I have a Samsung S9 phone that has been exploited by my neighbor, however I am unsure as to how to prove/verify it, how in depth the access is to my phone, or how I can re-secure my phone.
It seems as though they have access to everything on my phone. They have also talked through the speaker of my phone to me a couple of times as though the phone had a call in progress on speakerphone however there was no indication of it on the phone.
They have also been able to follow where I go using my cell phone. I ruled out them tracking me through location data in a Google account by removing all Google accounts from my phone.
I scanned for viruses and malware and on the phone using Kaspersky Endpoint Security and discovered a malicious .apk that was detected as a trojan virus (HEUR.RiskTool). I’m assuming this not a false positive because there is absolutely no information available anywhere online for it.
I first tried removing/quarantining it using Kaspersky Endpoint Security, however I received the following error(s):
“File quarantine failed: file is in use or permission to delete file is missing”
“Cannot delete file: file is in use or permission to delete file is missing”
I tried to delete the file manually, however the phone is not rooted so I did not have the required permissions to do so.
Then I tried rebooting the phone into safe mode and disabling the .apk through the applications list, however it was not present in the applications list.
I then tried to remove the .apk by factory resetting the phone, however the .apk still present after the factory reset. After that I thought it might be due to a custom rom being on my phone.
I attempted to flash the partitions on the phone back to factory defaults, however I was unable to do so since the phone was not rooted. I thought that possibly they were able to un-root my phone, install a custom rom on it, and then lock the phone back up, but I am unsure as to how to verify that. Is this at all possible?
I checked the current build number on my phone, and it appears to be the correct current build: R16NW.G960USQS3ARIB
Any information that would help me understand, backtrace, and/or remove this would greatly appreciated...
How did it get there if I do not have root access and did not download the malicious .apk directly, and the hacker had no physical access to my machine? Is it possible to have a virus installed to the phone via wifi or bluetooth without me ever having known it happened?
How can I back trace it where it came from?
How can I check the permissions of the malicious .apk to see what it has access to on my phone if the .apk doesn’t show up in the applications list, even in safe mode?
How can I identify if a custom rom has been installed onto my phone allowing remote access to my phone?
Is it possible for the phone to have been rooted, and then locked back up after the apk/custom rom was installed to prevent me from removing it?
Is there any way to re-flash the partitions on the phone back to factory defaults to remove the malicious .apk even if I do not have root access? All of the methods I could find required root access to the phone in order to re-flash anything.