Sudden battery drain, strange account charges, or strange background noises during a call often indicate that your smartphone is under surveillance. Spyware (stalkerware) can be installed by an attacker to steal passwords, read correspondence, or track location. Ignoring these signals is dangerous, since the leak of confidential data can lead to serious financial and reputational losses.
Modern malicious utilities have learned to perfectly disguise themselves as system processes, which complicates their detection by conventional methods. However, there are a number of specific signs and techniques that make it possible to identify hidden threat and neutralize it. Below we will analyze a step-by-step algorithm for checking and cleaning your device.
⚠️ Attention: If you suspect that a former partner or acquaintance is spying on you, be aware that removing the spy may send him a notification. In such cases, it is safer to first change passwords for cloud accounts from another device.
Analysis of indirect signs of infection
Before proceeding with in-depth technical diagnostics, it is worth paying attention to the behavior of the gadget in everyday use. Case overheating Even in standby mode and rapid battery discharge are the first “red flags”. Malicious apps constantly transfer data to remote servers, which creates a load on the processor and communication module.
It is also worth checking your call and SMS history. Attackers sometimes use your funds to send paid messages to short numbers or calls to premium lines. If you see outgoing calls that you didn't make, this is a warning sign. Sometimes spyware hides its icons, but leaves traces in the application list.
Checking administrator rights and accessibility
In order for a spyware app to run in the background and intercept keystrokes, it requires advanced rights. Most often, attackers activate rights device administrator or access to Accessibility. Without these permissions, the software will not be able to secretly record the screen or intercept messages.
You need to go to the security settings and carefully study the list of applications that have administrator rights. Typically, there should only be system utilities there, such as Find My Device or corporate clients. If you see an unfamiliar name or an application with a dummy icon, immediately revoke its rights.
- 🔍 Go to
Settings → Security → Device administrators. - 📱 Check the section
Accessibilityfor suspicious services. - 🚫 Disable the rights of all applications whose purpose you do not know.
Please note that some malware blocks the “Deactivate” button. In this case, proceed to the next section to use more advanced removal methods.
Spyware is often disguised under names like "System Update", "Wi-Fi Service" or "Google Sync". Check the names with official Google services.
Monitoring traffic and battery consumption
Transferring stolen information requires an Internet connection. Even if the app works economically, it inevitably leaves traces in the traffic consumption statistics. Go to your network settings and sort applications by the amount of data transferred. Suspicion should be raised by an application that you rarely use, but which “ate” megabytes of traffic in the background.
The situation is similar with energy consumption. Go to the battery statistics section. If some application with minimal screen time consumes a significant percentage of the charge, this is a sure sign of hidden activity. Background processes Spyware should not be power-hungry if they are just hanging in memory, but transferring data “warms them up.”
| Option | Normal behavior | Suspicious behavior |
|---|---|---|
| Battery consumption in the background | Less than 2-3% | More than 10-15% without active use |
| Mobile traffic | Complies with your actions | High consumption when Wi-Fi is on |
| Case temperature | Warm under load | Hot in standby mode |
⚠️ Attention: Menu interfaces may differ depending on the version of Android and the manufacturer's shell (MIUI, OneUI, ColorOS). If you do not find the item you need, use the search inside the settings.
Using USB and ADB debugging
If standard methods fail to remove the malware, because the “Delete” button is inactive or the application is immediately restored, you will need the help of a computer. The tool Android Debug Bridge (ADB) allows you to control the device at a deep level, bypassing interface restrictions. To do this, you need to activate developer mode.
Enable USB debugging in the menu For developers and connect the phone to the PC. After installing the drivers and ADB utility, run the command to list all installed packages. This will show even those applications that do not have an icon in the launcher.
adb shell pm list packagesCarefully study the output of the command. Look for packages with names containing words spy, track, monitor or just a meaningless set of characters. Having detected a suspicious package, use the command to forcefully remove it.
Command to remove via ADB
To remove a package, use the command: adb shell pm uninstall --user 0 package name. This will remove the application for the current user without requiring root access.
Dramatic measures: factory reset
In cases where spyware has embedded itself deep into the system or has gained root access, manual removal may not be effective. The only guaranteed way to clear the device is a complete data reset (Factory Reset). This procedure will return the phone to its original state, deleting all user data and third-party applications.
Before performing a reset, it is critical to save important files (photos, contacts) to an external drive or to the cloud, but do not restore a backup copy of applications immediately after the reset. You risk returning the virus along with your data. Recover only personal media files manually.
- 🔄 Go to
Settings → System → Reset settings. - 💾 Select “Delete all data (factory reset) settings). data-i="104">Log out of your Google account
- 🔒 After turning on, set up your phone as a new device without immediately logging into your old Google account.
☑️ Preparing for reset
⚠️ Attention: Resetting the settings irreversibly deletes all data from the phone’s internal memory. Make sure you have an up-to-date backup copy of important documents before starting the procedure.
Preventing re-infection
After successfully removing the threat, you need to reconsider your digital hygiene. The main attack vector is the installation of applications from unverified sources. Always keep the feature Google Play Protecton that scans applications for malicious code.
Regularly change passwords for major services and enable two-factor authentication. This will protect your accounts even if your device is compromised in the future. Also, do not grant administrator rights to applications whose reliability you are not 100% sure of.
The main security principle: never install APK files sent in instant messengers by unknown senders, even if they promise “hacking” or “premium access.”
Can spyware work if the phone turned off?
No, classic software cannot run on a completely turned off device, since the processor and communication modules are not supplied with power. However, there are complex hardware bookmarks or modified firmware that can simulate a shutdown, but this is the level of special services, not everyday espionage.
How can I find out if someone is reading my messages on WhatsApp?
Check the list of active sessions in the WhatsApp settings (item “Linked devices”). If you see an unfamiliar computer or browser there, immediately end this session and change the two-factor authentication PIN code.
Will antiviruses help you find hidden spyware?
Modern mobile antiviruses from well-known vendors (Kaspersky, ESET, Dr.Web) effectively detect most popular Trojans. However, specialized stalkerware often disguises itself as legitimate parental control utilities, so manual analysis of access rights remains necessary.
What to do if the application uninstall button is inactive?
This means that the application has been granted administrator rights. First, go to your security settings and revoke these rights. Only after this the “Delete” button will become active. If this does not help, use Safe Mode or reset the settings.
Is it dangerous to use public Wi-Fi networks after removing the virus?
Yes, public networks themselves are a source of risk. After cleaning your phone, try to use the mobile data or reliable home networks until you are sure that all critical passwords have been changed and the system is updated to the latest version.