Random sounds, have I been hacked?

[Hobbes69]

Occasionally over the last few weeks I've heard strange sounds from my Alcatel Revvl 5049W on T-Mobile. It's usually on the lock screen when I'm not using the phone. Sounds include the opening few seconds of the Universal Studios opening theme, a woman screaming, and a muffled conversation between an man and a woman in a foreign language. The phone also started running really slow and the battery drained faster than normal. I've since factory reset my phone and changed all my passwords. There have been no recorded unauthorized logins on my Google, Facebook or anything else that records that information. So far I've noticed no more weird behavior on my phone, but it had been so intermittent and random that it may not have happened yet. Anyone else experience this and know what it is?

 

[mikedt]

Someone else was reporting spurious Universal Studios sounds on their phone a few weeks ago. But I can't find that thread at the moment, and not sure what the resolution was.

 

[T0x1cd1n0]

No solution has been found, that I know of yet. My phone was doing the same thing. Playing random music, universal studios theme etc. I got a new device, same Google Account new microSD. That's what did it for me... Unfortunate I needed to buy a new device for this annoying ass problem. Hope you can figure it out

 

[Hadron]

In case anyone else is looking (I know that the OP has already found it) the other thread is here: https://androidforums.com/threads/my-phone-randomly-plays-music.1274963/.

The two sufferers who've given the information have different phones on different carriers, so it seems unlikely that it's a pre-installed app. So my best guess is some user-installed app, but the question is which?

 

[JohnCoachWalsh]

I've have the same problem (universal theme...) for about 2 weeks now.

Alcatel Idol 3 on MintSIM (T-Mobile).

The 'extra' apps I've installed are:

connect bot

hackers keyboard

instagram

lookout

lyft driver

messenger

netflix

nitroiptv

notification toggle

nova launcher

sms backup and restore

solid explorer classic / unlock

startup manager

I tried turning off wifi and data (for a day), and it didn't happen then.

When it does play the music (always universal theme), nothing else pops up, screen stays locked/off...

John.

 

[Hadron]

Try working in safe mode for a day. That will disable all user-installed apps, so if it happens then it's something that is pre-installed on the phone.

Otherwise, assuming these all came from the Play Store (if installed from elsewhere they may have been modified), the ones I've never heard of are nitroiptv, notification toggle, startup manager. I assume "lyft driver" is the official lyft app (we don't have lyft here, so there's no reason for me to know). There are many apps called "connect bot", so you'll need to specify the developer to make that one unambiguous.

netflix obviously has a thematic connection to a movie studio theme, but I think it unlikely as the problem would be very widespread if it were that.

 

[mikedt]

What's that NitroIPTV? Which I believe is one those illegal movie, TV, and sports streaming apps. Could it be making the movie theme sounds?

 

[BlueTomorrows]

Exact same problem here, a revvl t-mobile phone. Driving me crazy, hope someone finds an answer!

 

[Swoonis]

I'm also having this problem. The first second of the universal song plays at absolutely random intervals. Started a week or two ago.

This is probably related: two days ago I started hearing audio from what I presume was a Russian woman's home while she was watching the world cup. There were children in the background. She's couldn't hear me, and I can only assume and didn't know I could hear her. Very creepy.

 

[Hadron]

So what apps have you installed or updated in the week or two before this started? Updates can add crap to apps, which is a reason to pay attention to these (the "Peel Smart Remote takes over your lockscreen" business was an example of this).

As I asked another poster, does this happen in safe mode? If it doesn't that will confirm that it's a user-installed app responsible rather than a pre-installed one. And if it does it will confirm the opposite - either would be progress.

The majority who don't have this can only guess based on what's posted. We don't know what the common factor between sufferers is, and nobody can hope to spot it without information. In this thread 3 sufferers have said they are on T-Mobile, but the first to report this (in another thread) is on Verizon so it doesn't seem to be that.

 

[Swoonis]

The only app I remember installing is TOR. My provider is MetroPCS. I'm going to run my phone in safe mode asap, and report back.

EDIT: I've been in safe mode for around half an hour, and I don't hear the sound. It's most definitely a user app.

 

[noidodroid]

My mother was having the same problem (Universal Studio Sounds?) on her Motorola Droid Razr M XT907 on Verizon Network. She would hear this chime noise that sounded familiar to the noise USA NBC Studios? (i think it is) channel and related makes when it goes off air (seldomly happens). It's a two toned chime. I tried to find it on youtube just now but no luck. Anywho. She called me to take a look at it and I could not find the culprit so I just formatted the whole handset and reflashed the firmware. Now no issues.

I think it may have been an application or from some malware/adware that was installed from a nasty attachment she might have opened from email. All she uses the phone for is calls, txts and email. I am the one who put the apps on the phone and I know each and every one and they aren't malicious. All this leads me to believe it was something malicious.

 

[noidodroid]

I'm also having this problem. The first second of the universal song plays at absolutely random intervals. Started a week or two ago.

This is probably related: two days ago I started hearing audio from what I presume was a Russian woman's home while she was watching the world cup. There were children in the background. She's couldn't hear me, and I can only assume and didn't know I could hear her. Very creepy.

That is SUPER creepy. If you have TOR installed maybe it is from some deepweb .onion site. There is some CREEPY and straight SICK shit on the deepweb. Imagine for a minute a group of people viewing some Russian lady and her family through an exploited vulnerability - Computer Camera / TV Camera / Sound System with smart abilities or even just a Windows PC with sound recorder enabled that piped info in real time to an IRC channel or DeepWeb website. F*CKING CREEPY! There are sick people out there that do stuff like this.

Here is some more creepiness! lol -

I have a similar issue going on with my local network here at my home. I have random voices coming out of almost every speaker throughout my office. It is plain as day and whats even creepier is they try to speak to me and I even got a call one time from a person over in India (assuming based on voice) and he was telling me I had a virus (common scam they pull) but was different as the way he was talking to me he was acting as if he could see what I was doing. He was all like "no no, open up cmd prompt" "no not that, click on ..." etc. I recorded the call and social engineered his ass until he eventually got the clue that I wasn't your average PC user and hung up. I'd post it here but it is full of some foul language lol. Back to this sound issue.. I think I might be the victim of the BadBios virus that has been modified. It is driving me nuts and I don't have the time i wish i had to go over everything and especially not redo every single machine here. It's on going for a very long time now. The only time it stopped was when the whole power went out in a 4 block area of this local grid. I feel as if I am like that Russian woman. A victim to some strange sick prank. Everything is like it is out of a science fiction novel. I have a Bug Scanner that goes up to 6GHz but I have found very little. I am soon to hire a Private Eye better skilled in finding bug's than I am to scan the whole house.

Be happy you don't have the issues I do. You'd go nuts quick. lol

 

[Swoonis]

For clarification, I didn't use TOR for any deepweb stuff. I intended to pull a prank with some friends, but ended up not even using it.

And wow Noidodroid, you're gotten into some real trouble. I hope you stay safe.

 

[noidodroid]

For clarification, I didn't use TOR for any deepweb stuff. I intended to pull a prank with some friends, but ended up not even using it.

And wow Noidodroid, you're gotten into some real trouble. I hope you stay safe.

Yeah I haven't always lived such a geeky lifestyle so there is no telling. My past always seems to find a way to creep up on me when I least expect it. I'm just hoping though it is totally by random or something else and ultimately that I can stop it. So far this month it hasn't happened much.

 

[noidodroid]

@Hadron mentioned in another thread that it would be easier if everyone posted their phone information etc so we can see what is common amongst all.. For example here is the details on the handset of my mothers that was having similar issues.

Phone: Motorola Droid Razr M Model: XT907
Firmware: Stock KK 4.x.x (can't remember which)
Updates: Latest everything including google.
Apps: Nothing out of the ordinary. Yahoo email app, local weather channel app, google apps, and thats about all.
Usage: Only used for calls/txts/email and to take pictures. Some light surfing web to normal sites and google maps over the past years since it came out.. (yeah it's been THAT long my mother has used that phone without a factory reset or anything). No wifi use, straight data only. Bluetooth however was left on all the time and was used so she could pair it with her vehicle and drive / talk.

With everyone having this around the same time it makes me think it's something malicious being spread around and seems it's doing a good job propagating undetected as I haven't heard about it in the news or on any security sites yet. Kind of like my issue in my office. Im very interested in finding out what this could be. Perhaps it ties in with what I have going on at my place.

 

[JohnCoachWalsh]

Try working in safe mode for a day. That will disable all user-installed apps, so if it happens then it's something that is pre-installed on the phone.

Otherwise, assuming these all came from the Play Store (if installed from elsewhere they may have been modified), the ones I've never heard of are nitroiptv, notification toggle, startup manager. I assume "lyft driver" is the official lyft app (we don't have lyft here, so there's no reason for me to know). There are many apps called "connect bot", so you'll need to specify the developer to make that one unambiguous.

netflix obviously has a thematic connection to a movie studio theme, but I think it unlikely as the problem would be very widespread if it were that.

I was waiting for it to happen again, and it is doing it again now (I power off every night).

So I'm trying 'safe mode' now.

re: nitroiptv - I'm not using it, so I can uninstall it. Will do that next, after some safe mode time

Phone details:

Alcatel Idol 3.

Network: MintSIM (t-mobile)

Android: 6.0.1
Kernel: 3.10.49-ga2eb99a

updates: all to date.

developer options: on, but nothing enabled

I usually have bluetooth off, and it does happen then. Wifi/data will be on.

It had not been happening so often, so it may take a while to be confident in a result for safe mode.

 

[noidodroid]

I was waiting for it to happen again, and it is doing it again now (I power off every night).

So I'm trying 'safe mode' now.

re: nitroiptv - I'm not using it, so I can uninstall it. Will do that next, after some safe mode time

Phone details:

Alcatel Idol 3.

Network: MintSIM (t-mobile)

Android: 6.0.1
Kernel: 3.10.49-ga2eb99a

updates: all to date.

developer options: on, but nothing enabled

I usually have bluetooth off, and it does happen then. Wifi/data will be on.

It had not been happening so often, so it may take a while to be confident in a result for safe mode.

So when it happens you have wifi or data on? You might try using some packet sniffing applications and or just check your connections with a networking application.

Network Analyzer - Check connections on your network and more. Available from playstore.
Packet Capture - Capture packets from connections / apps. Available from playstore.
aLogcat - Check system logs for anything out of the ordinary. Available from playstore.

Fool around with those some and see what you can find. Hard to say when to run them as you arent getting the sounds that often lately you said. The best would be to run them before the sounds happen then view apps results/logs after the sound happens but this can use a lot of resources and disk space. Best bet would be to run them after the sound occurs and then keep them going for a bit to see if it happens again. Then collect results and analyze. You can paste here too and I/others can take a look at them.

 

[JohnCoachWalsh]

Was running in 'safe mode' for 3 days, no re-booting.

It did happen, played the universal theme.

Wifi (or data) has to be ON - I ran with it off before and it did not happen.

re: packet sniffer

So it's not happening often (one time a while ago, it did happen a lot).

Do you know if any of the apps have an option to only keep the last 5 mins of data?

Thanks.

 

[JohnCoachWalsh]

Happened today. The apps I had open:

messaging
google maps
camera

 

[noidodroid]

Was running in 'safe mode' for 3 days, no re-booting.

It did happen, played the universal theme.

Wifi (or data) has to be ON - I ran with it off before and it did not happen.

re: packet sniffer

So it's not happening often (one time a while ago, it did happen a lot).

Do you know if any of the apps have an option to only keep the last 5 mins of data?

Thanks.

I think what you might just have to do is log the processes running / connections to/from the phone from the time you start the phone until the problem happens. Right after the sounds occur and w/e else your phone does stop the logging on each, make sure they are saved and then post the logs here and we can take a look for anything out of the ordinary. Since you said data or wifi has to be enabled it is more than likely something that requires a connection.

 

[KBU2]

In the events of such activities begin to manifest like random sounds on your device, always check your Device Administrator and Connected Apps where some apps has websites to send random notification from past installed apps and games or installed apps on your device, outside of these of locations there is no other way for anything to conduct that type of activity on your device. Me personally if you can't pinpoint exactly where it was coming from, I would lean towards ( Connected Apps) under Settings than Google.

 

[bcrichster]

Happened today. The apps I had open:

messaging
google maps
camera

Go outside and walk around your home but keep your back to your home.. Do you see any unusual vehicles around within direct line of sight, possibly like a repair/work van?

 

[JohnCoachWalsh]

Go outside and walk around your home but keep your back to your home.. Do you see any unusual vehicles around within direct line of sight, possibly like a repair/work van?

Not sure what your thinking - but this happens at all sorts of different locations, and can also be when I'm driving in the car.

 

[JohnCoachWalsh]

Some more 'general' info:

It's always the same tune (Universal theme), not 'random' sounds.

The audio is broken up, stuttering, and usually does not complete the whole theme.