Detecting hidden surveillance of a smartphone causes concern for any gadget owner. Modern technology allows attackers or jealous partners to install undetectable spyware that transmits audio, messages and geolocation to third parties.
Fortunately, the operating system Android provides a number of built-in tools and commands to identify and neutralize the threat. In this article, we will analyze in detail the methods of cleaning a device, starting from simple USSD codes and ending with professional commands via ADB (Android Debug Bridge).
It is important to understand that there is no universal “magic button”, since viruses are constantly mutating. However, the comprehensive approach described below will help you regain control of your personal space and ensure data confidentiality.
Primary diagnosis and indirect signs of infection
Before entering complex commands, you need to make sure there is a problem. Spyware consumes device resources, which often manifests itself in changing the usual behavior of the smartphone. If you notice that the battery is discharged in a few hours, although it previously held a charge all day, this is the first alarm signal.
Pay attention to the heating of the case in standby mode. Active processes of recording a microphone or transmitting data via GPRS/3G/4G create additional load on the processor. It's also worth checking your mobile operator balance: a sharp increase in Internet traffic costs without changing your usage habits may indicate a data leak.
Check the list of installed applications. Spies often disguise themselves as system utilities with neutral names like System Update, Wi-Fi Service or simply have a transparent icon. Go to Settings → Applications and carefully study the entire list, especially those apps that do not have a “Delete” button or that require administrator rights.
⚠️ Attention: Some advanced viruses hide themselves from the regular list of applications. If you suspect an infection, but do not see unnecessary apps, proceed to the following sections using diagnostic codes.
Using USSD codes to check forwarding
One of the easiest ways to detect interception of calls and messages is the use of special service codes. Attackers often set up forwarding of your calls to their number in order to listen to conversations in real time or receive their recordings later.
Open the standard “Phone” application and enter the code *#21#. This command displays the status of conditional and unconditional forwarding for voice, SMS and data calls. If an unknown phone number is indicated in the fields opposite the items “Voice”, “Fax”, “SMS”, then your communications are being redirected.
To disable all types of forwarding, use the universal reset command. Enter ##002# and press the call button. The system should confirm that all redirection settings have been successfully removed. This action is safe and does not affect your personal files or contacts.
After entering the reset code, restart the phone so that the changes take effect completely and the network settings are updated.
It is also useful to check the forwarding status if the subscriber is busy or unavailable. The code *#67# will show the number to which the call goes if you do not answer the phone. Attackers can use this channel to listen to an answering machine or voicemail.
Commands to detect debugging mode and hidden services
Many surveillance apps require enabling developer mode and USB debugging for their operation or installation. Checking this parameter is a critical diagnostic step. Enter the code in the call menu ##8255## (if supported by your model) to launch test mode GTalk Service Monitor, which can show active connections.
A more reliable way is to manually inspect the settings. Go to section Settings → System → For Developers. If this section is active and item USB Debugging is turned on without your knowledge, this is a serious cause for concern. Disable this switch immediately.
There is also a code ##4636##that opens the testing menu. Here you can view phone usage statistics and battery information. Anomalous activity in the "Uptime" column or unexpected battery drain in this menu can confirm the presence of hidden processes.
adb shell pm list packages -3This command, executed through a computer, displays a list of all third-party applications installed on the device. Third-party packages are often the source of spyware. Compare the resulting list with what you see in the phone settings.
Deep cleaning via ADB and command line
If standard methods did not help, you need to use the developer tools ADB. This method allows you to remove applications that are not removed through the interface, or find processes hidden from the user. To work, you will need a computer with drivers installed Android SDK Platform-Tools.
Connect the phone to the PC with a cable. First, you need to temporarily enable USB debugging on your smartphone (if you are confident in the security of your computer) or use wireless debugging methods if the device is already rooted. At the computer command line, enter the command to log into the device shell:
adb shellOnce logged in, you can use the command pm list packages to display all packages. To find a suspicious application, knowing part of its name (for example, spy, track, monitor), use the filter:
pm list packages | grep spyHaving detected a virus package (for example, com.evil.tracker), you can force stop it and delete it with the command:
pm uninstall --user 0 com.evil.tracker☑️ Preparing to work with ADB
⚠️ Attention: Be extremely careful when deleting packages via ADB. Removing system components (for example com.android.phone) can lead to network inoperability or a complete blocking of the device (bootloop). Delete only those packages in which you are 100% sure.
What to do if ADB does not see the device?
Make sure that the file transfer mode (MTP) or charging only, but with debug confirmation is selected on the phone. Try a different USB port or cable. Some models (for example, Xiaomi) require additional permission “Install via USB” in the menu for developers.
Resetting settings and removing administrator rights
The most radical, but also the most effective way to get rid of any wiretapping is a full reset to factory settings (Hard Reset). However, before this, it is necessary to deprive the malicious application of device administrator rights, otherwise the reset may not proceed correctly or the virus will be restored from a backup copy.
Go to Settings → Security → Device Administrators (the path may differ depending on the version Android). Uncheck all unknown applications. If some application does not allow you to uncheck the box or the button is inactive, this is a sure sign of a virus. Try deleting it through safe mode.
To enter safe mode, hold down the power button on the screen, and then hold your finger for a long time on the “Turn off” or “Reboot” item (depending on the firmware). After confirming loading in safe mode, third-party applications will not launch, which will allow you to safely remove the spy through the standard application menu.
| Cleaning method | Efficiency | Complexity | Risk of data loss |
|---|---|---|---|
| USSD codes (##002#) | Low (forwarding only) | Low | No |
| Delete through settings | Medium | Low | No |
| ADB Commands | High | High | Minimum |
| Factory reset (Hard Reset) | Maximum | Medium | Full (without backup) |
After revoking administrator rights, perform a hard reset. Go to Settings → System → Reset → Erase all data (factory reset). This process will remove all applications, including hidden viruses, and return the phone to its original state.
Full reset is the only way to ensure that you remove rootkits and deep-rooted viruses that masquerade as system ones processes.
Prevention and protection against re-infection
After successful cleaning, it is important to take measures to prevent the situation from happening again. Never install applications from unknown sources. In the security settings, the ban on installing APK files from browsers and instant messengers should be activated, except in verified cases.
Regularly update the operating system Android and applications through the official store Google Play. Developers are constantly closing vulnerabilities that are exploited by spyware creators. Install a reliable antivirus from a well-known vendor, for example Kaspersky, ESET or Dr.Weband conduct a full scan once a week.
Be careful with granting permissions. If a simple flashlight or calculator requests access to your microphone, contacts, and geolocation, this is a clear sign of malicious intent. Reject such requests and delete the application.
⚠️ Attention: Menu interfaces and item names may differ on different phone models (Samsung, Xiaomi, Pixel, etc.). If you cannot find a specific item, use the search inside the settings using the keywords “Administrator”, “Reset” or “Applications”.
Change all passwords for your accounts (Google, social networks, banks) immediately after cleaning the phone. Perhaps the attackers have already managed to intercept your data before the virus was removed.
Frequently asked questions (FAQ)
Is it possible to listen to a phone without installing applications?
Yes, theoretically this is possible through vulnerabilities in cellular communication protocols (SS7) or through IMSI-catcher (false base stations), but These are tools of the intelligence services and are very expensive. In everyday life, 99% of wiretaps are carried out precisely through installed malicious applications or the redirection setting.
Does resetting the settings remove the virus forever?
In the vast majority of cases, yes. However, if the virus has received root access and is registered in the system partition (which is rare for ordinary spies), it can survive. In such cases, flashing the device is required.
How to find out who installed wiretapping?
It is almost impossible to find out using phone commands. You can only see the number to which the call is forwarded. To identify the identity of the attacker, you will need to contact law enforcement agencies and conduct a digital examination.
Does airplane mode help against wiretapping?
Enabling airplane mode breaks the connection to the network, so the transmission of data and audio in real time stops. However, the app itself remains on the phone and will continue to work once you turn off airplane mode. This is a temporary measure, not a solution to the problem.