1

My Samsung Galaxy S3 Sprint was hacked a couple of weeks ago. This happened after all of our laptops were hacked as well. I have strong evidence to support all are now hosting botnets. I THINK I could fix my phone if I could get it wiped. However, wiping via Clockwork Mod, factory reset, etc. leaves me with files and folders that should be wiped.

I recall seeing some config file which stated "allow factory reset" = false. I was able to make some progress by installing CyanogenMod until updates ran which put me back to square one. I can't download GApps but managed to get the Amazon Appstore. Other than that, I have fake system processes running. Such as "System UI" but when you open it up it says it's actually android.keylogger. You can kill all processes and it still runs, so I'm assuming the real ones are hidden.

I've found the complete root file system in three places and it appears I might be mounted to their network or system. My firewall shows constant connections between three different "companies". Same with the computers. If you block the app they are coming in through, they then say they are another app. Such as Akamai Technologies via the Amazon app. I block it and then that name and IP range starts coming through as Sprint or CyanogenMod. I've looked up all IPs and most come back linked to a backdoor trojan/spy network.

My question is, is there somewhere I can view the internal file tree so that I can compare? If I could see what doesn't belong, I should be able to get this under control via the terminal or Linux. Before anyone asks, every virus program has been run. The actual virus is gone. I'm left with the bots and a screwed-up filesystem. Once I find a way to actually wipe the device, the little nightmare bots should go too. This is 100℅ driving me nuts! I'd appreciate any help!

Improve this question

2 Answers 2

Reset to default
2

Burn the hardware. If it's dug itself in deeply enough to survive a factory reset and installing a new OS from scratch, then there's no way you can trust this hardware again.

Improve this answer
0

  1. Take the S3's battery out for 30 minutes.

  2. Then, reinsert the battery and use Samsung Odin to wipe the S3 and install a new Android firmware by doing:

    1. If you haven't installed the USB drivers for your S3, then install Samsung Mobile Phones USB Drivers 1.5.33.exe. Otherwise, skip this step. For Windows OS, you can download the Samsung USB drivers for mobile devices here (Straight download).

    2. Shut down your phone.

    3. Boot your phone into Download mode i.e. Hold Volume Down + Home + Power buttons down simultaneously. Then, press the Volume Up button to initiate Download mode.

    4. Plug in the phone's USB cable: one end into your phone's connector and the other to your PC's USB port or Hub.

    5. Open Odin3 (This version runs in Windows only) and check only the "Auto Reboot" and "F. Reset Time" options. Note: Download Odin from here.

    6. Click the "PDA" button and select <S3_firmware>.tar. Then hit the "Start" button and wait.

    7. Once Odin3 signaled "PASS!", unplug the phone's USB cable. Your S3 now has the new Android firmware.

  3. Once the firmware is installed, do a Factory Reset.

  4. Wipe the internal SD card, too, in case of rogue software lying around.

  5. If you have an external microSD card installed in your S3, wipe this card as well. Note: Back up any personal files (photos, music, etc.) before the wipe.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .