Help monitoring/spyware removal

[Nightspear]

Is there anything able to remove monitoring software? My sister's husband is a cyber stalker or something. He knows who and when she calls, text, anything done on social media, and even what her phone conversations entail (literally word for word). I have searched the net trying to figure out how to remove it, but the only thing suggested is a factory reset. We back up her contacts, photos, and etc. reset the phone and he still has access. Local law enforcement can't do anything until he does something violent/criminal. Is there anything that can help.

 

[chanchan05]

A complete reflash of the phone firmware will do it. A factory reset will only uninstall non-system apps. Spyware normally are installed as system apps just so they remain behind after factory reset. A complete reflash basically removes everything from the phone and puts back a factory image.

This is if the phone is the medium for spying used.

 

[ciresiuol123]

Wanna share a list of all of her apps? Could help... Download My App List...
Go to the settings for the app and uncheck the first box to show system apps, then go back and refresh the list, then generate the list into an XML file and add as an attachment to this post...

 

[Nightspear]

@chanchan05 That is what I was afraid of. Does re-flashing the firmware require root access? As far as I know, she does not have a rooted phone. I am quite sure that her phone is the medium used. He knows her conversations when she is at my house or in the car. The only thing I can really tell you about her phone is that it is an HTC.

@ciresiuol123 I will get the list as soon as I can. Being on different work schedules makes things a little difficult at times.

 

[svim]

@chanchan05 That is what I was afraid of. Does re-flashing the firmware require root access? As far as I know, she does not have a rooted phone. I am quite sure that her phone is the medium used. He knows her conversations when she is at my house or in the car. The only thing I can really tell you about her phone is that it is an HTC.

@ciresiuol123 I will get the list as soon as I can. Being on different work schedules makes things a little difficult at times.

Depending on how long he had physical access to her phone, and his skill level, in order to install and configure any kind of system level monitoring software he would have had to have rooted her phone. There is also the chance he then un-rooted it in an effort to hide and make it harder to reverse his work. But whether her phone is or is not currently rooted, all this requires time, planning, and knowledge, there is no quick, just-push-a-button process to accomplish something as elaborate as this.
If he did have possession of her phone for any extended length of time, I'd very strongly recommend she look into just getting a new phone and a new number. This is a serious issue where if's and maybe's carry little weight as long as you and/or her have suspicions her phone is problem. But it all comes down to you would need to have a forensics/penetration test lab to analyze that phone determine if its been compromised. No app you download from Google Play or whatever you as a typical consumer can do with it will be a 100% solution. Again, this is too serious a matter.
Also, while her phone might be an issue, a more likely target he's focusing on is her online presence. She should change all the passwords to her online accounts -- banking, email, Facebook, Instagram, etc. Even if she's done this recently if he has had access to her phone he would have noticed this.

 

[chanchan05]

No. Reflashing does not need root access. However I do not have experience with HTC. They have locked boot loaders so I do not know if that will cause trouble.

 

[svim]

I'm still going to recommend replacing the phone with a new number. The ex is clearly fixated and not acting rationally. Re-flashing the phone with an OEM ROM, or rooting and replacing it with a third-party ROM, or whatever will result in a phone that will still always be suspected of being compromised. If anyone on these Forums can absolutely guarantee the phone in question will be 'clean', I stand corrected but this isn't a matter where some Chinese hacker is data-mining user logins, it's much more serious.

 

[James L]

Not all "Spy apps" require root access as someone who does deal with spy apps via a private investigation firm, the app i deal with works on older Android versions as well as the newest ones.

I don't support nor disagree with spy apps as they are used for more then just spying on spouses. It's just business. As said above the app can be removed by using a RUU as long as HTC backup is not enabled. 99% of spy apps do require root or jailbreak for iPhone's

The one i have access to will access everything but whatsapp without root or jailbreak and is undetectable. Another way you could find the offending app is to compare a apps list with someone who has the same device. The apps are renamed to look like a normal app.

 

[Nightspear]

@chanchan05 I will look into the process of flashing the rom and get it done as soon as possible and let you know how it goes.

@svim I do not know how often she leaves her phone unattended, but I know he has more than enough time in the middle of the night. I would say he is savvy enough to be dangerous, especially if he has instructions at hand. He is very irrational and the stories I have heard lately point in the direction of a hostage situation. As I said, law enforcement can't do anything until he becomes violent or does something criminal. We can't prove anything other than when he confronts her about something he didn't like to see or hear. I do not know her finical position, but a new phone may not be an option.

@James L I understand there are legitimate uses for these applications. He does nothing with the information except prove that he has access to it and confront her when he doesn't like something, besides my sister hides nothing from him. He is having the affairs, she caught him in the act.

 

[James L]

@chanchan05 I will look into the process of flashing the rom and get it done as soon as possible and let you know how it goes.

@svim I do not know how often she leaves her phone unattended, but I know he has more than enough time in the middle of the night. I would say he is savvy enough to be dangerous, especially if he has instructions at hand. He is very irrational and the stories I have heard lately point in the direction of a hostage situation. As I said, law enforcement can't do anything until he becomes violent or does something criminal. We can't prove anything other than when he confronts her about something he didn't like to see or hear. I do not know her finical position, but a new phone may not be an option.

@James L I understand there are legitimate uses for these applications. He does nothing with the information except prove that he has access to it and confront her when he doesn't like something, besides my sister hides nothing from him. He is having the affairs, she caught him in the act.

Oh i'm not saying what he is doing is right, I totally agree that it should be stopped. If you can provide the model number i'm sure someone can point you to the correct RUU to wipe the device to a like new state,

 

[svim]

i'm sure someone can point you to the correct RUU to wipe the device to a like new state,

That would be giving unwarranted, anonymous advice to do something with no assurance it will solve the problem. In essence, this will be intentionally putting someone's safety at risk.
I hate to be such a tool but domestic issues are way, way beyond the scope of this forum.

 

[James L]

That would be giving unwarranted, anonymous advice to do something with no assurance it will solve the problem. In essence, this will be intentionally putting someone's safety at risk.
I hate to be such a tool but domestic issues are way, way beyond the scope of this forum.

Huh? I don't see how flashing OEM OS would put anyone at risk.... Using a RUU would default the device to the way the manufacturer intended ( Non altered) Domestic issues, i'm not getting involved with.

 

[svim]

So if the ex had installed a system level exploit than re-flashing the OEM ROM should fix the issue. (Until he gets a hold of the phone again.) But if he installed just a user level monitoring app than flashing the ROM than no, this would not fix the problem. That requires a Factory Reset. (Two different procedures that affect two completely separate partitions.) Every bit of advice we can give on this matter is based on if's and maybe's dependent on stated if's and maybe's.
Given the situation, misleading the OP that any solution we can offer that will 'clean' that phone is a dangerous practice.

 

[Nightspear]

@James L I am waiting for her to respond to my message with the info.

@svim We already tried a factory rest with no success in removing the monitoring software. Though I am concerned for my sister, I do not fear that something will escalate from removing the software. If that were the case, steps would be taken to insure her safety. I am hoping that by removing the software he realizes that she can remove it at anytime she chooses if he puts it back on her phone. At the very least removing it will stop him from confronting her when he is unhappy about something someone else has said. He knows how we feel about it him and is too cowardly to confront us about what was said. Instead he takes it out on her. OK I am starting to rant, I will stop here.

Thank you all for the advice thus far. I will get back to you all with the requested info and status.

 

[James L]

Exactly my thoughts, if you already contacted the police and made them aware of the current situation.... I couldn't see why you wouldn't feel free to do it again if the situation escalated, and or protect your family other ways. I prefer staying armed, of course legally.

I didn't believe a "user level monitoring app" was in use. A app that has them kind of capabilities would be a system app.
If it was a user level app it would have to have admin permissions in the settings.

99% of apps that are "Spy apps" do require root access to install as a system app. Have you tried running a root checker app?
Even if SuperSU is hidden it can be unhidden.

A RUU would remove this app, and return the device to it's original OS.

 

[Nightspear]

@James L That's some good news. Does an RUU involve data loss if not backed up?

 

[James L]

@James L That's some good news. Does an RUU involve data loss if not backed up?

Yes

 

[Nightspear]

Well flashing the RUU went a lot easier than I expected. I was even able to update the rom to the latest version. So far the monitoring application seems to be removed and her phone is actually running about 50MB less in ram than it was before. That could be a good indication that it is now clean. Thanks to everyone that helped. I also stressed svim's advice about getting a new phone and phone number if he still has access or gets access again.

 

[svim]

Does she have a lock screen enabled on her phone?

 

[AZgl1500]

Does she have a lock screen enabled on her phone?

this is a very neccessary requirement.

I would make it a six digit pincode.
miss it ten times and it reformats the phone.

I use a 4 digit code, and I use one of those digits twice.

even if they inspect the face of the phone to see which digits are used, no way can he/she guess the correct order within ten tries.

 

[chanchan05]

this is a very neccessary requirement.

I would make it a six digit pincode.
miss it ten times and it reformats the phone.

I use a 4 digit code, and I use one of those digits twice.

even if they inspect the face of the phone to see which digits are used, no way can he/she guess the correct order within ten tries.

Use a digit twice. Makes it harder to guess. Is it a 4 digit code or did she use one digit twice to make a 6 digit code? 5 digit code?

 

[Nightspear]

She is using the pattern lock.

 

[svim]

You might want to look into installing something like this 'Third Eye' app on her phone.

http://www.ghacks.net/2016/05/15/android-know-how-tried-to-get-in-your-phone/

https://play.google.com/store/apps/details?id=com.miragestacks.thirdeye