• After 15+ years, we've made a big change: Android Forums is now Early Bird Club. Learn more here.

Think my phone is hacked

If you think someone has access to information on your phone, 9 times out of 10 its your Google (gmail) account that's been compromised. Either from sharing credentials, forgetting about an old device that was logged in or by having a weak password.

First thing I'd do is to change your Google password and enable 2-step verification. Then, to make sure there's nothing malicious on your phone, a factory reset would be a good idea. (after you've backed everything up, of course.)
 
zygote64 is the 64-bit initialization process for Android. Did you just see it running or did you get a pop-up asking for root permission? If the first, then yeah, you need it. If the second, it could be from some mods like xposed framework or something nasty.
 
I'm thinking it has root but I'm not sure how it was obtained as I don't recall ever seeing anything asking for permission. I've tried several times to hard reset and my phone continues to behave in the same manner.
 
Well if it's a system process it should have root access. What, if anything, is it doing that has attracted your attention?

And to go back to the start, why do you think your phone may have been hacked? If it's something innocent it will save you a lot of time and worry if we can determine that now, but we can't without information.
 
Am I allowed to post bug reports on here?

I used the system dump menu and copy several of the logs to my SD card. This is one of several that it produced.
 

Attachments

  • Screenshot_20180812-051709_Log Viewer.jpg
    Screenshot_20180812-051709_Log Viewer.jpg
    317.4 KB · Views: 388
  • Screenshot_20180812-051702_Log Viewer.jpg
    Screenshot_20180812-051702_Log Viewer.jpg
    309.8 KB · Views: 357
  • Screenshot_20180812-051654_Log Viewer.jpg
    Screenshot_20180812-051654_Log Viewer.jpg
    271.9 KB · Views: 335
What exactly in that log makes you think your phone was hacked? I don't see anything in there that looks out of the ordinary. Granted, sometimes log files can be a bit daunting to slog through because they will record a vast quantity of information that the user never sees, but just because it looks like there's a lot going on behind the scenes, it doesn't mean you've been hacked. It's just that for any given app or process there *IS* a lot going on behind the scenes.
 
Last edited:
A lot of the apps on my phone have quite a bit of permissions. Here are the permissions that the BEAMING SERVICE has and I never allowed any of them. To me they look a little too extreme for what the app is intended for. There are at least a few on my phone that appear to have similar capabilities

What exactly in that log makes you think your phone was hacked? I don't see anything in there that looks out of the ordinary. Granted, sometimes log files can be a bit daunting to slog through because they will record a vast quantity of information that the user never sees, but just because it looks like there's a lot going on behind the scenes, it doesn't mean you've been hacked. It's just that for any given app or process there *IS* a lot going on behind the scenes.

It's not the quantity of information that's displayed but the content and timeframes in which those process appeared to have taken place.

Can anyone help me out with this

I found a file inside a folder that was hidden titled 'wiatrace' it mentions both my Samsung note 8 and also my kindle fire. Is there any reason this should be taking place. I'm confused as to how my HP laptop should have any mention of my phone or tablet.
 

Attachments

  • Screenshot_20180812-210525_Settings.jpg
    Screenshot_20180812-210525_Settings.jpg
    110.1 KB · Views: 544
  • Screenshot_20180812-210539_Settings.jpg
    Screenshot_20180812-210539_Settings.jpg
    109.8 KB · Views: 393
  • Screenshot_20180812-210549_Settings.jpg
    Screenshot_20180812-210549_Settings.jpg
    114.8 KB · Views: 308
  • Screenshot_20180812-210555_Settings.jpg
    Screenshot_20180812-210555_Settings.jpg
    104.4 KB · Views: 318
  • Screenshot_20180812-210606_Settings.jpg
    Screenshot_20180812-210606_Settings.jpg
    103.8 KB · Views: 518
  • Screenshot_20180812-210616_Settings.jpg
    Screenshot_20180812-210616_Settings.jpg
    113.6 KB · Views: 402
  • Screenshot_20180812-210621_Settings.jpg
    Screenshot_20180812-210621_Settings.jpg
    101.9 KB · Views: 580
I still don't see anything that would indicate you've got malicious activity going on. That file 'wiatrace' is a log file from Microsoft for the WIA (Windows Image Acquisition) services. Since both your Note and your Fire tablet have cameras, it makes sense that if you've ever connected them to the laptop, they'd show up in the logs.
 
Back
Top Bottom