How do I remove a hack or a hacker from my Galaxy S9

[Android Central Question]

I have an Galaxy S9 and I think my phone is hacked my locations being constantly turned on by itself my Wi-Fi in my Bluetooth and I think it's an ex cet obsessed with me but she keeps tapping my phone I think she's getting my messages my call's I'm having call logs on my phone that I don't know numbers calling me from everywhere that I don't know and a how do I go about removing this hack

 

[Mooncatt]

For starters, it's hard to hack into someone else's Android phone. Not impossible, but not something an average user could do. So let's look at a couple of your issues.

Wi-Fi and Bluetooth can be turned on and off automatically based on your location, as a way to automate things. I.e. You get home and it turns Wi-Fi on so you don't have to. If you go out, it can turn Wi-Fi off for you, and activate Bluetooth to connect to your car. So go through your settings and look to see if anything like that is set up.

Those unknown numbers calling you are most likely nothing more than spam calls. Robo-spam calls are running rampant right now. Even if you are on a "do not call" list, these scammers don't care about that and will call anyway.

Has your ex ever had possession of your phone? And what do you mean by "tapping" it? Please register an account here to answer and also help us figure out what's going on exactly.

If you still really think you have been hacked, then I would just go the nuclear route. Factory reset the phone (make sure you know your Google login and password, as you will need this to set it up again) to wipe any spy programs from your phone. Next, get a password manager and give it a strong master password that you can remember (I personally recommend Last Pass). Use the password manager to create entries and help you go through all of your accounts to change passwords, giving them all unique, random, strong passwords. While you're at it, turn on two factor authentication where possible.

Hacking these days doesn't have to mean actively interacting with your phone. If they have your login info for Google, Facebook, and other big name accounts, they can wreak havoc from anywhere because so much of our info is now cloud based and synced in real time.

 

[coffee1707]

My husband and I are having the same problem. I've been trying to get help with this issue for months. I've had people tell me I wasn't hacked and made me feel like I was completely crazy. I now have screen shots of a lot of things. To prove I am not crazy.
I have factory reset our phones and before doing so closed email accounts along with the Samsung cloud accounts. When factory resetting our phones we just had to set up a lock code or password whichever one you wanted then when the phone boots back up afterwards I've set up all new accounts. Nothing seems to matter. Because as soon as we are all set up and think finally it's over, then guess again. I'm not sure about rooting a phone but that is next on my list of things to try.
The things that are happening on our phones mainly my husband's phone, is the Hangouts are set up with Pop or IMAP accounts set up where we cannot receive our mail, Google drives, Google pictures and clouds are full of hidden files, Google pay accounts are set up, Samsung links are activity sending links from people in some kind of secret language. There will be things in our clipboard that are just unbelievable.
In files I have read on my phone through file viewer it has how the program is computing. The steps it is taking and the failed steps and then finally the successful steps. I am by no means a computer person and neither is my husband, but over these past few months I have learned a lot. When the program that is on our phones gets a successful hack then there is some kind of coin it collects. If anyone who doubts this and wants to see for themselves, I have nothing to hide and you are welcome to connect with me and see for yourself. But I would say do it at your own risk.
Also I have no internet. We have phone data. Samsung has remotely worked on our phones through the tech support team and their only advice was to get new phones. I have a Galaxy J7 and my husband has a J3 prime.

 

[Rukbat]

1. Don't hijack threads - especially year old threads,

2. See the answer to your later post at https://forums.androidcentral.com/a...e-remove-hack-factory-reset-does-nothing.html.

 

[Desmien D]

For starters, it's hard to hack into someone else's Android phone. Not impossible, but not something an average user could do. So let's look at a couple of your issues.

Wi-Fi and Bluetooth can be turned on and off automatically based on your location, as a way to automate things. I.e. You get home and it turns Wi-Fi on so you don't have to. If you go out, it can turn Wi-Fi off for you, and activate Bluetooth to connect to your car. So go through your settings and look to see if anything like that is set up.

Those unknown numbers calling you are most likely nothing more than spam calls. Robo-spam calls are running rampant right now. Even if you are on a "do not call" list, these scammers don't care about that and will call anyway.

Has your ex ever had possession of your phone? And what do you mean by "tapping" it? Please register an account here to answer and also help us figure out what's going on exactly.

If you still really think you have been hacked, then I would just go the nuclear route. Factory reset the phone (make sure you know your Google login and password, as you will need this to set it up again) to wipe any spy programs from your phone. Next, get a password manager and give it a strong master password that you can remember (I personally recommend Last Pass). Use the password manager to create entries and help you go through all of your accounts to change passwords, giving them all unique, random, strong passwords. While you're at it, turn on two factor authentication where possible.

Hacking these days doesn't have to mean actively interacting with your phone. If they have your login info for Google, Facebook, and other big name accounts, they can wreak havoc from anywhere because so much of our info is now cloud based and synced in real time.

I've been having a similar problem with my phone being remotely hijacked by my ex-wife with help from someone else since she has no knowledge of how to do this and very basic knowledge with computers. I first suspected that I was being hacked when I was typing emails to attorneys for custody case of our daughter. Constantly multiple letters would be typed while I'm typing some no where near the letter I had pressed or even while I wasn't touching the screen of my galaxy j3. This also includes multiple random letters and symbols appearing at the end of the email when I pressed send in gmail. It was after several incidents caused by her and her new husband and this problem starting shortly after sending me a picture of our daughter along with videos of her. Recently a couple weeks ago I was chatting with her brother in Hong Kong through Facebook messenger and someone was altering my messages while I was typing then. I first noticed this when her brother kept asking who some other person with me was and talking to him on my phone when I was alone but in looking at the log I saw that there were statements added to my messages when I was pushing send claiming they were with me at the end of a message I typed telling her brother no 9ne is with me. I've had my camera and video start taking pictures on its own or show video but not recording. Apps would constantly crash with high battery usage. Phone would turn off or reboot on it's own multiple times. I've tried multiple hard resets with holding the power, volume button and home to try getting rid of any malicious software that was put on the phone and did a full removal of all data in my Google, Samsung, Microsoft, and other online accounts including Yahoo and a new Facebook account but it didn't help and my phone was still being hacked. All antivirus and anti malware software I tried couldn't detect it. Some of these apps were panda, malwarebytes. AVG, Kaspersky. Trend micro, webroot, bullguard were some I tried using along with scans from a desktop while the phone was connected through USB cable.

 

[SLoW503]

Unfortunately this cant be removed with security apps for malware or viruses if you went thru what I did. It was someone accessing my device thru a port that was open and allows them to use your device and monitor it.

There is actually many ports and apps people use from our carriers themself meant for parents. But sometimes phlsychos and ex can do this. I went to my account or my carrier to disable allow port access. Then it helps a bit but I think it was too late for me. But using an app to monitor network usage or memory can be a good warning sign for future use.
Hope you can get yours solved.

 

[Mooncatt]

I've been having a similar problem with my phone being remotely hijacked by my ex-wife with help from someone else since she has no knowledge of how to do this and very basic knowledge with computers. I first suspected that I was being hacked when I was typing emails to attorneys for custody case of our daughter. Constantly multiple letters would be typed while I'm typing some no where near the letter I had pressed or even while I wasn't touching the screen of my galaxy j3. This also includes multiple random letters and symbols appearing at the end of the email when I pressed send in gmail. It was after several incidents caused by her and her new husband and this problem starting shortly after sending me a picture of our daughter along with videos of her. Recently a couple weeks ago I was chatting with her brother in Hong Kong through Facebook messenger and someone was altering my messages while I was typing then. I first noticed this when her brother kept asking who some other person with me was and talking to him on my phone when I was alone but in looking at the log I saw that there were statements added to my messages when I was pushing send claiming they were with me at the end of a message I typed telling her brother no 9ne is with me. I've had my camera and video start taking pictures on its own or show video but not recording. Apps would constantly crash with high battery usage. Phone would turn off or reboot on it's own multiple times. I've tried multiple hard resets with holding the power, volume button and home to try getting rid of any malicious software that was put on the phone and did a full removal of all data in my Google, Samsung, Microsoft, and other online accounts including Yahoo and a new Facebook account but it didn't help and my phone was still being hacked. All antivirus and anti malware software I tried couldn't detect it. Some of these apps were panda, malwarebytes. AVG, Kaspersky. Trend micro, webroot, bullguard were some I tried using along with scans from a desktop while the phone was connected through USB cable.

That sounds more like defective phone hardware than hacking. For example, a damaged screen or even a bad USB cable can cause erratic screen touches.

There is actually many ports and apps people use from our carriers themself meant for parents... I went to my account or my carrier to disable allow port access.

Yes, those parental apps exist, but you would have to explicitly allow one to be installed. If you did not approve an app installation, then the only way it could be put on your phone is if someone else had unfettered physical access to it.

Also, please explain in more detail how you disabled port access, as that's not something I've ever heard of on phones. Even on PC's, it's not done on any account level. Ports are blocked/allowed at the PC itself.

 

[SLoW503]

No you dont. You can push install apps thru playstore and many other ways even sprint. Then use that remote restart from carrier, or lookout, or whatever your anti theft software is. How do I know this? It happened to me. Found out what it was and I reported such a security issue to them and samsung last month. And look what happened to samsung, sprint and now capital one? I am so willing to bet of they just patched it none of that would have happened.

If you dont understand open ports then obviously you never done networking. Open your router and check your ports. On a phone use adb shell cmd it will show. Websites have ip and can have ports connected you. And simply put parental control on carriers have access. Outlook has restart access playstore can push installs while you sleep and you dont even know it then restarts you never woke up wondering why you phone is asking to re enter password? You be surprised how bad someone can mess with your phone service with just you imei number and access to you account.

So best thing is ask your carrier to see if you have like a live support app if something was wrong with you device. If they say yes like a one care. Then usually you can turn that off in your account preferences on your carriers.you have to opt in or out when it is asked for help with device. Let me check that later and show a bit tired sorry its almost 6am.

 

[Mooncatt]

The only way the Play store can push apps to your phone is if someone has access to your Google account. If that's happened to you, that's in large part your fault for having such weak password management (the chances of a data breach at Google and then someone you know finding your specific info on the dark web is almost non-existent). I suggest you read up on this and do a better job of locking down your accounts.

https://forums.androidcentral.com/showthread.php?t=899430

Even IF something like that got on your phone via Play, a simple factory reset would wipe it. Apps that survive a factory reset are malware and not even available on Play.

As for the open port issue, you weren't even sure how you closed them. I'm not saying it's impossible to control at an account level, just that I've never heard of it and wanted clarification as to how.

But, as been said, if you still think you're being hacked and followed, go to the police. It is possible (usually through simpler ways like gaining physical access to the device or just social engineering), but most of these stories are just too fantastical to believe. Heck, some claim to have basically created an entirely new online identity but still think they are hacked for some reason. Very, very few people in the world are of that kind of importance for a hacker to go through the trouble needed for that.

 

[SLoW503]

It's been a few months but yeah it was sprint complete app. Which I was chatting with sprint techs to try to fix an issue on my phone at the time but they couldnt and told me I could just go swap my phone. Which sucked cause it was my s8+ I only had for like a week.

To do remote connections you only need their ip address and a known port that is open that's why phishing and keyloggers that get installed thru malware is so dangerous especially on mobile devices. They are still new and lack real security and task management to even clear our cache going into recover mode is a pain.

In this case if it's an ex wife or something they probably already know your info can pretend to be you add the feature and mess with you. Those notifications can be turned off on your carriers site too and manage who has the number that's the parent and change things in the account.

I did this in the past to make my nephews get off their phones and go sleep. I even made it one time receive call and text only and said. Tell Bigg Daddy you are sorry lol

But anyways the whole entire connect to another device isnt actually that hard to do unnoticed. With the lack of software monitoring that on phones. You know like when you have a home network and shared folders locally the other person can take those without you knowing they just copied your info. The main problem that I see is allowing some things in apps and web browsers.

For this person they may have to go into apps and check special permissions and disable the permissions manually for each that can control wifi, bluetooth, gps, and whatever else they want disabled. But if you do that mine as well limit data usage and refuse background usage to also help with battery life and performance.

You didnt see the part of him saying an ex? And no your wrong theres a big security flaw on the samsung pie how else did those companies get hacked? Think about it. Even I caught someone trying to install malware on my device a few times. That information I cant share with you due to TOS with samsung reward program and bugcrowd aggreement.

There is plenty of ways people can access your info certain apps have security issues too those get targeted by hackers along with people that do web browsing and dont have proper security set up or go to a unsecure site. Tons of ways you can get hacked but more like keylogged for them to steal info hacking is different then simpl_ sending a trojan or script to harvest data. And yeah it happens just companies and corporations dont want that to leak because bad rep.

For him I suggest calling his carrier if he thinks his ex is doing I was referring to that part but got into fun tech talk now I am gonna have a rough day at work. Kudos and good night.

You only need to make an algorithm and script to send to one person and it spreads to others they share networks with and so on that's why it sucks when the last issue with samsung wasnt fixed and affect sprint. And I am willing to bet capital had that issue too which is why they disable certain feature on their mobile app. I would try to ask figure out why samsung and sprint both say it's no big deal but had to shut down and do major maintenance on their websites last weekend. Its just a pain. And alot hackers that do this stuff are usually young kids and college students that get bored and like to troll people unfortunately.

 

[Mooncatt]

To do remote connections you only need their ip address and a known port that is open that's why phishing and keyloggers that get installed thru malware is so dangerous especially on mobile devices. They are still new and lack real security and task management to even clear our cache going into recover mode is a pain.

Yeah, no. Android is very secure.

https://www.computerworld.com/article/3411440/android-security-scares.html

Phishing is easily caught with even basic protections. Browsers can alert you to possible phishing sites, don't open random email links, visit sites directly via your bookmarks or manual URL entry, never give out personal info to unsolicited calls, etc. Key loggers would not be able to install without you making several major blunders as well, as evidenced by the article above.

Regarding account level access, the owner can set up a pin/passkey that the carrier must verify before making any account level changes. Anyone else attempting to do so must be an authorized "manager" (what Verizon calls it, other carriers may differ) and also know the PIN to do so.

Data breaches are different, and nothing you can do about it to prevent it. That's why it's always been good security protocol to change your passwords about every six months or so to minimize the damage.

When it comes to Android, the amount of effort needed to get into your phone is more than the average person is willing to go through unless you've left some gaping holes in your own security measures. Besides, if someone is going through that effort, they certainly wouldn't be dumb enough to make it so obvious that you've been hacked.

 

[Mitzi Suhuck]

Someone actually hacked my phone last October and I do believe it was before October. I contacted FBI, got IP addresses and screenshots of pictures someone hacked into my Moto z3, my accounts, my, my girl laptops and even WiFi. Someone locked me out of my phonei had to replace the phone. When I use Google websites I can browse or Google, but can't sign in or leave comments. I have to use Firefox app on my phone. Thankful for Firefox app that I found and got copied of someone got into my g mail. Someone changed all my emails passwords while I changed. Google and Verizon McAfee are not very good services. They allowed someone kept getting into my new email address. This is my 6th email address since October. I changed my new number and hopefully he never know my new number. I've been tugwar with Verizon, and they said they didn't see anything wrong. My goodness. I believe one of my neighbors that moved in a few blocks away from me. I even walked over and knocked the door, he refused to answer the door. I hope IP addresses will help to track down. Believe it or not, someone changed wifi from sagecom to Netgear program. I really need to find out what my phone required to have. I've been looking through the apps, some look strange, but not sure. Know what package installer is? Hopefully to solve my phone problem and get rid of hacker.

 

[belodion]

Know what package installer is?

A normal and important System app.

 

[Mooncatt]

Someone actually hacked my phone last October and I do believe it was before October. I contacted FBI, got IP addresses and screenshots of pictures someone hacked into my Moto z3, my accounts, my, my girl laptops and even WiFi. Someone locked me out of my phonei had to replace the phone. When I use Google websites I can browse or Google, but can't sign in or leave comments. I have to use Firefox app on my phone. Thankful for Firefox app that I found and got copied of someone got into my g mail. Someone changed all my emails passwords while I changed. Google and Verizon McAfee are not very good services. They allowed someone kept getting into my new email address. This is my 6th email address since October. I changed my new number and hopefully he never know my new number. I've been tugwar with Verizon, and they said they didn't see anything wrong. My goodness. I believe one of my neighbors that moved in a few blocks away from me. I even walked over and knocked the door, he refused to answer the door. I hope IP addresses will help to track down. Believe it or not, someone changed wifi from sagecom to Netgear program. I really need to find out what my phone required to have. I've been looking through the apps, some look strange, but not sure. Know what package installer is? Hopefully to solve my phone problem and get rid of hacker.

I would direct you to my last reply right above yours, and additionally suggest you talk with a local shop or someone you trust to go over your issues. For example if your Google login info was changed, you never would've been able to access it through Firefox or any other service. It sounds more like you're not understating some of how internet related tech functions, and you need someone to get their hands on it to see exactly what's going on. The stuff you're describing here makes no sense, and thus not something we could offer much help with.

I'll give you this, though. The "Package Installer" app is the app that installs, updates, and uninstalls other apps. Without it, you'd not be able to install anything, not even from the Play store. It is a benign system app that you should ignore. In fact, I would suggest ignoring all of those strange looking system apps. This kind of paranoia leads to users trying to uninstall anything that looks even remotely obscure, and will screw up your phone. If you really think something is suspicious, Google the app name and you'll usually find the info on it quickly.

 

[Mitzi Suhuck]

Guys. Thank you for replying back to me. I just discovered that my Gmail account was signed out by someone. I managed to get get my Gmail account to recover. I really need to look through the apps see if something is hiding I uninstall. I do not know what kind of app did someone install. I'm not fan of sitting on the chair and look through the phone which is such waste my time. Will read the rest after my phone is charged

 

[Mooncatt]

I really need to look through the apps see if something is hiding I uninstall. I do not know what kind of app did someone install.

Unless you specifically installed an app from questionable sources (random pop-up's, email spam, pirated apps, etc), you likely have nothing to worry about on that front. If being signed out of gmail is your big concern, that could be done remotely or even simply timed out as a security precaution from the Google servers. Are you getting any sort of error messages or notices of sign in attempts that you didn't initiate?

 

[Mitzi Suhuck]

Hi there.
My battery rocket while charging then now it draining fast. Something isn't right. Someone managed to signed me out of my Google account again. Been like this since. All our devices inside the house hacked. I tried to reset and factory reset my girl Nintendo 3DS XL, but said I'm not authorized even for our laptops. I don't understand how internet work? I've never use Firefox on my phone until October 30 or 31 I looked through Google account history I saw "embedded in*" under google.com I went look up Google website what it really means? I still don't understand so I asked a friend of mine explained me what it means. Someone suddenly deleted history and didn't want me to get screenshots of history. To be honest I'm not that technical whiz, but hacker taught me a lot. How can I get rid of someone that still attached to my phone?
Thanks so much for your time
Happy Holidays

 

[Mooncatt]

Hi there.
My battery rocket while charging then now it draining fast. Something isn't right. Someone managed to signed me out of my Google account again. Been like this since. All our devices inside the house hacked. I tried to reset and factory reset my girl Nintendo 3DS XL, but said I'm not authorized even for our laptops. I don't understand how internet work? I've never use Firefox on my phone until October 30 or 31 I looked through Google account history I saw "embedded in*" under google.com I went look up Google website what it really means? I still don't understand so I asked a friend of mine explained me what it means. Someone suddenly deleted history and didn't want me to get screenshots of history. To be honest I'm not that technical whiz, but hacker taught me a lot. How can I get rid of someone that still attached to my phone?
Thanks so much for your time
Happy Holidays

I'm still not convinced that you have a hacker going after you, as you are all over the place with your claims. Only in the movies will a hacker single out a specific person and somehow get into every device like you are claiming. Not to mention a lot of what you're claiming is easily explained as normal behavior.

For example, batteries wear out. That can explain the apparent rapid charge/discharge. I've personally abused one and wore it out in about 6 months, so it can happen even on a new phone. I've already explained a possible reason for the sign outs. Your browser history (if using chrome) is tied to your Google account. If that's signed out, your history can go as well.

As for that "embedded" comment, care to upload a screenshot showing where you saw it? No telling what it means by your description, but I'm guessing it's benign as well.

 

[Mitzi Suhuck]

Hi mooncatt,
Thank you for letting me to be part of this forum group.
I'm sorry I didn't explain clearly. When "embedded in*" showed up I went to look at the Google and asked what it means. I went back to my Google account history app it disappeared. I couldn't see or find someone signed me out. I kept signing back in. I decided to find different browser app, that's Firefox that came to my mind. I went sign my Gmail account and through Firefox. Bingo. I saw someone used different phone to sign in and signed me out. At this point I have screenshots. But for embedded in I've not screenshot because of someone deleted it. I witnessed my own eyes. I'm with the other girl saying someone hacked her phone. So is mine still going on.

I just look through half way of apps. What is "hide" app have to do with? I didn't recall downloading "hide" app.

What is "key chain", "Android Easter egg" apps are for? I looked through and found this 2 weird apps. Anyone knows what those are for?

 

[Mooncatt]

What phone is this? I don't know what those other apps are, but every manufacture has their own naming for their system apps. Everything, and I mean everything, on your phone is ran by or as an app. That's why you're seeing so many seemingly obscure ones. Package Installer for installing apps. SIM toolkit for interacting with the SIM card. Apps for controlling settings, widgets, network connections, you name it.

Fyi, Android Easter Egg is just that. Google puts special little drawings, animations, games, etc hidden in the phone. So of course this too requires an app to see.