really can't deal Anymore but I need the proof. Please, someone help me. Thank you.
Can you add a screenshot of what happens when you try to open one of those apps or files?
Related
Sorry to apparently flout the warning about poking my noobish nose in to post about something non-ROM related, but since this is a development and hacking section, I figure I must be in the right place.
I've been googling and futzing around with build.prop to no avail, so I figure I should ask someone with a clue before I go and kill my install or even brick my phone, I dunno.
Is there any sort of hack on this file that tells Play what CPU/GPU/etc you have but also says, I'll be the judge of what's compatible, thanks?
Or is there some other method?
Maybe some folks have started a Play mirror on the sly...? Surely I'm one of millions who are cheesed off about not having any way around this silliness.
Two possibilities, right?
Either there's an answer, or this is an issue which deserves the attention of folks with the talent to address it.
Anyone care to give me a clue which it is?
Well, here's a workaround of sorts: try to find what you're after at mobile.brothersoft.com, where the site simply asks you what your phone is, and lets you save it wherever.
If you want to try another model, don't bother choosing a different one via the site's controls, because the initial drop-downs you identified your phone with are no longer available (instead you have to choose from pages and pages of poorly-identified entries, half of which are missing pics). Just delete your cookies for that site and choose again.
Play told me Google Goggles wouldn't work for some reason; I told the Brothersoft site my Galaxy Mini was a Pop 1559 (pretty similar as far as I can tell), downloaded the app, and bingo.
Now to have a look for all that other stuff Google told me wouldn't work...
...Actually, there's no need to tell the Brothersoft site any lies; it doesn't enforce Google's 'incompatibility' call, or even tell you about it.
Why did it take me so long to come across that joint after searching high and low for a fix? I tried enough angles... seems both obvious and obscure at the same time.
I'm not sure if this should go in QA, here, or software and hacking. forgive me if this is the wrong place. I have posted a few times, and mostly lurk/repeatedly return to xda via googlefu. Well, it's failing me here today.
I work in malware research and removal. I'm not a layman, but I'm by no means a programmer or reverse engineering wizard at all. I can write my own batch files and a good understanding of how devices work as a whole and as parts, and I can figure out just about anything I need to, but these here phones man, stumping me.
In my work, the two biggest tools to quickly isolate what a malicious entity is, where it is, and how it's starting is a combination of process explorer and autoruns. Besides rootkit and MBR infections and some really weird outliers, these give you a straight-shot no nonsense look at everything I need to know.
However, in googlin' for similar bits for phones, I get a pointer to system panel, which while useful, doesn't tell me everything I want to know.
I want to know what applications will start automatically when I kick over something else, enable wireless, etc. I spent two months chasing down slowdown on my phone on-and-off until I honed in on it being winamp. I have no idea why. I don't know if a configuration file got messed up, or if it's interacting poorly with google play music, or lord only knows what and why. (I'm actually kind of tired of winamp's **** on my phone anyhow, after giving play music another shot, it's actually a lot better. Sigh!)
I want to know what tools I need to read up on, what materials I can go over to help me isolate the cause in situations like this. I also know a few folks who have phone issues with ads in the notification pulldown, shortcuts appearing on the homescreen, and etc. Of course, I can review permissions of individual aps for him, but a lot of this looks like the devil to me: I know mywebsearch, myway, mindspark anything, COMPANY_VERSNAME for description, desktop.ini as a running ap etc, random names, signatures, fake sigs that don't verify, etc ad naseam; I know the earmarks of windows enviroment malware, how it behaves, executes, and in general is a ****.
Android however, is a somewhat alien beast. of course I could figure out root, and have had a lot of fun with the device as a whole; it's basically replaced my laptop completely. (droid 4 full keyboard for the win!)
In both cases too, his phone gets hot as hell in his pocket. like almost too hot to touch. Mine gets hot when I listen to music while GPSing (mighta been winamps fault though, I'll see soon)
I'm sure this is high cpu usage, but maybe I am missing something else; something that starts when I plug in a headphone jack that's behaving strangely, or something else.
What I'm saying here, is what I don't know about apps on android could fill a truck. I would LOVE some reference materials for taking my knowledge in general diagnostic work on PCs and translate that over to android.
Hello All!!
Tonight*I was reviewing different YouTube videos and I clicked on one and it started playing one of those ads that you get every once in a while in front of the actual video and all the sudden I saw the screen go blank and I started seeing what appeared to me to be like a dos window for lack of a better definition with some typing scrolling across and it said something to the effect of personal data gathered or something like that and really freaked me out so I pulled the battery & took my sd card out and booted it back up but I'm not sure exactly what the hell that was.
Have any of you seen anything like this?
I'm really concerned because I have a lot of personal and customer data on my phone.Is there anything I can use to scan it to see if something was able to be *installed? I don't think it had enough time to get any information out just in case it was able to install something but it really freaked me out.*I'm a microsoft network administrator but androids are out of my knowledge base.Any information would be greatly appreciated!Regards
ITAdmin said:
Hello All!!
Tonight*I was reviewing different YouTube videos and I clicked on one and it started playing one of those ads that you get every once in a while in front of the actual video and all the sudden I saw the screen go blank and I started seeing what appeared to me to be like a dos window for lack of a better definition with some typing scrolling across and it said something to the effect of personal data gathered or something like that and really freaked me out so I pulled the battery & took my sd card out and booted it back up but I'm not sure exactly what the hell that was.
Have any of you seen anything like this?
I'm really concerned because I have a lot of personal and customer data on my phone.Is there anything I can use to scan it to see if something was able to be *installed? I don't think it had enough time to get any information out just in case it was able to install something but it really freaked me out.*I'm a microsoft network administrator but androids are out of my knowledge base.Any information would be greatly appreciated!Regards
Click to expand...
Click to collapse
It is probably your browser crashed and started to collect crash info to submit to Google. Check if you can disable that or at least you can get a pop up window asking if you want to submit crash data to Google.
Install adaway and you won't get any ads playing on youtube...
Sweet! That makes sense as I have been having issues with my phone. Can't wait for my Saygus V Squared to show up!! That's going to be one great smartphone!
Thanks again for the help. Now I feel better that I didn't get compromised by a virus. Do android phones get viruses by the way? I've read both opinions that they do and don't? ?
Thanks again!
Tom
ITAdmin said:
Sweet! That makes sense as I have been having issues with my phone. Can't wait for my Saygus V Squared to show up!! That's going to be one great smartphone!
Thanks again for the help. Now I feel better that I didn't get compromised by a virus. Do android phones get viruses by the way? I've read both opinions that they do and don't? ?
Thanks again!
Tom
Click to expand...
Click to collapse
Probably didn't get compromised...
Every OS has viruses even linux, but at least on Android you can get under the hood (because it is open source unlike IOS or Windows). Let me give you an example: there are firewalls for Windows/IOS, but they all depend on Windows binaries. Only on Android (because it is based on open source Linux) you can have a firewall with its own binaries, which means that you can really restrict system and still have internet access. Try to disable internet access to system in windows and you won't have any internet access. And once you enable it, all bets are off, because windows can freely communicate with Microsoft servers and who knows what others, which could be exploited by anyone.. So, if you don't want to have viruses in Windows, don't use the internet...
I think that answers the question.
don't even know where to begin to explain the world I live in and this is the best place I can think of or somebody could possibly answer what the hell is happening.. no I will try to keep this summarized and not going to too much detail other than with the technical aspect.. so my girlfriend was going into my phone and I'm sure she was trying to get into everything possible like my Google account Instagram lineapp what'sapp snapchatocrosoft account amazon.account VK, everything... Now I'm sure somewhere along that she synced her phone because obviously a bunch of my files now ended up on her phone making her think that I somehow installed some virus to her phone which now in her mind she feels like if the phone's messing up or if the router is Messing up which my assumption is she was in the router messing around with settings and now she doesn't have internet when she goes to solve this problem she goes out and uses Wi-Fi elsewhere and now when she went back to the house she couldn't go to the Internet service provider website to be able to mess with the settings on the blue curve router from Shaw because her phone was saying she was in the states we live in canada. She's under the impression I've gone to some third party app site that allowed me to get some firmware that her words has mirrored her storage and it was my way of blocking her ability to see twitch and discord because I was obviously hiding that because I was talking I assume with other women on it ...
Alot of the issue started with the fact that I used to play a game called magic Rush and I had shared my account or given it let's say a player that continued on with it.. obviously giving the Google account because it was binded is the email to the account, caused a s*** storm of problems.. password manager was all synced across his device anything he downloaded in his Play store showed up in my history just making it look like I just deleted it.. she feels like I'm hiding files on my computer or my phone because of some of the apps he had downloaded the other guy in Guatemala that I had shared the account with he had a calculator app that was a vault for hiding files like pictures.. she's literally accused me of everything under the sun thought somehow Steam my Steam account was being used to talk to other girls or somehow I was hiding files because she would take a random file from Steam in one of the folders and when she tried to open it with when we are it would just show up like random numeric code complete gibberish and this is why I must have been hiding files I must have been encoding them because I had things like notepad++ and irfanview, she's told me that I've cloned her SIM card and I have a VPN in the states so I can use things like Vox talk or w.e phone app that's just for the states.. I'm on an s10 plus and she's on an s10 so now that we kind of got the Guatemala guy off the account there is still weird s*** going on she went into developer tools on Google Chrome and it looked at the source code when you're looking at the Google activity when you're logged into the account and it had lots of words like null and hidden and she was swearing up and down thinking that this was proof that I was being shady..
Does anyone have any idea what could have possibly moved my files onto her account whether that be through her signing into my Google s*** but I mean yeah she feels like my phone's infected her phone or my computer has infected hers and I think it was just her and experience self somehow enabling it to like share all files I don't know I can't tell you everything she's possibly gotten into but she's clicked on everything a woman could click on oh and side note if you reach this far and you read all this thank you for taking the time because this is a serious issue in my life right now this was also in the beginner or new help thread I will also attach pictures the cheese sent me over the last month or so showing that I was being shady and did some s*** to her phone that I had rooted it or mirrored her storage
BoosieBC said:
don't even know where to begin to explain the world I live in and this is the best place I can think of or somebody could possibly answer what the hell is happening.. no I will try to keep this summarized and not going to too much detail other than with the technical aspect.. so my girlfriend was going into my phone and I'm sure she was trying to get into everything possible like my Google account Instagram lineapp what'sapp snapchatocrosoft account amazon.account VK, everything... Now I'm sure somewhere along that she synced her phone because obviously a bunch of my files now ended up on her phone making her think that I somehow installed some virus to her phone which now in her mind she feels like if the phone's messing up or if the router is Messing up which my assumption is she was in the router messing around with settings and now she doesn't have internet when she goes to solve this problem she goes out and uses Wi-Fi elsewhere and now when she went back to the house she couldn't go to the Internet service provider website to be able to mess with the settings on the blue curve router from Shaw because her phone was saying she was in the states we live in canada. She's under the impression I've gone to some third party app site that allowed me to get some firmware that her words has mirrored her storage and it was my way of blocking her ability to see twitch and discord because I was obviously hiding that because I was talking I assume with other women on it ...
Alot of the issue started with the fact that I used to play a game called magic Rush and I had shared my account or given it let's say a player that continued on with it.. obviously giving the Google account because it was binded is the email to the account, caused a s*** storm of problems.. password manager was all synced across his device anything he downloaded in his Play store showed up in my history just making it look like I just deleted it.. she feels like I'm hiding files on my computer or my phone because of some of the apps he had downloaded the other guy in Guatemala that I had shared the account with he had a calculator app that was a vault for hiding files like pictures.. she's literally accused me of everything under the sun thought somehow Steam my Steam account was being used to talk to other girls or somehow I was hiding files because she would take a random file from Steam in one of the folders and when she tried to open it with when we are it would just show up like random numeric code complete gibberish and this is why I must have been hiding files I must have been encoding them because I had things like notepad++ and irfanview, she's told me that I've cloned her SIM card and I have a VPN in the states so I can use things like Vox talk or w.e phone app that's just for the states.. I'm on an s10 plus and she's on an s10 so now that we kind of got the Guatemala guy off the account there is still weird s*** going on she went into developer tools on Google Chrome and it looked at the source code when you're looking at the Google activity when you're logged into the account and it had lots of words like null and hidden and she was swearing up and down thinking that this was proof that I was being shady..
Does anyone have any idea what could have possibly moved my files onto her account whether that be through her signing into my Google s*** but I mean yeah she feels like my phone's infected her phone or my computer has infected hers and I think it was just her and experience self somehow enabling it to like share all files I don't know I can't tell you everything she's possibly gotten into but she's clicked on everything a woman could click on oh and side note if you reach this far and you read all this thank you for taking the time because this is a serious issue in my life right now this was also in the beginner or new help thread I will also attach pictures the cheese sent me over the last month or so showing that I was being shady and did some s*** to her phone that I had rooted it or mirrored her storage
Click to expand...
Click to collapse
Lol! Seems like you are really under some big trouble...
By the way, did you check if partner sharing in on? And did you add her as a family member to your google account and granted permissions for her account to access yours? Check these first. Google them if you don't know how to...
And maybe prove her that her phone isn't rooted and show her that even Knox in her S10 isn't tripped concluding that you didn't do anything and maybe proving her they might have happened by mistake.
Venkata Lochan Nune said:
Lol! Seems like you are really under some big trouble...
By the way, did you check if partner sharing in on? And did you add her as a family member to your google account and granted permissions for her account to access yours? Check these first. Google them if you don't know how to...
And maybe prove her that her phone isn't rooted and show her that even Knox in her S10 isn't tripped concluding that you didn't do anything and maybe proving her they might have happened by mistake.
Click to expand...
Click to collapse
So I check partner sharing and I believe that's a part of the Google photos side of Google nothing seems to be enabled I also found some other pictures that explain some of my pain I must have been encoding my drive because of the
BoosieBC said:
So I check partner sharing and I believe that's a part of the Google photos side of Google nothing seems to be enabled I also found some other pictures that explain some of my pain I must have been encoding my drive because of the
Click to expand...
Click to collapse
Hmmm. Maybe try proving your innocence by the way I said..
She reads root and thinks ta da, it must be rooted... I explained all that does is allow people to like tweak their phones better sort of like jailbreaking but there's no convincing her of that
BoosieBC said:
She reads root and thinks ta da, it must be rooted... I explained all that does is allow people to like tweak their phones better sort of like jailbreaking but there's no convincing her of that
Click to expand...
Click to collapse
Try proving in a way like using a root checker.
Get some one else's device and show the same root certificates...
This may help.
And did you show her that her KNOX is still intact and it did not trip.? If no, first do it... that way, you could prove that nothing just happened to her device and its still secure and not rooted.
Then maybe you could give her other explanations...
She's going to spin it like this, that I'm somehow rooting her messages like sending them off she also feels a cloned SIM card and thinks I'm just a f****** monster like I'm literally a cat playing with a mouse and torturing the person by watching them squirm with their phone and to be honest I've lost all effort and trying to defend it trying to figure out why when you take a file from Steam and go to unzip it with one RAR it shoots out weird numerical wingding.fonts I explained The Root checker thing to her and she didn't even want to check it meaning that she just doesn't know the right words to explain it to me when she says I may actually get her to come on this thread and f****** explain everything that's happening to her s*** because yeah man it's it's a serious problem
BoosieBC said:
She's going to spin it like this, that I'm somehow rooting her messages like sending them off she also feels a cloned SIM card and thinks I'm just a f****** monster like I'm literally a cat playing with a mouse and torturing the person by watching them squirm with their phone and to be honest I've lost all effort and trying to defend it trying to figure out why when you take a file from Steam and go to unzip it with one RAR it shoots out weird numerical wingding.fonts I explained The Root checker thing to her and she didn't even want to check it meaning that she just doesn't know the right words to explain it to me when she says I may actually get her to come on this thread and f****** explain everything that's happening to her s*** because yeah man it's it's a serious problem
Click to expand...
Click to collapse
Ohh MMAAANNN, this is too much..
Is she still mad at you? first try calming her down. Get another device from your friend or someone else if possible and show her that every Android has such things. If she still doesn't believe, ask her to get on XDA and try a conversation with the XDA senior/staff members about all her doubts...
Try your best.
Know something? These XDA guys are really awesome. They help a lot if required.
She's going to spin it like this, that I'm somehow rooting her messages like sending them off she also feels a cloned SIM card and thinks I'm just a f****** monster like I'm literally a cat playing with a mouse and torturing the person by watching them squirm with their phone and to be honest I've lost all effort and trying to defend it trying to figure out why when you take a file from Steam and go to unzip it with one RAR it shoots out weird numerical wingding.fonts I explained The Root checker thing to her and she didn't even want to check it meaning that she just doesn't know the right words to explain it to me when she says I may actually get her to come on this thread and f****** explain everything that's happening to her s*** because yeah man it's
Bro we've gone to war over this and the f***** up part is right now it's like she's like just admit it and we can get past it... And it's like first off I'm not doing it she thinks that because I used to run a video game back in the day which was a pre-compiled server that I didn't have to do any sort of coding whatsoever other than edit like Lua and XML she feels like I'm this master coder but I'm not.. also I don't have the willpower and determination to learn or care enough to getting into her phone I just asked her to show me what I wanted to see and if she didn't want to show me it then I would have a problem I would not go about the same matter by like hacking her phone... So her she's like well if you're going to keep lying well then I can't be with somebody that's going to keep lying.. well.fk... I am going to get her on here cuz I really would like to figure out what f*** this all up
BoosieBC said:
She's going to spin it like this, that I'm somehow rooting her messages like sending them off she also feels a cloned SIM card and thinks I'm just a f****** monster like I'm literally a cat playing with a mouse and torturing the person by watching them squirm with their phone and to be honest I've lost all effort and trying to defend it trying to figure out why when you take a file from Steam and go to unzip it with one RAR it shoots out weird numerical wingding.fonts I explained The Root checker thing to her and she didn't even want to check it meaning that she just doesn't know the right words to explain it to me when she says I may actually get her to come on this thread and f****** explain everything that's happening to her s*** because yeah man it's
Click to expand...
Click to collapse
Wait, why did you just resend an old msg of yours...? Doesn't make sense
BoosieBC said:
Bro we've gone to war over this and the f***** up part is right now it's like she's like just admit it and we can get past it... And it's like first off I'm not doing it she thinks that because I used to run a video game back in the day which was a pre-compiled server that I didn't have to do any sort of coding whatsoever other than edit like Lua and XML she feels like I'm this master coder but I'm not.. also I don't have the willpower and determination to learn or care enough to getting into her phone I just asked her to show me what I wanted to see and if she didn't want to show me it then I would have a problem I would not go about the same matter by like hacking her phone... So her she's like well if you're going to keep lying well then I can't be with somebody that's going to keep lying.. well.fk... I am going to get her on here cuz I really would like to figure out what f*** this all up
Click to expand...
Click to collapse
First relax, tell her that you will ignore this all first get past it. Later, when every you are free and happy with something, you could explain her everything slowly.... Don't you think this will work out?
I've known for 2 years I've been hacked. Everyone I know thinks I'm crazy because for 2 years I've been convinced that my phone was being controlled remotely even though I've changed devices, profiles, and deleted more apps than I can count. Finally yesterday I dicovered Total Virus Scan and it found this. I've had at least 50 antivirus apps with no success and I was not sure if maybe I wasn't a going crazy. I even would stop using my phone for a month or more at a time because that was the only time I had issues. Whoever is behind this has taught me everything I know about android and hacking by directing me in a way that is hard to explain. I'd just see what they wanted me to do by a random page that would pop up, or sentence highlighted, or other discreet cues. If I have not had 100% accuracy on certain issues I've been informed about by following these cues I would be certain I was crazy but there has been like 50 personal issues I've been informed about by following these cues and not a single time has it been we wrong. Unfortunately I let it consume me for about a year and almost ruined my life because of it and what I've learned has seriously altered my life. Yesterday Total Virus Scan found this Keylogger, 2 Trojan, RAT in OS. How do I remove these from my OS andcatch who is behind this? Attached is screenshot of the 4 issues found. Also on SD Maid it said my device wasn't rooted but had a built-in superuser app. Can't find the screenshot I had of that but had a url of toybox. A bunch of numbers then said [email protected] something. Any help will be much appreciated. Thank you in advance.
Could you try to create a backup of those apps and upload somewhere? Maybe it is possible to check it
Try to uninstall those apps with an app uninstaller
If you are unable to uninstall those apps they might be deeply installed? Ive been under the same situation 4-5years ago
Maybe a firmware reflash would do the job but everything will get deleted so try to backup everything
DrunkTrooper said:
Could you try to create a backup of those apps and upload somewhere? Maybe it is possible to check it
Try to uninstall those apps with an app uninstaller
If you are unable to uninstall those apps they might be deeply installed? Ive been under the same situation 4-5years ago
Maybe a firmware reflash would do the job but everything will get deleted so try to backup everything
Click to expand...
Click to collapse
It's not the apps. From what I've read one of the Trojans, the one in Google framework, is a dropper and reproduces and hides them in legit clean apps. That is why antivirus software doesn't pick them up. I've done at least 100 scan's with every malware finder I can find and this is the first time I have gotten a hit on anything but I know for a fact it's been there for at least 2 years. Everything I know about android whoever this person is taught me. It's almost as if they are a friend because they've directed me to learning about someone close to me who was doing me wrong, taught me everything I know about android and hacking, it's crazy man. I can't explain how they communicate with me all I can say is I will just see it and know. Something highlighted briefly, a random page popping up that directly coorilates with what is happening in my life, but also have tried getting money out of me and removed pictures of my wife from my device. I want to find out if it's someone I know before I remove it. If so, I'm thinking criminal charges and anything else I can do to mess with their life like they have mine. They truly destroyed my life for about 18 months and just now getting everything back together. I don't really talk about it anymore because everyone thought I went crazy but still privately search for the cause and who wmis behind it and yesterday I finally found it. Showed my mother and step son and even with these screenshots they still say I'm crazy and seeing things. Just glad I finally have proof. I can't explain what it's like to have EVERYONE around you saying you are crazy and seeing things that aren't there and knowing you aren't. It really sucks and I wouldn't wish what I've experienced the last couple years on my worst enemy.
EJay80 said:
I've known for 2 years I've been hacked. Everyone I know thinks I'm crazy because for 2 years I've been convinced that my phone was being controlled remotely even though I've changed devices, profiles, and deleted more apps than I can count. Finally yesterday I dicovered Total Virus Scan and it found this. I've had at least 50 antivirus apps with no success and I was not sure if maybe I wasn't a going crazy. I even would stop using my phone for a month or more at a time because that was the only time I had issues. Whoever is behind this has taught me everything I know about android and hacking by directing me in a way that is hard to explain. I'd just see what they wanted me to do by a random page that would pop up, or sentence highlighted, or other discreet cues. If I have not had 100% accuracy on certain issues I've been informed about by following these cues I would be certain I was crazy but there has been like 50 personal issues I've been informed about by following these cues and not a single time has it been we wrong. Unfortunately I let it consume me for about a year and almost ruined my life because of it and what I've learned has seriously altered my life. Yesterday Total Virus Scan found this Keylogger, 2 Trojan, RAT in OS. How do I remove these from my OS andcatch who is behind this? Attached is screenshot of the 4 issues found. Also on SD Maid it said my device wasn't rooted but had a built-in superuser app. Can't find the screenshot I had of that but had a url of toybox. A bunch of numbers then said [email protected] something. Any help will be much appreciated. Thank you in advance.
Click to expand...
Click to collapse
You need to utube Beef, it's a exploit that takes over your browser that's started with script embedded in a web page, text, messenger msg, etx. You may confuse it with malware because the attackers will gain the same info if not more by using social engineering.
remove all google accounts from settings, perform a factory reset, create new google account and check Total Virus Scan again.
You can use same google account just don’t restore data
Arealhooman said:
You can use same google account just don’t restore data
Click to expand...
Click to collapse
I don't recommend this as google account is device administrator, anyone knowing that password can remotely install apps