How do I know if my iPhone is still hacked or has a virus?

Yukinayoyoyo wrote:

I accidentally downloaded an app which carried virus. I got a message saying they add a virus into my phone and they are able to see people in my contacts and all my pictures. They also send me a picture of getting information of my contact list. So I am pretty sure they hacked my phone. I quickly deleted that app and search for solutions and finally deleted all the content and reset my phone. Do anyone know is this able to remove all the virus and stop the hacker to have access of my contact list and photo album?

Scam!

If you actually installed an app onto your phone and you gave that app permission to access your Contacts and/or Photos, then it could have pulled up those things while the app was installed and had those permissions. No hack involved. Once you deleted the app, any access they gained that way would have been gone.

Control access to information in apps on iPhone - Apple Support

But a very common lie that scammers use is the claim that they are some sort of omniscient hackers, that they are able to see everything on your phone. When in fact they have nothing, and can see nothing. It's a fear tactic that criminals use to try to trick you into paying extortion money.

U. K. National Cyber Security Center – Sextortion phishing scams: How to protect yourself

If you already got rid of the app, then you're good (or, should be). But a side loaded app may have messed with the phone in a way that simply deleting the app can't fix.

Honestly, you should erase the phone as new and start over.

1. Absolutely first! Backup your contacts, photos and other personal info to an external drive. All of this should be in your iCloud account for any services you have turned on, but better safe than sorry.
2. Turn off Find My, and sign out of your account.
3. Choose to erase the phone: Settings > General > Transfer or Reset iPhone > Erase All Content and Settings
4. When the phone returns to the "Hello" screen, go through the setup sequence, being certain to log back into your same user account.
5. iCloud will automatically repopulate/sync your photos, contacts and other items synced to iCloud.
6. Email accounts usually have to be added back in manually. But once set up again as IMAP, all or your emails will appear.

You downloaded a Developer Certificate, then told your device that you trust this person to have access to your phone. That does not involve any virus or a hacking of your phone, and you voluntarily gave them the access. They can certainly access your photos and contacts as well. The certificate you trusted can be viewed and removed at Settings > General > VPN & Device Management. Resetting your phone will prevent further access and also remove the Certificate. There is nothing you can do about the data they already have such as your Photos and Contacts.

It is like giving someone your Bank Account number, then wondering how come money is missing from your account. I suspect the exact message you saw was this one:

• Allow apps from this developer to be opened on your phone and to access your data.

In any case, you have removed access by resetting your phone, although it is not recommended to restore from a backup. If you did, you may want to check the Device Management setting above to verify that it is no longer there or perform a Factory Reset and do NOT restore from a backup. The data they accessed is in their hands, so you cannot change that fact. You now understand the importance of reading those warnings and should choose wisely who you Trust with your data. In the future, stick to downloading apps in the Apple App Store, and if you do not see an app there that you want, consider that there is likely a good reason for that.

Factory Reset and do not restore from a backup. It is likely that all that is needed is to remove the app and verify the certificate is no longer at Settings > General > VPN & Device Management, but if it were me I would take the extra step to do the Factory Reset, and that is also what I would recommend to others.

To be clear, the only thing that makes anything a Trojan is when it claims to do one thing and does something else. There is no AntiVirus app that you should ever download and certainly nothing that can determine what an app does. Nothing is hidden on your phone and absolutely nothing can be stored in your System Folders as they are locked in a read only partition of your phone.

Removing the app that you had already trusted is what removes a Trojan. Removing the Developer Certificate prevents those apps from that developer from running on your iPhone. Just that is likely all that is needed, but the recommendation by us is for a complete Factory Reset without restoring from a backup. Once that is done, you are all good.

I couldn't recall for sure if it was necessary to logout out of your account to erase an iOS device. But turning off Find My is required. It won't continue if that's still active.

Yes, anything that didn't belong on the phone is gone. That is, as long as you didn't restore a backup. Then you'll be back where you started.

AV apps in iOS are totally worthless. Even more so than on a Mac. iOS is a sandboxed OS. Apps can only talk to themselves. They are not allowed access to the OS, apps, or any other locations on the device. In other words, the only thing AV apps on iOS can check is themselves.

There are currently no viruses that can infect an unjailbroken iPhone.

That message was a scam. They were trying to get you to give them money. The people sending the message didnt' actually have access to anything.

The only possible way they could get such "permission" would be if you gave them both your Apple (user) ID and password. With that information, they could then login to your account from any other device and see everything stored in your iCloud data. Access to the phone itself is completely unnecessary at that point, and still not possible.

If you did give them that information, IMMEDIATELY change your password, and remove any trusted phone numbers or email addresses they may have added. Then remove any devices that don't belong to you from your account.

That won't change that they already have your information, but it will block all further access.

There is no virus on your phone and you did not have one in the first place. The message you got was a phishing message that attempted to scare you and may have accomplished what they wanted. The most notorious of those scams is called the "Hey Pervert" scam due to they way they address you and claims they will send photos of you to people in your Contacts if you do not send them money. All lies!

Your phone does not have a virus. It is not hacked. The message is a scam.

• In what way did you download an app to your phone?
• What is the name of the app?
• Was it in the App Store?

The only region capable of downloading apps outside the App Store is in the EU where third party App Stores are allowed. It is not done by clicking a link in a website. Giving someone your Apple Account credentials is a completely different matter if that was the case, and nothing to do with an app on your device. It is the details that are going to matter on what actually happened to provide any meaningful way to help you.

Then what you did was voluntarily download and run a Trojan. There are more than a few of these, all of Chinese origin. Once installed, the app has direct access to whatever's on your phone.

Mind you, this is NOT a virus. It's a Trojan. Viruses self replicate. These do not exist on the Mac or in iOS. Trojans require the user to install the app, which is what you did.

Yukinayoyoyo wrote:

Yes, I understand

Just make sure that they can no longer access to any of my new contacts and photos after I reset my phone.

While they had access they could have downloaded all of your contacts and photos, and they can keep them even after you reset the iPhone.

OK... so YOU compromised your phone.

It was not 'hacked' in the traditional sense unless you count the fact that you are the one who 'hacked' it.