Home Security & Triage Toolkit for Your Devices (Android, Windows)

11 minutes ago

8 min read

Are you worried that someone is spying on your phone or computer? We created a practical diagnostic guide to help you scan your Windows PC and smartphone for hidden threats. If any of the technical steps feel overwhelming, get in touch with our team. We can guide you through the process or handle the full device analysis for you!

Android

Easy

Google Play Protect: Play Store → profile icon (top right) → Play Protect (shield icon) → Scan.
Check permissions: Settings → Security & Privacy → More Privacy Settings → Permission Manager. Look for apps with access to SMS, mic, camera, or location.
Device admin and special access: Settings → Security and privacy → More security settings → Device admin apps. Certain applications, such as Device Policy & Enrollment Service, possess administrative rights to erase your phone; these are legitimate and expected on company-managed phones. Malware frequently exploits such permissions. Additionally, review “Install unknown apps” Settings → Security and privacy → More security settings → Install unknown apps. It is generally best to install apps from the Play Store.
Privacy dashboard (Android 12+): shows which apps recently used the mic, camera, or location. Settings → Security and privacy → Privacy section → Permissions used in the last 24 hours (or last 7 days)
Battery and data usage: Look for apps using lots of background data or battery that you rarely open. For battery, go to: Settings → Battery → Battery usage chart → View details → Usage by apps and features (check different dates).

For data usage, go to: Settings → Connections → Data usage → Mobile data usage.
Google account: myaccount.google.com → Security & sign-in. Check:
- Recent security activity: Review security activity
- Your devices: Manage all devices
- Your linked apps: See all linked apps
- People & sharing: myaccount.google.com → People & sharing → Location Sharing
Warning signs: sudden battery drain, overheating, pop-ups, unknown charges, contacts receiving spam from you, settings changing on their own.
Clear cookies and site data:
- Samsung Internet Browser: Open the Samsung Internet app on your device → Tap the menu icon (three vertical dots) in the bottom-right corner of the screen → Settings → Personal browsing data → Delete browsing data → Check the box next to Cookies and site data (and uncheck any other options you wish to keep, such as passwords or history) → Tap Delete data (or Delete) and confirm if prompted.
- Google Chrome: Open Google Chrome on your Samsung phone → Tap the More icon (three vertical dots) in the top-right corner → Settings → Privacy and security → Delete browsing data (or go to History > Delete browsing data) → Select a Time range from the dropdown menu (All time) → Check Cookies and site data (Uncheck any other items like browsing history or saved passwords if you do not want to delete them) → Tap Delete data (or Clear data), then confirm when prompted.
Dedicated Antivirus Applications: Bitdefender Mobile Security, Sophos Intercept X for Mobile, Malwarebytes, ESET.
Last resort: backup photos/contacts only (not apps), factory reset, and reinstall apps from Play Store only.

Also keep Android and security patches updated (Settings → System → Software update).

Needs more time and effort

Review installed apps: Settings → Apps. Start by removing any applications you do not recognize or no longer use. Keep in mind that some apps are built into the system by default. Below is a list of pre-installed apps you can safely delete or disable on your Android phone.

Note: Depending on your region or carrier, the apps on your device may vary. You can use this database to compare installed packages against community-contributed device profiles: https://sysapps.bayton.org

Samsung apps and services
- Device management and setup
  - Samsung setup wizard
  - Samsung account
  - Samsung Cloud
  - Samsung Find / Find My Mobile
  - Samsung Members
  - Samsung Smart Switch
  - Samsung Device Care
  - Samsung Push Service
  - Samsung Update / Galaxy Store update services
- Bixby and Samsung intelligence
  - Bixby
  - Bixby Voice
  - Bixby Vision
  - Bixby Routines / Modes and Routines
  - Bixby dictation or voice components
  - Samsung Keyboard
  - Samsung Text-to-Speech
  - Samsung Personal Data Intelligence or related AI components (model-dependent)
- Phone and communication
  - Samsung Phone
  - Samsung Contacts
  - Samsung Messages (model/region-dependent)
  - Samsung Internet
  - Samsung Email (optional on some models)
  - Samsung Calendar
  - Samsung Clock
  - Samsung Voice Recorder
- Files, media and everyday tools
  - Samsung My Files
  - Samsung Notes
  - Samsung Calculator
  - Samsung Gallery
  - Samsung Music (may be optional)
  - Samsung Video / video components
  - Samsung Print Service Plugin
  - Samsung Capture / screenshot tools
  - Samsung DeX (supported models)
- Galaxy ecosystem and accessories
  - SmartThings
  - Galaxy Wearable (may be downloadable)
  - Galaxy Store
  - Samsung Wallet / Samsung Pay (region-dependent)
  - Samsung Health
  - Gaming Hub / Game Launcher
  - Game Booster
  - Samsung Global Goals (optional)
  - PENUP (optional)
  - Samsung Tips
  - Samsung News (region-dependent)
  - AR Zone / AR Emoji (model-dependent)
Google apps and Android-related apps

App	Purpose
Android Auto	Connects the phone to a compatible vehicle
Android Switch	Helps transfer data when moving to an Android phone; availability and name depend on the setup version
Google Play Store	Installs and updates apps
Google Play services	Core Google APIs, account integration, location and push notifications
Google Services Framework	Google service integration
Google Play Protect / related components	App security and scanning
Google app	Google Search and assistant-related features
Google Assistant	Voice assistant, where available
Gemini	Google's AI assistant, depending on configuration
Google Chrome	Web browser
Gmail	Email
Google Maps	Maps and navigation
Google Photos	Photo backup and management
Google Messages	Messaging, often the default on newer models
Google Phone	Dialer on some configurations
Gboard	Google keyboard, if included or selected
Google Contacts	Contact management or synchronization
Google Calendar	Calendar
Google Drive	Cloud storage
Google One	Google account storage management; may be optional
YouTube	Video app
YouTube Music	Music app
Google TV	Video and entertainment app
Google Wallet	Payments and digital passes, where supported
Android System WebView	Displays web content inside apps
Android System Intelligence	On-device smart Android features
Private Compute Services	Supports certain privacy-oriented intelligence features
Android System SafetyCore	Supports selected system safety features on compatible versions
Android AICore	On-device AI services on supported devices
Google Partner Setup	Supports device and partner-service setup
Google Connectivity Services / Adaptive Connectivity Services	Connectivity-related functions, when included
Android System Key Verifier	Supports verification of encryption keys in compatible messaging services
Android Accessibility Suite	Accessibility features such as TalkBack, when installed
Speech Services by Google	Speech recognition and text-to-speech, depending on configuration
Google Backup / Android backup components	Device backup and restore
Google Setup Wizard	Initial Android setup

Core Android system apps and services

Component	What it does
Android System	Main Android operating-system components
System UI	Status bar, notification shade, navigation and system interface
Settings	Android settings
Package Installer	Installs APKs and app updates
Permission Controller	Manages app permissions
Android System WebView	Embedded web rendering
Downloads / Download Manager	Manages downloaded files
Media Storage / media provider	Indexes media files
External Storage	Provides app access to shared storage
Contacts Provider	Shared contacts database
Calendar Provider	Shared calendar database
Settings Storage	Stores system configuration
Credential Storage / KeyChain	Manages certificates and credentials
Android Keystore	Protects cryptographic keys
Input Devices / keyboard framework	Handles keyboard and input services
Autofill Service	Supports password and form autofill
Bluetooth and Bluetooth MIDI services	Bluetooth connectivity and related functions
NFC service	Near-field communication, if supported
Wi-Fi services	Wireless network connectivity
Telephony Provider	Phone and mobile-network data
Phone Services	Calls, SIM and telephony functions
IMS Service	Carrier voice and messaging features, including VoLTE where supported
SIM Toolkit	SIM-based carrier services
Carrier Services	Carrier-specific integration, if included
Emergency / location services	Emergency calling and location-related functions
Biometric services	Fingerprint, face unlock or related authentication
Device Policy / enterprise management	Work profiles and device management
Backup and Restore	System backup and recovery
Android Shared Library	Framework libraries used by apps
System certificate and trust components	Certificate validation and secure connections
Job Scheduler / Download services	Background work and scheduled tasks
Connectivity and Network Stack	Network management
System tracing and diagnostics	Performance and debugging functions

Other preinstalled apps you may encounter Depending on the phone's sales region, these may also be legitimate:
- Carrier apps: carrier account management, voicemail, carrier configuration and network services.
- Microsoft apps: Microsoft 365, OneDrive, Outlook or LinkedIn.
- Facebook components: Facebook app, app installer, app manager or related integration on certain firmware.
- Wearable and accessory services: Galaxy Buds, Galaxy Watch and Bluetooth accessory integration.
- Regional services: local payment apps, news, government services and emergency alerts.
- Enterprise services: Knox, work-profile management and device-policy components.

Advanced USB Inspection

For a deeper investigation, connect the phone to your PC via a USB cable with Developer Options enabled on the Android device and the Android Debug Bridge (ADB) utility installed on your computer.

To Enable Developer Options & USB Debugging:

Open Settings > About phone > Software information.
Tap Build number 7 times rapidly until you see "You are now a developer!" (enter your PIN if prompted).
Return to Settings > System > Developer options.
Toggle USB Debugging to On.

ADB inspection commands (USB debugging on)

For third-party apps:

adb shell pm list packages -f -3

For permissions and signatures:

adb shell dumpsys package <pkg>

For device admins:

adb shell dumpsys device_policy

For a full system dump:

adb bugreport

Network analysis

Route traffic through a proxy or capture on a router/Wi-Fi hotspot with Wireshark. Look for beaconing, unknown domains, and unusual DNS. You can also use PCAPdroid, a network monitor app, to log and analyze all local app traffic on the device.

Spyware like Pegasus can evade on-device checks, so if you suspect a targeted attack, a factory reset plus new credentials is the safest route.

Windows

You can install Malwarebytes on your Windows machine to quickly scan the device.

To help catch threats hiding in lesser-known areas, we have included PowerShell scripts that pull vital diagnostic data from your system for inspection.

Open PowerShell as Administrator

Press Windows key + X.
Select Terminal (Admin) or Windows PowerShell (Admin).
Approve the administrator prompt.

List processes with executable paths:

Get-CimInstance Win32_Process |
Select-Object ProcessId, ParentProcessId, Name, ExecutablePath, CommandLine |
Format-List

Find processes running from suspicious locations:

Get-CimInstance Win32_Process |
Where-Object {
    $_.ExecutablePath -match '\\AppData\\|\\Temp\\|\\Downloads\\'
} |
Select-Object ProcessId, Name, ExecutablePath, CommandLine

Note: Legitimate applications can also run from these directories.

List active network connections:

netstat -ano

Show executable names associated with connections:

netstat -abno

Inspect established connections using PowerShell:

Get-NetTCPConnection -State Established |
Select-Object LocalAddress, LocalPort, RemoteAddress, RemotePort, OwningProcess

Registry startup entries:

reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run

reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Run

Check additional startup locations:

reg query HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce

reg query HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce

PowerShell startup applications:

Get-CimInstance Win32_StartupCommand |
Select-Object Name, Command, Location, User

List all scheduled tasks:

Get-ScheduledTask |
Select-Object TaskName, TaskPath, State

Inspect task actions:

Get-ScheduledTask | ForEach-Object {
    [PSCustomObject]@{
        TaskName = $_.TaskName
        TaskPath = $_.TaskPath
        Actions  = ($_.Actions | Out-String)
    }
}

List running services:

Get-CimInstance Win32_Service |
Select-Object Name, State, StartMode, StartName, PathName |
Format-List

Check whether Microsoft Defender is enabled and functioning:

Get-MpComputerStatus

Check antivirus preferences:

Get-MpPreference

Check detected threats:

Get-MpThreat

Check detection history:

Get-MpThreatDetection

Update Defender signatures:

Update-MpSignature

Run a quick scan:

Start-MpScan -ScanType QuickScan

Run a full scan:

Start-MpScan -ScanType FullScan

Find recently modified executable files in common user-writable locations:

Get-ChildItem "$env:APPDATA","$env:LOCALAPPDATA",$env:TEMP `
-Recurse -File -Include *.exe,*.dll,*.ps1,*.bat,*.vbs `
-ErrorAction SilentlyContinue |
Sort-Object LastWriteTime -Descending |
Select-Object -First 100 FullName, LastWriteTime

Calculate a file's SHA256 hash:

Get-FileHash "C:\Path\To\File.exe" -Algorithm SHA256

Check its digital signature:

Get-AuthenticodeSignature "C:\Path\To\File.exe"

Check for potentially malicious domain redirections:

type C:\Windows\System32\drivers\etc\hosts

Inspect configured DNS servers:

Get-DnsClientServerAddress

Check recent system errors and warnings:

Get-WinEvent -LogName System -MaxEvents 100

Check security events:

Get-WinEvent -LogName Security -MaxEvents 100

Useful security event IDs to investigate:

Event ID	Description
4624	Successful logon
4625	Failed logon
4672	Special privileges assigned
4697	Service installed
4698	Scheduled task created
4720	User account created
1102	Security audit log cleared

Availability of these events depends on Windows auditing configuration.

Search for a specific Event ID:

Get-WinEvent -FilterHashtable @{
    LogName = 'Security'
    Id = 4624
}

Search across multiple Event IDs:

Get-WinEvent -FilterHashtable @{
    LogName = 'System'
    Id = 41, 6008, 1074
}

Search all event logs for a specific Event ID:

Get-WinEvent -ListLog * -ErrorAction SilentlyContinue |
Where-Object { $_.RecordCount -gt 0 } |
ForEach-Object {
    Get-WinEvent -FilterHashtable @{
        LogName = $_.LogName
        Id = 4624
    } -ErrorAction SilentlyContinue
}

Display useful event details:

Get-WinEvent -FilterHashtable @{
    LogName = 'System'
    Id = 43
} | Select-Object TimeCreated, Id, ProviderName, LevelDisplayName, Message |
Format-List

Search only the last 24 hours:

Get-WinEvent -FilterHashtable @{
    LogName = 'System'
    Id = 43
    StartTime = (Get-Date).AddDays(-1)
}

Check PowerShell operational logs:

Get-WinEvent -LogName "Microsoft-Windows-PowerShell/Operational" -MaxEvents 300

Check Windows system integrity:

sfc /scannow

then

DISM /Online /Cleanup-Image /CheckHealth

Additional tools worth knowing

Autoruns

Inspects startup entries, services, drivers, scheduled tasks, browser extensions, and other persistence mechanisms.

Download Autoruns

Process Explorer

Advanced Task Manager replacement. Shows process trees, loaded DLLs, handles, signatures, and process details.

Download Process Explorer

TCPView

Graphically monitors active TCP and UDP connections and the processes responsible for them.

Download TCPView