My phone started doing something maddening: every time I dropped it on the wireless charger, a browser popped open to an ad. No app I could point to. Nothing obvious in my app drawer. Just… ads, on cue, whenever it charged.
Here's exactly how I hunted it down and removed it — no root, no factory reset, no sketchy “cleaner” apps. Just the official Android debug tools and a bit of detective work. If you've got a Samsung (or any Android) phone doing something similar, you can follow the same playbook.
TL;DR: The culprit wasn't a normal app. It was carrier-preloaded adware (Digital Turbine “Ignite”) that had quietly created a hidden Samsung “Modes and Routines” automation to open ad pages whenever the phone charged. I found it by watching the system logs at the moment the ad appeared, traced it to the app that installed it, and uninstalled it for my user profile with one command.
What you'll need
- A Windows, Mac, or Linux computer
- A USB cable or Wi-Fi (Android 11+ supports wireless debugging)
- 10 minutes
That's it. We're using ADB (Android Debug Bridge), Google's official developer tool. It's safe and reversible.
Step 1: Turn on Developer Options + Debugging
On the phone:
- Settings → About phone → Software information
- Tap Build number seven times. Enter your PIN when asked.
- You'll see “Developer mode has been turned on.”
- Go to Settings → Developer options.
- USB cable: plug into the computer and turn on USB debugging. Tap Allow on the prompt.
- Wi-Fi (no cable): turn on Wireless debugging instead (handy if your cable turns out to be charge-only — more on that below).
Gotcha I hit: my first cable was a charge-only cable with no data wires, so the computer never even saw the phone and no debugging prompt appeared. If you plug in and nothing happens, try a different cable or just use Wireless debugging.
Step 2: Install ADB on your computer
Windows (winget):
winget install --id Google.PlatformTools --source wingetMac (Homebrew):
brew install android-platform-toolsLinux (Debian/Ubuntu):
sudo apt install android-tools-adbOr download “SDK Platform Tools” directly from Google: https://developer.android.com/tools/releases/platform-tools
Verify it works:
adb versionStep 3: Connect to the phone
Over USB:
adb devicesYou should see your device listed. If it says unauthorized, tap Allow on the phone.
Over Wi-Fi (wireless debugging): On the phone, open Wireless debugging → Pair device with pairing code. You'll get an IP:port and a 6-digit code. On the computer:
adb pair 192.168.x.x:PORT (then enter the 6-digit code)
adb connect 192.168.x.x:PORT (use the IP:port from the MAIN wireless debugging screen)
adb devicesWireless debugging drops when the screen sleeps. Turn on Developer options → “Stay awake while charging” to keep the link alive during your investigation.
Step 4: Catch the culprit in the act (the key trick)
This is the part that cracks the case. We clear the phone's system log, reproduce the problem, then read what happened.
Clear the log buffer:
adb logcat -cNow reproduce the symptom (in my case: put the phone on the charger and wait for the ad).
Then dump the log and look at what launched:
adb logcat -d > capture.logOpen capture.log and search for the moment the ad appeared. Two things to look for:
START/ activity launches — shows which app/Activity opened, and often the URL (dat=https://...).WindowManager ... addView— shows windows being drawn on screen, with the responsible class name.
In my log, right as the ad fired, I saw this repeating:
WindowManager: addView ... [UrlActionMessageOverlayService],
caller=...com.samsung.android.app.routines.preloadproviders.function.openurl.actions.UrlActionMessageOverlayService.onStartCommand…immediately followed by Microsoft Edge (com.microsoft.emmx) launching a browser tab.
Translation: a Samsung “Modes and Routines” automation with an “Open URL” action was firing and shoving an ad into my default browser. The log even printed the routine's name and configuration:
name = "Playing games while charging"
conditions = plugged_battery_v3 ; wifi_on_sdk3 (charging AND Wi-Fi on)
actions = connect_url_sdk3 (OPEN URL) ; ...I never created that routine. So what did?
Step 5: Find which app planted it
Legit apps don't usually create URL-opening automations. The most revealing question is: which apps were sideloaded or installed by something other than the Play Store?
List every third-party app with its installer:
adb shell pm list packages -3 -iEverything from com.android.vending (Google Play) or com.sec.android.app.samsungapps (Samsung Galaxy Store) is normal. What jumped out in my list was an installer I'd never heard of:
package:com.dreamgames.royalkingdom installer=com.LogiaGroup.LogiaDeck
package:net.peakgames.match installer=com.LogiaGroup.LogiaDeck
package:com.blackout.spades installer=com.LogiaGroup.LogiaDeckA mystery app called com.LogiaGroup.LogiaDeck had silently installed a bunch of games. Time to inspect it:
adb shell dumpsys package com.LogiaGroup.LogiaDeckThe internals were a full confession:
- Internal classes named
com.dti.phoenix.*— “DTI” = Digital Turbine Ignite, a notorious carrier app-monetization engine. - Server domains baked in:
delivers.dtignite.com,sti.dtignite.com. - APK pieces named
split_verizon.apk,split_dynamicInstalls.apk,split_wizard.apk. - The permission
INSTALL_PACKAGES= granted — meaning it can install apps silently, without asking.
So: a carrier-preloaded adware platform had the power to install apps on its own, did exactly that, and set up a Samsung routine to fire ads when charging. Mystery solved.
Step 6: Remove it (no root needed)
Carrier bloat usually has no “Uninstall” button. But you can remove it for your user profile with ADB — safe, reversible (a factory reset brings it back), and it doesn't need root:
adb shell pm uninstall -k --user 0 com.LogiaGroup.LogiaDeckI removed the junk games it had installed, too:
adb shell pm uninstall -k --user 0 com.dreamgames.royalkingdom
adb shell pm uninstall -k --user 0 net.peakgames.match
adb shell pm uninstall -k --user 0 com.blackout.spadesEach one returned Success.
disablevsuninstall: If you're nervous, you can freeze an app instead of removing it:adb shell pm disable-user --user 0 <package>
To reverse a--user 0uninstall later:adb shell cmd package install-existing <package>
Step 7: Delete the automation it created
Removing the app doesn't delete the routine it left behind — that runs on its own. On Samsung:
Settings → Modes and Routines → Routines → find the rogue routine (mine was “Playing games while charging”) → Delete it. Don't just toggle it off; delete it.
Step 8: Confirm it's gone
Verify nothing's left:
adb shell pm list packages | findstr LogiaDeck (Windows)
adb shell pm list packages | grep LogiaDeck (Mac/Linux)Blank output = gone. Then put the phone back on the charger and confirm: no more ads. Finally, turn Wireless debugging / USB debugging back off in Developer options.
The takeaways
- Not all “malware” is a malicious app icon. The sneakiest stuff hides in legitimate system features — here, a Samsung automation created by carrier software.
- The system log doesn't lie.
adb logcatat the exact moment of the symptom tells you precisely what launched. - Check who installed what.
pm list packages -3 -iinstantly separates “I installed this” from “something installed this for me.” - Carrier preloads are removable with
pm uninstall --user 0— no root, fully reversible. - Digital Turbine Ignite (it shows up under names like
com.dti.ignite,com.logia*, or as “DT Ignite”) is worth looking for on US carrier phones specifically. It's a common source of “where did this app come from?” surprises.
A phone you paid for shouldn't be serving you ads off a charging pad. Ten minutes with a free, official tool, and mine doesn't anymore.