Forgive me if this is a simplistic question, but I can't figure out what's going on with my phone.
I have an app that tracks my data usage and gives me a breakdown of which apps are using the most data. Recently, an app called MyFlare has appeared on the list and it's using quite a bit of data. I went to uninstall it, though....and I can't find it. It's not in the general apps list, it's not in the application settings menu under "all apps" and I can't even find it if I do a file search on "MyFlare." This has me really concerned that I inadvertently downloaded something harmful. I've run several scans through Lookout and that has not turned up anything malicious, but I'm still worried.
I think Cox communications has an app called MyFlare that's some kind of photo backup or something. I use Cox for my internet and may have downloaded the app when I first signed up with them, but it's not on my phone anymore.
Could someone help me figure out if I downloaded something malicious and how to remove it quickly?
Can you post a screenshot of this issue
That would be greatly appreciated
Sorry for the delay, here are the screenshots.
In the first, you can see that myflare is using quite a bit of data:
But in the second picture, that app doesn't appear in my apps list....
(I'm posting from my phone and it said that the pictures uploaded, but if somehow they didn't, I'll re-upload when I get back to my computer)
Related
Hey All,
Im sorry if this was asked before but I didnt see it and none of the keywords brought anything up for a phone only for a computer.
I know there is a too called sktools, which tracks images of before and after app installs, but I was wondering is there is such a thing as a monitoring program, such as I think its called process monitor for a computer?
I am trying to see if there is such an app that can kept a log in text of what the phone does as apps are called to load and function, my hopes is to narrow down calls that the app is making in real time so to find possibly sdome solutions to a common modding of files and apps, aka htc messaging msg loading.
If there isnt one, could someone make one? And if there is one, can someone provide me a link since I couldnt hit it with my searches?
Thanx.
Hello Everyone,
As you know, when you have multiple apps that can fulfill the same function Android asks you to choose one as the default. My problem is, if I choose one other than the built in Android app (like "Browser") it will lose it's setting after reboot. I've tried searching the forums for a solution but most of the threads deal with how to clear the default app setting and don't deal with how to make the default app settings permanently stick. I've tried apps like "Default App Manager" but after reboot it still resets. Can anyone suggest a solution to this issue? Thanks.
are you checking the checkbox on the bottom that says "Remember my Decision" (well something like that) when asked which action to do? you gotta check that dude..
Yes, I have been doing that! That of course was the first thing that I did: Check the box to remember and than click on the app. That's why I find this behavior so strange. I notice this was happening on both the R800a build that came with the phone, and the new .368 rom that I just loaded. Note that I also made it a point to keep these programs on the phone memory rather than the SD card, but it still makes no difference.
Same problem here...
at least don't nag.. was just trying to help
Sorry, to sound like I was nagging on you. I just assumed the obvious but I should have clarified that in my original post.
Try using different alternative apps. Like opera or dolphin for browser
Sent from my R800i using XDA App
Hi Cat,
That's what I'm doing, but the problem is when an app requires the browser to be opened it will ask for me to choose an app. I check the box at the bottom and then click on Opera. This will be remembered by android as long as I don't reboot the phone. The minute I reboot the phone it will forget what I set and ask me to choose a default app again. This is quite annoying.
Did you edit your build. Prop?
Deleted any system apps?
Sent from my R800i using XDA App
I only froze things like facebook etc. and have the problem of reconfirming default actions again and again. Someone suggested to make Sure replacement microsd should have same volume name like PHONE CARD or whatever original was. I,m not at my pc so cannot check if that fixes it. Hope it helps
Sent from my Sony Tablet S using Tapatalk
Sometimes if you are getting Force-Closes, the system will reset the "Default" action for that intent if the intent failed with a force close of an app. Are you getting many FCs?
*shrugs* Past that, not sure what would be causing it. Maybe another app?
Hello everyone,
Since the beggining of this week, I'm experiencing a weird and suspicious event.
My wifi icon shows up like if I was downloading something 24/7 (please see the attached picture)
Seems like some app keeps using my wifi to send/receive data (could be a trojan ?).
I want to know your thoughts about this knowing that I rebooted both my phone and rooter several times already.
Thanks.
Hey dude,
That's normal. Most times bloatware is running as a back process on the phone. It also depends which apps you've got. Like news apps or if your Facebook or Twitter is active. Don't worry about it, I would say.
Sent from my GT-N7100 using xda premium
Dea7h said:
Hello everyone,
Since the beggining of this week, I'm experiencing a weird and suspicious event.
My wifi icon shows up like if I was downloading something 24/7 (please see the attached picture)
Seems like some app keeps using my wifi to send/receive data (could be a trojan ?).
I want to know your thoughts about this knowing that I rebooted both my phone and rooter several times already.
Thanks.
Click to expand...
Click to collapse
If you are worried about Trojans do a search on Play for one of the free security software. A good one will scan and show you suspicious apps you need to evaluate and possibly remove. Good luck
Best way to find out is root and use Android Firewall. It is free and useful. You can block and just check logs to see what is sending traffic.. and where.
Thanks for the answers guys
It does look like some heavy working app because It takes ages before a normal website loads.
@Beowulf_pt : that's exactly what I'm looking for, cheers !
You really need to look at what you have runing in the background and decide if you want all of it turned on. There is a lot of things that are on by default that you may not need like auto updates for apps. They will be checking to see if there is an update and use your bandwidth even if there is no update available.
Dea7h said:
Thanks for the answers guys
It does look like some heavy working app because It takes ages before a normal website loads.
@Beowulf_pt : that's exactly what I'm looking for, cheers !
Click to expand...
Click to collapse
It could be google instant upload / picasa (check your Google Account sync settings) or Dropbox Camera Upload (check dropbox app settings).if you have those enabled that could be the cause. I'd guess they're the most likely culprits in this case.
Hy,
anyone saw that the new gallery update brings "Browse your photos and videos in the cloud" functionality?
Now I sure dont see any option for this but at night I got a notification from Coud that "duplicates has been deleted"...
I dont know where I can find this features, but I sure dont want any photos/videos uploaded to cloud without my permission... So if anyone have any info on this, I would really appreciate it.
Best regards
X2
I have an htc one m7 that I just updated to the latest version, after a reboot it shows the same message "gallery cloud" duplicate... etc
It didnt ask for my permission, I have the htc sync disabled, cant seem to find the option to disable this POS. Not happy.
I just noticed this morning the same behavior. I am trying to find out where this service is coming from, why it is running without my permissions and why it is putting my personal information in the cloud somewhere and I don't know where or how to get it, shut it off, or change it. It has really pissed me off to no end. I am hoping someone has an idea.
Just came here looking for the same answer.
A bit of a **** move if HTC is uploading peoples pics without asking first!!
I've emailed HTC via the play store app and asked how do we turn this feature off. I'll post if I get an answer...
Chiming in. just saw this, not pleased. I'm thinking of disabling the app till a solution is found.
I might bin it too, don't want this feature using up my data allowance...I've got about 4000 pictures on my phone...
yea wtf
Same issue. my phone keeps giving me a Cloud Gallery notification every 10 minutes or so saying it deleted duplicate photos. What in the world HTC was thinking, we may never know. But they need to let us turn this off because I show it using my data. Not cool HTC.
To add to it, I open my gallery and its cycling through all of my photos. Constantly. I click a folder, then the 'highlights' starts fast-cycling through every single photo in the folder. Not like a preview as it used to (which was annoying). This needs to stop. As someone else mentioned, I also have thousands of photos on my phone and this is driving me nuts.
CrazyCypher said:
Hy,
anyone saw that the new gallery update brings "Browse your photos and videos in the cloud" functionality?
Now I sure dont see any option for this but at night I got a notification from Coud that "duplicates has been deleted"...
I dont know where I can find this features, but I sure dont want any photos/videos uploaded to cloud without my permission... So if anyone have any info on this, I would really appreciate it.
Best regards
Click to expand...
Click to collapse
HTC Cloud Gallery does not upload any of your files to the cloud. It only indexes whatever you have on Dropbox, GDrive, FB, Flickr, only after you have agreed to link to those sites. If you see photos found by Cloud Gallery, those could be uploaded by Dropbox or GDrive automatically. You need to check their settings. Again, Cloud Gallery is a "read only" indexing service.
Started getting the same notification since the last few days -- and the worst part is that there doesn't seem to be a setting anywhere in the gallery app or in the system settings allowing to configure this "Cloud Sync" or turn it off all together.
And now I really don't know if my pictures got "synced" somewhere in someone's cloud Really annoying. Uninstalled the gallery app altogether with Titanium Backup root uninstall.
adri72 said:
Started getting the same notification since the last few days -- and the worst part is that there doesn't seem to be a setting anywhere in the gallery app or in the system settings allowing to configure this "Cloud Sync" or turn it off all together.
And now I really don't know if my pictures got "synced" somewhere in someone's cloud Really annoying. Uninstalled the gallery app altogether with Titanium Backup root uninstall.
Click to expand...
Click to collapse
I have the same issue. Haven't found a solution yet but I wanted to let you know that freezing/uninstalling gallery will stop the cloud syncs but there are side affects.
I froze it and all seemed normal until I tried to set a contact image. Freezing gallery somehow disrupted the ability to link images to contacts. I tried it from within the contact app and through a third party gallery app and it wouldn't work either way. I had to defrost the HTC gallery in order to set the contact image.
There maybe other side affects but that was the only one that I ran into.
My phone was infected with stalkerware, they had access to my files, could view what was on my screen, listen into my mic, view my cameras remotely, everything! It's incredibly creepy! From what I can tell they somehow loaded q hacked version of Google Chrome and or android web viewer. After getting suspicious I downloaded Kaspersky and ran a scan, I found 2 versions of Google Chrome on my phone one of them had the dual messenger app icon on it. The other one said it wasn't a current version from the apps store. I Uninstallerd and downloaded the current version through the app store. I tried to see if a packet sniffer would lead me to them but I think I was too late by that point. I also pulled the Chrome app qnd decompiler it. There was some weird things in there like ignore playstore version but nothing that I could find that would lead me to who was watching me. Is there anything I can still do that will lead me to who did this? I have a strong idea of who it was but need evidence so I can prosecute them. Any help would be appreciated. Im putting up a 500 dollar bounty if anyone can help me get some solid evidence.
dangerruss said:
My phone was infected with stalkerware, they had access to my files, could view what was on my screen, listen into my mic, view my cameras remotely, everything! It's incredibly creepy! From what I can tell they somehow loaded q hacked version of Google Chrome and or android web viewer. After getting suspicious I downloaded Kaspersky and ran a scan, I found 2 versions of Google Chrome on my phone one of them had the dual messenger app icon on it. The other one said it wasn't a current version from the apps store. I Uninstallerd and downloaded the current version through the app store. I tried to see if a packet sniffer would lead me to them but I think I was too late by that point. I also pulled the Chrome app qnd decompiler it. There was some weird things in there like ignore playstore version but nothing that I could find that would lead me to who was watching me. Is there anything I can still do that will lead me to who did this? I have a strong idea of who it was but need evidence so I can prosecute them. Any help would be appreciated. Im putting up a 500 dollar bounty if anyone can help me get some solid evidence.
Click to expand...
Click to collapse
Try logging into your Google account from a computer. Look at what devices have access to your account. I looked at mine a couple of months ago and saw a phone I never owned on AT&T. Funny thing is I have NEVER had AT&T. I've always and still have Verizon. I immediately removed, blocked and reported the device.
HyperChick said:
Try logging into your Google account from a computer. Look at what devices have access to your account. I looked at mine a couple of months ago and saw a phone I never owned on AT&T. Funny thing is I have NEVER had AT&T. I've always and still have Verizon. I immediately removed, blocked and reported the device.
Click to expand...
Click to collapse
That was the first thing I tried. Didn't find anything unfortunately. These a holes are good.
dangerruss said:
That was the first thing I tried. Didn't find anything unfortunately. These a holes are good.
Click to expand...
Click to collapse
Did you run a log of your IP addresses?
HyperChick said:
Did you run a log of your IP addresses?
Click to expand...
Click to collapse
Not until after the connection was severed. My first thought was to run a virus scan. The only thing I found was an application was installed feb 1st and the clean version of chrome stopped uploading on Feb 1st.
Why are there two of these? And how did they use dual messenger to install doubles? I've disabled all of them.
dangerruss said:
Not until after the connection was severed. My first thought was to run a virus scan. The only thing I found was an application was installed feb 1st and the clean version of chrome stopped uploading on Feb 1st.
Click to expand...
Click to collapse
Did you delete the corrupt Chrome already? The IP history may be in there...
you wish to find your IP address Internet history, you can easily do so directly from your Internet browser.
Step 1
Open your Internet browser, and click on "Tools" located in the horizontal menu bar at the top of the window.
Step 2
Click on "Internet Options"
Step 3
Click on "Settings" located beneath the "Browsing History" subheading.
Step 4
Click on the "View Files" button to find your IP address Internet history.
If you post the chrome apk that you dumped or anything else that you have that was related to the "infected" files, they might be helpful in looking for clues.
These are the apk files that I suspect could have been infected. Unfortunately I didn't pull them until after they were updated. But I believe there is still a change log kind of manifest if you decompile them.
On mobile? Im not seeing those options
HyperChick said:
Did you delete the corrupt Chrome already? The IP history may be in there...
you wish to find your IP address Internet history, you can easily do so directly from your Internet browser.
Step 1
Open your Internet browser, and click on "Tools" located in the horizontal menu bar at the top of the window.
Step 2
Click on "Internet Options"
Step 3
Click on "Settings" located beneath the "Browsing History" subheading.
Step 4
Click on the "View Files" button to find your IP address Internet history.
Click to expand...
Click to collapse
From what I can see, those apks unfortunately appear to be normal un-tampered files. The manifest I believe you are referring to is a component of the apk that dictates things like permissions and interfaces, but it does not perform any sort of logging or historical record sadly, as the entire apk is replaced when an app is updated or installed over an existing installation.
I am not sure how much cleaning you have done of your device since it happened, but aside from clues or records which might be available from various services you use (finding connected accounts that aren't yours, history of any account activities that weren't initiated by you, etc), your next best bet would probably be to dig through the files on the device in search of anything that shouldn't be there. Hopefully there is still some artifact of the infection which could potentially point towards its origin. I will follow this thread, happy to dig through files in my spare time.
Does anyone know if android keeps a log of installs or qnything in the root folder perhaps?
Isn't there a relation between duplicate app instances and secure folder?
OnnoJ said:
Isn't there a relation between duplicate app instances and secure folder?
Click to expand...
Click to collapse
Yes but I've never set up secure folder. Never felt a need to.
First thing I do is a factory reset (and hope that gets it) and reset the Google password.
Keep that bloody device 100% isolated from your PC and data backup copies including the SD card*. Wipe the SD card in the device before the reload and again after the reload. Do NOT connect the card or phone to your PC before the new load is proven clean. Load data directly to SD card from the PC then to the 10+ just in case.
Try to piece together when and what did it but that is a secondary concern. Consider it a drill.
Better get while the gettings good... that level of being compromised means no time to lose ditching the OS. I most likely wipe the SD card too and use one of the clean data backups I keep for just such an event. Torch all data on the device.
If it gets into your backup data copies you're boned.
OSs are 100% expendable, critical data is not.
*you can scan it with everything on the planet and still miss trojans, tainted jpegs/pngs, etc if no definitions exist yet. Expect multiple hidden infections now and go full nuke.
Isolating the infection to that device is only priority. It's possible the infection(s) are already on one or more backups and/or your PC. That's why it's important to keep multiple time staggered backups on multiple electronically isolated hdds.
I keep a 3 tier backup and my PC is never internet connected.
Keep your head and limit the spread...
dangerruss said:
Why are there two of these? And how did they use dual messenger to install doubles? I've disabled all of them.
Click to expand...
Click to collapse
looks normal to me. Those are typical apps that run when dual account messenger service is used .