Related
Ok, maybe I'm in the wrong place. But here goes.
My phone is trying to send text to paid numbers behind my back. I'm using prepaid so it doesn't work. I get a "You have insufficient funds to send this text" message daily, at random times.
I have no pirated apps. Everything on my phone came straight from the market. However, I've not installed a single one of the apps that was on the recent list all over tech sites.
I'm planning on reflashing with a different rom and changing all the passwords that were stored on my phone.
BUT.
Before I do this, I want to find out which app is causing this behavior. Any Ideas on how to find out what is sending random text from my phone (they don't show up in the messaging app)
viogrep said:
Ok, maybe I'm in the wrong place. But here goes.
My phone is trying to send text to paid numbers behind my back. I'm using prepaid so it doesn't work. I get a "You have insufficient funds to send this text" message daily, at random times.
I have no pirated apps. Everything on my phone came straight from the market. However, I've not installed a single one of the apps that was on the recent list all over tech sites.
I'm planning on reflashing with a different rom and changing all the passwords that were stored on my phone.
BUT.
Before I do this, I want to find out which app is causing this behavior. Any Ideas on how to find out what is sending random text from my phone (they don't show up in the messaging app)
Click to expand...
Click to collapse
Install a android antivirus and firewall like Lookout.
Sent from my GingerBread Eris using XDA App
lookout finds nothing. All the other AV software fails to install. "Unknown error -18"
i have plenty of free space.
viogrep,
I wrote a novel, but then thought I should just ask a few preliminary questions:
Q1) does the error message contain any useful "hints", such as the destination number ?
Q2) if you use a logcat - capturing app, does anything show up in the logcat right around the time the message is generated which might provide some further clues?
There's a lot of different techniques you can use, but they require a bit of effort - not only to perform, but to explain, too.
Q3) Are you willing to post up the output of the "ps" command to a pastebin?
Q4) What apps on your phone request "SEND_SMS" privileges? You can find out with
Code:
strings /data/system/packages.xml > /sdcard/strings-pkgs-xml.txt
and then poking through the "strings-pkgs-xml.txt" file. When you see (for instance)
name="android.permission.SEND_SMS"
the immediately prior package is what requested it. Either that or you can do something tricky like
Code:
strings /data/system/packages.xml | awk '/<package name/{pkg=$2;}; /_SMS/{print pkg, $2;}'
bftb0
1. No destination number in the error. Sorry.
2. Also, no clues in logcat from what I've seen.
3. PS > http://pastebin.com/iUAfP9Yb
4. Besides the default gapps, the only other app with SEND_SMS priv. is Koxx Pure Messenger. (Purchased from the market, Have had for awhile, the sms sending is new)
Going to try to call my provider and see if I can get the number that's been denied because of funds.
*edit* No luck with provider.
I'd really like to know whats doing it so I don't install the same app once I flash. Luckily I keep nothing important on my phone. Its gmail account is actually a duplicate with my original forwarding to it. I'm a tiny bit overprotective over my email(address). :x
viogrep said:
4. Besides the default gapps, the only other app with SEND_SMS priv. is Koxx Pure Messenger. (Purchased from the market, Have had for awhile, the sms sending is new)
Click to expand...
Click to collapse
I know that it isn't necessarily this simple, but if that really is the only other app besides the GAPPs with SMS priveledges, especially coupled with the knowledge that the SMS capability is new, I think you have your answer.
If you tried a new ROM and restored all but that one app, and the problem never happens again then you can be 95% sure. Only way to be 100% sure is that after a certain length of time without a problem (a week?) you reinstall Koxx and then if the problem starts happening again.
I looked through your "ps" listing.
Didn't see anything too obvious sticking out at me; there were a couple of non-market apps running though. I know that there is no theoretical reason why non-market apps would be malicious - on the other hand, I sort of wonder why they are not on the market... you know what I mean? What is stopping them? (In the case of Tubemate - which was actually kicked off of Google's market, my suspicions are even higher. I realize it was not kicked off because of malware; but still...)
These were the only processes that were either not on my phone, or I didn't really recognize.
Code:
com.dylan.tube = [Non-Market App] Tubemate
com.gau.golauncherex.notification = GO Launcher EX (READ SMS)
com.levelup.beautifulwidgets = Beautiful Widgets (LevelUp)?
com.revsodev.volumecontrol = [Non-Market App] Volume Control (Cyrket?)
com.swype.android.inputmethod = Swype?
com.tencent.research.drop = QQPlayer (no perms req'd?)
net.bajawa.battery = BattStatt (no perms req'd?)
org.sipdroid.sipua = Sipdroid VoIP + video
The Road Warrior has an idea which is sort of useful; but I'll modify it to use binary division.
Start with a freshly installed, clean ROM, and only install half of your apps. (I would put all of your most frequently used apps in the first half, and delay any non-market apps as long as possible). Here's how this goes:
- if the "half" you put on the phone is trouble-free (long enough to know the SMS popup thing is not going on), then, install half of the remaining apps, and wait again to see if there is a problem.
- if the "half" you put on the phone develops trouble, then you know that the problem app is in that group. Wipe the phone and re-install all prior "halves" (that caused no trouble), but split the current half (the group containing the suspect app) in half, and only install that. Proceed in this fashion until you are down to the app which causes the trouble.
If you have 128 apps on your phone, and you wait 1 day between installations, it will take 7 days to find the malicious app. (And if you don't get a failure within the first two days, your phone will have 3/4s of it's apps installed - that's not too bad).
The thing is though, even if you had an app compromise your phone, it might not be an "app" that is doing the dirty work any longer. For example, the most recently discovered malware ran rooting exploits against the device, and once successful, downloaded and installed "other stuff". That "other stuff" could be native binaries. So, examining permissions in the system manifest doesn't necessarily guarantee that you have exhaustively looked at your phone, or discovered all possible means of interacting with the SMS system.
It might be "just an app", though - and if it were me, the first ones that I would suspect are non-Market apps, or apps that *cough* got downloaded from "freeware" sites.
Thanks for the responses. I actually did a fresh flash last night. First thing I installed was tubemate (running through non market apps) and it did it. Ironically I added some money to my account to see if I could get the number it was trying to text. Apparently it still couldn't go through.
Sent from my FroShedYo V10-ERIS using XDA App
I had a game from a Chinese developer that stole my gmail. Log into yours from the website and see if you get a red warning.
Sent from my GSBv1.9 ERIS using XDA App
viogrep said:
Thanks for the responses. I actually did a fresh flash last night. First thing I installed was tubemate (running through non market apps) and it did it. Ironically I added some money to my account to see if I could get the number it was trying to text. Apparently it still couldn't go through.
Sent from my FroShedYo V10-ERIS using XDA App
Click to expand...
Click to collapse
I'm always amazed when something I suggested actually works. LOL. It's just that I'm used to things being more complicated than I hope.
Glad you figured out the trouble!
Thanks bt and RW for the help.
As far as the gmail thing... I use a different gmail address on my phone with email forwarded (different pass)...
If it gets taken I just stop the forwarding and make a new one. Makes things a more simple. Sure, they can see past emails, but they cant request passes/info from other sites... (I also monitor the login IPs in gmail, religiously. Just a habbit.)
viogrep said:
Thanks bt and RW for the help.
As far as the gmail thing... I use a different gmail address on my phone with email forwarded (different pass)...
If it gets taken I just stop the forwarding and make a new one. Makes things a more simple. Sure, they can see past emails, but they cant request passes/info from other sites... (I also monitor the login IPs in gmail, religiously. Just a habbit.)
Click to expand...
Click to collapse
You're welcome. You could just change your password from the web if your phone gets stolen.
Especially since it's the gmail address you use on your phone that everything is sync'd to, not the one that's forwarding to it. So if you got another Android phone you'd lose all your contact info and bought and installed apps info, calendar and such. Unless you sync them manually which is so much harder in my experience.
Or you could use one of the many free apps out there that would let you remotely do many things to your phone. Turn the GPS on, triangulate your phone, make your phone scream, do a factory reset to erase everything...
Just a suggestion.
I am getting an annoying spam/popup whatever in my Chrome browser. It's very deceiving and I've tried restarting Chrome, the phone, clearing cache but it still pops up all the time. It's from "update.appfansworld.com" and gives me an initial message about memory being low or something. Attached is a screenshot. Anyone know how I can get rid of this?
If this is an app.
Go to settings > application manager
Find the system ui upgrade app and uninstall it.
Is it a popup? If so try an ad blocker. Or figure out what site's giving you this junk.
If your user agent string is reporting as android (in Chrome it is) they can tailor ads to look like "updates".
If you get the "memory slowed" message hit cancel or the back button.
Sent from my Verizon NC5 Galaxy S4 w/ GEL and Xposed
Fixed this problem on my phone by going into the App Info for the Chrome App and Deleting All Data. Just had to resign into Google, and it has not come back so far.
Update.... Went one week with no pop up. Got one again from app fans world. Com again last night. Not the UI one though. This one said my browser crashed, which it hadn't. Spent several hours trying to get it to repeat, but it never did, nor did it today. Just as a final check, I ran Malwarebytes, and found only one instance of malware on my phone, but not thinking it was actually malware. It was the root uninstaller file for Smart Ram Booster Pro. I uninstalled the app anyway as I don't really use it. Will give an update on this in a week or so. Looking online, this is becoming a widespread issue.
jakel1.jf said:
Update.... Went one week with no pop up. Got one again from app fans world. Com again last night. Not the UI one though. This one said my browser crashed, which it hadn't. Spent several hours trying to get it to repeat, but it never did, nor did it today. Just as a final check, I ran Malwarebytes, and found only one instance of malware on my phone, but not thinking it was actually malware. It was the root uninstaller file for Smart Ram Booster Pro. I uninstalled the app anyway as I don't really use it. Will give an update on this in a week or so. Looking online, this is becoming a widespread issue.
Click to expand...
Click to collapse
Yeah I tried deleting data in the chrome browser but that didn't prevent it from coming back. I'll look forward to a solution if you find one.
After clearing the data under app info it stopped for a week for me. It was popping up every other page almost before that. Now, it popped up again just once, and I did a couple weeks worth of browsing in a couple hours after it did, just to see if I could get the pop up again to inspect it better, but it just won't come up again. I don't know if it is gone, or will pop up again sometime later. Weird.
I have been following a guy on the Verizon forum dealing with this. He was going to run his phone in safe mode, and try activating one 3rd party app at a time, using Terminal to see if he could find an app that was causing this. That didn't work though as while in safe mode with no 3rd party apps activated, it still happened. He is now going to reset his phone, reinstalling apps one at a time to see if he can find an app causing it. This will take more than a week though, as he will take time to test chrome for awhile after each app is installed. One thing to note is that the app.fansworld.com site was only created 12.18.14. It could be any app you installed slightly before to any time after that date, or even any update installed then. I am almost thinking it is something to do with Chrome, as I don't install anything except from the Playstore, and only a thing or two that I can remember during that time frame. I am going to both uninstalled all chrome updates, and try a different browser, to see if it still happens. If it does, I am going to factory reset my phone, and see if I can fix it.
jakel1.jf said:
I have been following a guy on the Verizon forum dealing with this. He was going to run his phone in safe mode, and try activating one 3rd party app at a time, using Terminal to see if he could find an app that was causing this. That didn't work though as while in safe mode with no 3rd party apps activated, it still happened. He is now going to reset his phone, reinstalling apps one at a time to see if he can find an app causing it. This will take more than a week though, as he will take time to test chrome for awhile after each app is installed. One thing to note is that the app.fansworld.com site was only created 12.18.14. It could be any app you installed slightly before to any time after that date, or even any update installed then. I am almost thinking it is something to do with Chrome, as I don't install anything except from the Playstore, and only a thing or two that I can remember during that time frame. I am going to both uninstalled all chrome updates, and try a different browser, to see if it still happens. If it does, I am going to factory reset my phone, and see if I can fix it.
Click to expand...
Click to collapse
I assumed it was a chrome thing since that's where it always pops up for me. I guess I could try another browser...
I did click on the page (clicking cancel or update does the same thing) as I figured I will be reseting my phone anyway. No matter how many times I click on it, all it does is redirect me to the Dolphin Browser page on the playstore. This makes me really suspicious because the developers of Dolphin Browser wouldn't ruin their extremely good reputation by doing this. I think the redirect is a cover for something else. Maybe a keystroke logger, or something just as malicious. Rolling back Chrome didn't get rid of the page that pops up. No popping up with new browser so far, went with Maxthon, but it is early. Really starting to think a complete wipe and reset is necessary. After all, the pop up is only what we are seeing, what else might be going on we can't.
Quick question... Have you downloaded any (.flv or.m2v specifically) video files during the time frame? Read a recent article about hackers using them to exploit vulnerabilities. Right now it is suggested not to download those 2 file types at all.
Factory reset my phone, which was a small hassle, but it has fixed it, and the other small bugs and slow downs that appeared at the same time. Back up your files... Pics and such you want to keep, and reset. Your phone should automatically re-install all your apps, although you will have to redo some of your settings. After you save your files to wherever you want, I saved them to my pc, just go to settings.. Then back up and restore.... And select factory reset or reset phone, however it is listed. Your phone will then be like brand new, and you will only have to re-set up a few things as most things will reinstall by themselves with their previous settings. Like I said, a small hassle, but it fixes the problem, and you again know your phone and data is secure.
It started doing it again today. Reset didn't work. Talked to the guy on verizon forum, and he is going through all files to locate it's origin. Will just have to wait until he is done. FYI--It started happening in other browsers too.
My daughter in very tech savy and at the same time is starting to take the wrong path as she hits her teen years. I have installed screentime and it let's me remotely view what she view, installs and things like that. But she is smart and figured out a way around that. And she has what seems like to me some google apps that hide messages and IMG in PDF and KLM using email, maps and other apps. I have taken her phone from her but I for the life of me can figure this out. Its like as soon as she logs into an account in android settings it sets it up. And her nexus 5 always has an update ready for download .. While she is still on 4.4 she has always refused to upgrade to 5.1. Anyone know of any apps like this?
It's been like 5 days since I was able to say ok Google with screen off, call ( name here) and the phone would unlock and dial the number, regardless if it was a contact or not.
Now I say ok Google call ( name here) and either the assistant will not respond after opening to make the call, or it goes open and it shows example,
Call circles pizzeria
But it never makes the call.
Now if I using my fingerprint to unlock the device, say ok Google call circles pizzeria, it will make the call.
Want to note, this is not a contact. Also don't matter if it's a contact or not. I've showed 2 examples of ok Google getting "stuck" on the commands.
I've factory reset the device. I'm thinking this has to be on Google's end. Just want to know if anyone else is affected.
So 19 views, and no one quick tested their own device? Gee thanks....
Sent from my LG-H932 using XDA Labs
I don't use Assistant at all (in fact I struggle to keep it disabled on my phone, and Google tries to enable it all the time). So I am one those views, but unfortunately have no experience.
Which OS version are you on? That might affect the results of others who try it.
Does it matter if you're in a Smart Lock situation (Trusted location, Trusted BT device etc)?
Just tested mine. My Google Home took the initiative of making the call, and gave me some tips on my first call that way. This was while my phone was in my hand, too, so I'm not sure why the GH took over, but whatever. In the end, it did dial out... or try to, before I told it to hang up.
Not exactly your situation, so I didn't respond. Mine has nothing to do with unlocking the screen, as I keep my screen unlocked and on Navigation app while driving.
But here's my story...
_________
A few months ago, new Google app update stopped Google Assistant from making the daily phone calls to my wife when I'm coming home from work. (I never know what time I can leave.)
"OK, Google, call (my wife's name)"
Normally automatically dials via Bluetooth through Google Voice.
This time nada, repeatedly -- from trying to show me search results, to not responding at all.
Even tried "OK, Google, call my wife" (instead of her name). Google Assistant: "Who is your wife?" (She's listed in Contacts as my wife, besides her full name.)
Suddenly Google Assistant wasn't performing as previously and also had amnesia.
This happened two days in a row. I had to manually hit a pinned dialer screen shortcut to call my wife while driving home. (Which is technically against the law now in Georgia, touching your phone while driving.)
So, I reverted back to the previous Google app version (downloaded through APK Mirror) -- which does exactly what I need -- and refuse to let it auto update in Google Play Store. I also have Titanium Backup of that specific version on hold, in case Google accidentally updates somehow.
I know I'm now a few months behind in app versions, but I don't have time to mess with trouble shooting. If the version I have works, I'm keeping it.
_______
I have half a dozen apps I also keep from auto updating for similar reasons.
For instance, because of newly imposed Google rules about a year ago, an long time app called My Data Manager has to put an icon on the left side status bar to show it's technically running in the background. On previous versions you could disable that stupid icon or "badge" in the app settings. It's a neat app, because I can merely swipe down and at the bottom of my notifications, there's a pinned box that shows my current data usage. And it's quite accurate. Every time I compare it to my carrier's report of my data usage it's within a few MB.
But I do NOT want to see a CONSTANT icon on my left side status bar for that app. So, I reverted to older version before the Google rules change and it works EXACTLY the way I wish. I unticked "auto update". I've done that for my phone, my wife's and my mom's.
________
I just finished working one month straight, with no days off. Feb 15 - March 13, often 12-14 hour days. In one two week stretch, I worked over 160 hours (4 weeks of work, crammed into 2 weeks.)
So, I'm not putting up with any crap from my phone.
If new app version breaks something, I'm reverting to previous app version and preventing it from updating. At some unknown point in time, if I want to test they've finally fixed what they broke, I will do that when I have free time. Other than that, I need my daily phone to work, period.
ChazzMatt said:
snip.
Click to expand...
Click to collapse
What version of the G app are you on?
Also on EdXposed, or regular Xposed grab sudohide.
You can hide any app from play store.
Sent from my LG-H932 using XDA Labs
BROKEN1981 said:
What version of the G app are you on?
Click to expand...
Click to collapse
See screenshot.
There are at least two apps (that I've noticed) which seem to act strange when I run them again after running them once. The strangeness vanishes if I go into recent apps, swipe the app away, then run it from scratch. I get annoyed at having to do this frequently. Would one of the many background app killers out there achieve the same effect automatically without me having to swipe the app away? Any recommendation for a killer I can restrict to just certain apps? Is there any setting on the s21 to say "never cache this app in memory"?
Claghorn said:
There are at least two apps (that I've noticed) which seem to act strange when I run them again after running them once. The strangeness vanishes if I go into recent apps, swipe the app away, then run it from scratch. I get annoyed at having to do this frequently. Would one of the many background app killers out there achieve the same effect automatically without me having to swipe the app away? Any recommendation for a killer I can restrict to just certain apps? Is there any setting on the s21 to say "never cache this app in memory"?
Click to expand...
Click to collapse
No offense but it sounds like the issue is with the apps and using an app killer to autokill the app is nothing more than band aid. The app killer would be yet another service that will run in the background using up your resources. I think you would be better off contacting the developer and see if they will allow you to submit logcats so they can fix the issue(s). This would help you and potentially help others as well. I would also see if there any alternative apps that can do the same thing.
aybarrap1 said:
No offense but it sounds like the issue is with the apps and using an app killer to autokill the app is nothing more than band aid. The app killer would be yet another service that will run in the background using up your resources. I think you would be better off contacting the developer and see if they will allow you to submit logcats so they can fix the issue(s). This would help you and potentially help others as well. I would also see if there any alternative apps that can do the same thing.
Click to expand...
Click to collapse
The most irritating one is the Chase mobile app. Attempting to contact the "developer" gets me chase customer service who wants to help me reinstall the app. Pleas to forward my mail to the actual developer are met with total incomprehension .
Okay. We might try going deeper here. Did the problem always exist or did it start randomly? If each one was working fine at one point it could be an update from the developer broke Apps. Did it start after an update to the app or the phone Rom?
Did you customize and/or disable the os or rom baked services/apps?
How long have you had the phone? Did you upgrade from android 11 to 12 and do a factory reset? Just some questions to see if there might be other root causes.
Everything is stock with all system updates from samsung applied. I'm pretty sure it started after an app update. The chase app insists "You are not connected to a network", but since I was just on chrome looking at web pages, that seems unlikely. It acts more like the app doesn't clean up everything correctly on exit, then if android keeps it around in memory, it has trash in uninitialized variables when starting back up again. I've gotten pretty good about swiping it away from recent apps, so even if they fix the bug someday, I'll probably keep doing it from reflex .
Have you looked at recent comments for the app on the play store? Are there similar complaints that started around a certain time? That would be a definitive indicator if it was an update issue.
I commented about it and since then 15 people have found my review helpful, so maybe that means they have the same problem.
Claghorn said:
I commented about it and since then 15 people have found my review helpful, so maybe that means they have the same problem.
Click to expand...
Click to collapse
Yeah...that is unfortunate. It looks like you may have to wait on the company and developer to fix it.