1

Today I was on my computer and I had my phone (Samsung Galaxy S2 X) sitting beside me. All of a sudden the screen on the phone came on and instead of it showing the lock screen, it went directly to the home screen and a little message appeared at the bottom saying "Sending...". This happened a couple more times and then stopped.

I have ran both a AVG and avast! virus scan of my phone and both came up empty.

I'm wondering if I should be worried if something like this happened or is it something else? What I don't understand is how it just went straight to the home screen without having to unlock it. There's nothing in my text messages or emails to suggest it was being used for spamming. My guess is that it was just an app sending usage statistics or something? Any ideas?

  • What I don't understand is how it just went straight to the home screen without having to unlock it. -- It's a program already having access to inside of your system. Why would it have to unlock then? It has nothing to do with unlocking physically because unlocking is meant to restrict access of humans solely. E.g.: Airdroid app when accepting connection from PC browser bypasses any unlocking authentication (pin,pattern,slide,password,etc) and will show a dialog box to select Agree or Deny. – Firelord Mar 23 '15 at 10:08
3

If that is a malware, it will take care to leave no tracks (i.e. deleting the sent message).

Two things you should do ASAP:

  1. Contact your provider and check what messages where sent. Especially expensive "Premium" messages. It could be something sends "just spam", but it also could be some "money generator".
  2. Check with a permission checker what apps have the permission to...
    • send SMS/MMS
    • deactivate your lockscreen (aka keyguard)

If you find an app that has both permissions, that's a very likely candidate. A good app to check this is e.g. RL Permissions, which lets you check by app and by permission:

RL Permissions: Apps by permission RL Permissions: Permissions by app
RL Permissions: Apps by permissions / Permissions by app (source: Google Play; click images for large variants)

As RL Permissions has not been updated for more than 2 years, an alternative to this is Permission Explorer, which offers similar features:

Permission Explorer: Apps by permission Permission Explorer: Permissions by app
Permission Explorer: Apps by permissions / Permissions by app (source: Google Play; click images for large variants)

Once you've identified a suspicious app, deactivate or uninstall it. Watch if the described behaviour continues. If it does not, you've got the culprit.

One more lesson learned: Just having some AntiVirus on your device doesn't mean you're safe and don't need to care. Those "checkers" mostly compare with a database of known malware. Unlike their PC companions, they don't do heuristic scans.

  • Thanks! I checked with my carrier and there doesn't seem to be any unusual text messages that were sent. There also doesn't seem to be any apps that I can see were being used for malicious activity. – ub3rst4r Apr 22 '13 at 18:40
  • That's good news! I already wondered why a malware app would do that in a so obvious way. But still I'm curious what app does unlock the phone to send something. Did you find any app with the DISABLE_KEYGUARD permission which could do that? – Izzy Apr 22 '13 at 18:51
  • I found lots of apps that have that permission but none look suspicious.... – ub3rst4r Apr 22 '13 at 21:42
  • OK, so no need to worry it seems. If you want to figure out what's going on despite of that, you might want to capture your logs using e.g. aLogCat (which also allows you to save your capture to SDCard for e.g. posting it to pastebin and adding a link here so we can help you investigating). – Izzy Apr 22 '13 at 21:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.