Is this something to worry about? System app/user labelled "root"

[thanksforreading]

Hey, I've had my network and laptop hacked before (last year). I'd noticed my phone behaving weirdly but was unable to locate an app that I could link to that. I'm able to see the app/user "root" when I look through the app "NetGuard". I'm unable to see this in other places as far as I'm aware. I've got screenshots but unsure how to upload those.

Could you help me out? Is this nefarious, or am I paranoid?

 

[B. Diddy]

Welcome to Android Central! You have to register in order to upload a screenshot: http://forums.androidcentral.com/ge...ide-how-post-screenshots-android-central.html

It's actually very difficult to get hacked on Android, as long as you follow common sense:
“I’ve been hacked” - Android Forums at AndroidCentral.com
[GUIDE] How To Avoid Malware - Android Forums at AndroidCentral.com

Please register on this forum, which will allow you to engage in discussion more easily, as well as post images. https://forums.androidcentral.com/ask-question/409154-join-android-central-community.html

 

[thanksforreading]

Posted earlier about checking if im rooted

Hey, sorry. I made an account so I can discuss and post pictures too.

BDiddy replied I think.

I'm sure you're used to paranoid posts etc, and I understand that - but my network was genuinely accessed, and my laptop too. That's not a debate as such (just so you have context of my situation)

The android question is related to a system app/user named "root" which I was able to see on an app called "netguard". I wondered if anyone can help me troubleshoot this as to calm me or help me assess my situation.

In any case, how do I upload screenshots on this website? I can show you some things that worried me if that helps. I'm using Android 13.

Any help/talking sense into me would be greatly appreciated. Thanks a lot.

 

[B. Diddy]

I merged your threads together, and made you the owner of the original guest post to make it easier for you to find.

I don't doubt that your laptop and network got compromised -- Windows PCs (and to a lesser extent, Macs, if that's what you have) are much more susceptible to malware than Android. But it's still worth mentioning that Android devices are much less likely to get hacked.

The instructions to post an image are in the link in my previous response.

My instinct is that the "root" you're seeing is only a system term, and doesn't mean anyone gained root access to your phone. I'll see what else I can find out about NetGuard.

 

[B. Diddy]

I installed NetGuard on my Samsung Galaxy A32 5G (from T-Mobile), which I use without a SIM, set it to show system apps, and I saw the system app called "root" as well. It's normal.

 

[rvbfan]

It is very much normal, some apps/ system apps need root access to install updates that sort of thing.

Sent from my Pixel 6 using Tapatalk

 

[thanksforreading]

Hey, sorry for the spam posts - not used to this forum setup.

I attached a couple of images, I appreciate you guys checking if the root app is normal.

When it comes to this overlay error, is that just a settings issue then? I found it weird that there was no named app when it did this.

So I reached out to the people I know who had accessed my network, and pc, and said this is weird. Then it just suddenly stopped. Again, not sure if I'm paranoid or that's coincidence.

Does this look odd to you guys?

 

[thanksforreading]

Thanks a lot, I appreciate you doing that. I posted some pictures below too about a screen overlay issue. Again, I've heard that's problematic often anyway but not sure.

 

[B. Diddy]

Display Over Other Apps (previously known as Screen Overlay) is a common special app access permission (in Settings>Apps>Special App Access). It can be used for a number of things -- read this: https://techforesta.com/display-over-other-apps-feature-not-available/

I'm not sure why Brave browser would need to do that. Maybe it's related to a feature to autofill passwords? You could always turn off that permission and see if it affects anything.

I'm also not sure what the "" means -- I'm guessing the system is just glitching a little when trying to report what Brave is displaying over. But again, I don't think this is malicious at all.

 

[thanksforreading]

Interesting. I'd turned it off for brave and all the apps on the device - those settings I mean. The "" was what I thought was weird especially.

It doesn't just happen on brave for example, it's happened on several apps.

In any case, thanks, and I'll go check it out with someone in person to be sure if I can't get it out of my head.

Easy to get paranoid when stuff like that has happened I guess but I appreciate your message

 

[B. Diddy]

Go to Settings>Apps, and see if any apps show up there with only an icon and no name. If not, then select the Show System option and see if any system apps show up with no name.

 

[thanksforreading]

Hey - none there at all. In either apps or the system ones. Would that be a good sign?


Sorry for the late response.

 

[B. Diddy]

Hey - none there at all. In either apps or the system ones. Would that be a good sign?


Sorry for the late response.

I'm not sure if it means anything one way or another.

Are any of the apps reported as displaying over "" system apps or preinstalled apps? If so, see if it still happens in Safe Mode. What phone do you have?

 

[thanksforreading]

I'm not sure if it means anything one way or another.

Are any of the apps reported as displaying over "" system apps or preinstalled apps? If so, see if it still happens in Safe Mode. What phone do you have?

It's happened over bromite browser, brave, Reddit and discord - worth noting the people I had issues with were from those platforms.

I've had it in safe mode, and not noticed it, but it seems to be sporadic now. It happened once today, and a couple times overall this week. Also, I haven't had it in safe mode a lot to notice I guess. I've spent less than 1% of my time during this in safe mode.

Whereas last month it happened every day, frequently. It's when I click the bottom left button to switch between open apps that it appears. After I mentioned it - it just stopped.

I'm using a OnePlus 9 Pro.

 

[B. Diddy]

Are you using a 3rd party launcher, or just the stock OnePlus launcher?

 

[J Dubbs]

It's happened over bromite browser, brave, Reddit and discord - worth noting the people I had issues with were from those platforms.

I've had it in safe mode, and not noticed it, but it seems to be sporadic now. It happened once today, and a couple times overall this week. Also, I haven't had it in safe mode a lot to notice I guess. I've spent less than 1% of my time during this in safe mode.

Whereas last month it happened every day, frequently. It's when I click the bottom left button to switch between open apps that it appears. After I mentioned it - it just stopped.

I'm using a OnePlus 9 Pro.

Is that a NetGuard warning? It looks like it. And I also noticed you're using the free version... a lot of those antivirus apps can give weird warnings about things that are confusing and off base, that's why they're not usually recommended. I use Brave Browser on multiple devices (I'm using it now) and have never had any overlay issues of any kind... it's a solid app.

I would suggest trying something else besides NetGuard, or maybe nothing at all. It's extremely hard to get your Android phone truly hacked unless you do something blatantly unwise... and you sound pretty careful

 

[thanksforreading]

Nah it's unrelated to netguard - I was just using that to monitor the network (I only downloaded it a few days ago). There's never been any antivirus apps on here until after the fact.

Alright - thanks a lot for the help. I appreciate it. I'm going to go elsewhere IRL and check it out in person with someone.

-thanksforreading.

 

[thanksforreading]

Are you using a 3rd party launcher, or just the stock OnePlus launcher?

Just for reference - I've made absolutely no modifications to this phone. I hadn't used 3rd party app stores, clutter apps from the playstore, or anything like that at all.

I didn't see that particular message - sorry.

Thanks for the help.

-thanksforreading