I had bought a used phone from a friend and was facing issues like password changes and media leakage as shown by my other friends

so I scanned using antiviruses like Malwarebytes,Kaspersky,lookout, dr web etc, but it came clean so I then flashed it along with factory reset(only factory reset didn't remove it)i think it's gone, is there any way any way to confirm this? (I think It's a malicious rom that my friend flashed)

But afterwards I think I somehow got reinfected and the above symptoms persist even after I started all services from new accounts

I am running an redmi android 7 so exploits exist, can this be detected and patched? Does it matter if my phone is unlocked if exploits come into play?

I suspect it is either ransomware/stalkerware and I'm getting infected just by visiting a friends profile on Pinterest(suspicious)/Twitter (sus)/Spotify link(clean)

I tried to scan the links using virus total but only got one low suspicious warning saying wiper ransomware seems far fetched but it's the only lead I have so far I did report it but they later confronted me about it, how did they know about me reporting it?

How do I detect malware on lower level partitions where antiviruses cannot reach like system partitions, recovery, bootloader and etc? I know only know of I want to know the source of infection if there is one

What are all the reinfection possibilities other than me doing something obvious?

  • Patching old Android versions is not really practically. Vulnerabilities in the kernel may be patchable, but vulnerabilities e.g. in the Bluetooth soc drivers are a big problem. Also Google does only patch vulnerabilities in recent AOSP versions (I think at the moment 10+) so older versions are unmaintained.
    – Robert
    Dec 12, 2023 at 18:07
  • that's too many question marks, is the device even infected, what is the malicious exploit, is it vulnerable on locked bootloader, is bootloader even locked, did you flash firmware or just ROM?
    – alecxs
    Dec 13, 2023 at 21:46
  • @alecxs Sorry for being all over the place i think whole fastboot rom is the firmware Dec 14, 2023 at 8:45
  • Instead of device malware, have you considered the possibility that the account is compromised, and they're exploiting the cloud-sync password vault and media backup?
    – Andrew T.
    Dec 17, 2023 at 10:53
  • @AndrewT. Yes I've tried making Google account from scratch on the device and use that account for everything else but its still the same could you please enlighten me though I tried cleaning the drive too Dec 17, 2023 at 18:43

1 Answer 1


Once you have flashed it and factory reset it, then it can no longer be infected. Also, if Kaspersky and MalwareBytes can't find anything then

  • Either there is nothing to find
  • Or your so called friend is a super genius.

If you are getting re-infected then

  • You are not running a decent virus scanner
  • Or you are installing suspect apps or visiting dodgy sites.
  • 1
    You forget that there are exploits that work without user interaction. For example in baseband (infection via SMS) or Bluetooth. Also on some versions a simp!e saved files can case an infection as it is processed by Androids media store service.
    – Robert
    Dec 12, 2023 at 18:02
  • As far as I know antiviruses don't scan the recovery/bootloader/system partition where i think the malware resides I am assuming that the phone was flashed with a malicious os, so to detect these conditions was my question My friend is not a super genius I think he bought the malicious program from a company that does these stuff What exactly do you mean when you say I'm not running a decent scanner I tried Kaspersky, Malwarebytes etc as you mentioned, if not what else do you recommend? Thanks for the answer. Dec 13, 2023 at 12:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .