Viruses on Android devices are a problem that every fifth user faces. According to data Kaspersky for 2026, 22% of mobile threats are disguised as legitimate applications, and 14% are distributed through phishing links in instant messengers. But if your smartphone starts to slow down, show annoying ads, or install apps on its own, this is not a death sentence. In 90% of cases, the virus can be removed without losing data if you act correctly.

In this article you will find 7 proven methods cleaning Android from malware - from simple (antivirus scanning) to radical (flashing). We will look at how to determine the type of infection, what tools to use for Samsung, Xiaomi, Huawei and other brands, and what to do if the virus has blocked access to the settings. All instructions are relevant for Android 10-15 and do not require root access.

⚠️ Important: Some viruses (for example, Triada or Agent Smith) are embedded in system processes. If the problem remains after cleaning, this is a sign of deep infection. In this case, only full reset or flashing will help.

📊 How do you usually protect your Android from viruses?
I install an antivirus
I don’t download applications from unknown sources
I update the OS regularly
I don’t protect it in any way
Another way

1. Signs of infection: how to understand that there is a virus on Android

Viruses on Android rarely behave obviously - most modern threats are disguised as system processes. Here 10 key symptomsthat should alert you:

  • 📱 A sharp increase in traffic consumption (the virus can send SMS to paid numbers or load ads in the background).
  • 🔋 Rapid battery drain (malware often uses device resources for mining cryptocurrency).
  • 📲 The appearance of unknown applications (especially with names like com.system.update or android.engine).
  • 💰 Writes off money from the account (viruses like Joker sign the user for paid services).
  • 🔒 Lock screen with ransom demand (ransomware, for example, LeakerLocker).
  • 📢 Pop-up advertisement outside browser (adware sign, for example, HiddenAds).
  • 📡 Self-sending messages (the virus sends itself to your contacts).
  • 🛠️ Inability to delete the application (system rights or disguised as a Google service).
  • 🌐 Redirection to strange sites when opening the browser.
  • 📉 Slowdown (the virus loads the processor or memory).

If you notice at least 2-3 signs from the list, the probability of infection is 85%But before you panic, check your device. on false positives:

  • 🔍 Go to Settings → Applications and check the list of installed apps.
  • 📊 Open Settings → Battery → Battery Usage —unknown processes with high consumption should alert you.
  • 📶 Look Settings → Mobile network → Traffic consumption —if some application “eats” gigabytes for no reason, it’s suspicious.
⚠️ Attention: some "symptoms" may not be caused by viruses, but problems with firmware or CPU overheatingFor example, rapid battery drain on Samsung Galaxy S22 after updating to One UI 6.0 is a known error not related to malware.

2. data-i="97">The first step in the fight against viruses is

The first step in the fight against viruses is deep scan devices. Despite the fact that Google Play Protect is built into the system, it only detects 40% of threats (data AV-Test, 2026 For reliability, use specialized antiviruses.

Here TOP-5 free antiviruses with a high level of detection (according to test results AV-Comparatives):

Antivirus Detection level Additional functions Cons
Bitdefender Mobile Security 99.8% VPN (200 MB/day), phishing blocking Paid version for full functionality
Kaspersky Mobile Antivirus 99.5% Protection against ransomware, checking links No protection against mining in the free version
Malwarebytes 98.7% Adware removal, cleaning of unnecessary files No real protection (scanning only)
Avira Antivirus 97.3% Memory optimizer, call blocking Lots of advertising in the free version
ESET Mobile Security 99.1% Anti-phishing, checking Wi-Fi networks Complicated interface for beginners

How to scan correctly:

  1. Download the antivirus only from Google Play (not from third-party sites!).
  2. Update the virus databases in the app settings.
  3. Run full scan (not fast!). It will take 10-30 minutes.
  4. If threats are found, remove them through the antivirus interface.
  5. Reboot the device and check if the symptoms have disappeared.

Close all applications

Connect the charger

Disable power saving mode

Enable mobile data or Wi-Fi

Do not use the phone while scanning-->

⚠️ Attention: some viruses (for example, FakeApp) block the installation of antiviruses. If you cannot download the app:

  • 📥 Try downloading .apk the antivirus file to your computer, and then transfer it to your phone via USB.
  • 🔄 Restart the device in safe mode (press the power button → hold down "Turn off" → agree to enter safe mode).

3. Manual cleaning: how to remove a virus without an antivirus

If an antivirus did not help or you cannot install it - you will have to act manually. Most viruses on Android are divided into 3 types:

  1. Adware - shows advertisements (the easiest way to remove).
  2. Trojan - disguises itself as legitimate applications (requires rights verification).
  3. Rootkit - is embedded in system files (can only be removed by resetting or flashing).

Instructions for manual cleaning:

Step 1: Checking installed applications

Go to Settings → Applications → List of all applications i:

  • 🔍 Sort apps by installation date - viruses often appear after recent downloads.
  • 🚫 Remove suspicious applications (especially those that you did not install).
  • ⚙️ For system applications (which are not deleted) — disable them and clear the cache.

Step 2: Checking device administrators

Some viruses (for example, Android.Triada) receive administrator rights, which prevents their removal. To revoke rights:

  1. Go to Settings → Security → Device administrators (on some firmware the path may differ: Settings → Lock screen and security → Other security settings → Phone administrators).
  2. Uncheck unknown applications.
  3. Go back to the list of applications and delete them.

Step 3: Clearing adware (pop-up ads)

If advertising appears even when the browser is closed:

  • 📵 Check the list Accessibility (Settings → Accessibility → Installed services) - some viruses use this function to display advertising on top of other applications.
  • 🛑 Disable window overlay for suspicious apps (Settings → Applications → ⋮ → Special access → Overlay on other applications).
💡

If you cannot find the virus in the list of applications, try entering its name in the search settings (magnifying glass icon in the upper right corner).

Step 4: Checking startup

Viruses often add themselves to autostart. To disable:

  • 🔄 Go to Settings → Applications → ⋮ → Autostart (to Xiaomi path: Settings → Battery and performance → Autorun management).
  • 🚫 Disable autorun for unknown apps.

If after manual cleaning the problem remains, the virus could get root access or infiltrate system files. In this case, this will help. only reset to factory settings or flashing.

4. Removing the virus through safe mode

Safe mode (Safe Mode) loads Android with a minimal set of drivers and disables all third-party applications. This will help remove the virus if it:

  • 🔒 Blocks access to settings.
  • 📵 Interferes with the installation of the antivirus.
  • 🔄 Reboots on its own. device.

How to enter safe mode:

  1. Hold the button poweruntil the shutdown menu appears.
  2. Hold your finger on the option "Turn off" (or "Turn off power") for 3-5 seconds.
  3. Confirm entering safe mode (on some devices you need to click "OK" in the window that appears).

The message appears on the screen "Safe Mode" in lower left corner. Now:

  • 🔍 Check the list of applications and remove suspicious ones.
  • 🛠️ Install an antivirus and scan.
  • 🔄 Reboot the device as usual. mode.
⚠️ Attention: on some devices (for example, Samsung Galaxy A54 s One UI 5.1), entering safe mode is done differently:
  1. Turn off the phone.
  2. Press the Power and Volume Down button at the same time.
  3. Hold until the logo appears Samsung, then release.

The exact method depends on the model - check the instructions for the device.

💡

Safe mode does not automatically remove viruses - it only blocks their operation, giving you the opportunity to act.

5. Reset to factory settings: radical. method

If there is a virus not removed or you cannot log in (for example, due to a screen lock with a ransom demand), all that remains is full resetThis will remove:

  • 📱 All installed applications and their data.
  • 📁 Photos, videos and music (if they are not saved on a memory card or in the cloud).
  • 🔑 Accounts and passwords (except those synchronized with Google).
  • ⚙️ All settings (Wi-Fi, Bluetooth, wallpaper, etc.).

How to reset:

  1. Create a backup copy of important data (contacts, photos, messages).
  2. Go to Settings → System → Reset settings → Delete all data.
  3. Confirm the action (you may need to enter a PIN code or pattern).
  4. Wait for the process to complete (takes 5-15 minutes).

If there is a virus has blocked access to the settings, you can reset the device through recovery mode (Recovery Mode):

  1. Turn off the phone.
  2. Hold down the button combination (depending on the model):
    • For Samsung: Power + Volume up + Bixby.
    • For Xiaomi/Redmi: Power + Volume up.
    • For Google Pixel: Power + Volume down.
  • In the recovery menu, select "Wipe data/factory reset" (volume button control, confirmation - power button).
  • After the reset, select "Reboot system now".
    • What to do if the reset did not help?

    If after a complete reset the virus remains, this is a sign infection of the boot partition or incorporation into the firmware. In this case, only flashing the device via Odin (for Samsung), Fastboot (for Google Pixel) or SP Flash Tool (for Mediatek) will help. This process requires technical skills and can lead to a "brick" device in case of an error.

    6. Reflashing: a last resort against persistent viruses

    Reflashing is complete reinstallation of the operating system. will remove all data, including viruses embedded in system files. This method is recommended if:

    • 🔄 Resetting to factory settings did not help.
    • 🛡️ The virus blocks the system from loading (the logo appears and the phone turns off).
    • 📱 The device has become a "brick" (brick) after an unsuccessful update.

    ⚠️ Attention: reflashing will void the warranty (if you do not use official software) and can lead to data loss. If you are not confident in your skills, contact the service center.

    General flashing algorithm:

    1. 📥 Download official firmware for your model from the manufacturer's website:
  • 🖥️ Install the necessary drivers and tools:
    • For Samsung: Odin + drivers Samsung USB.
    • For Xiaomi: Mi Flash Tool.
    • For Google Pixel: Android SDK Platform Tools (fastboot).
    • 📱 Connect the phone to the PC in Fastboot or Download Mode (for button combinations, see the device instructions).
    • 🔧 Run the firmware through the appropriate tool (for example, Odin click AP → select the firmware file → Start).
    • ⏳ Wait for completion (do not disconnect the USB cable!).

    After flashing:

    • 🔄 The phone will reboot and be like new.
    • 🔒 You need to re-configure your Google account and restore data from a backup.
    • 🛡️ Immediately install an antivirus and check the system.
    ⚠️ Attention: firmware from unofficial sources (for example, custom ROMs type LineageOS) may contain own vulnerabilities. Use only official software from the manufacturer.

    7. How to protect Android from viruses in the future

    The best protection against viruses - prevention. By following these rules, you will reduce the risk of infection by 95%:

    • 🛡️ Install an antivirus (for example, Bitdefender or Kaspersky) and update its database once a week.
    • 📥 Download applications only from Google Play (the risk of infection through APK files is 10 times higher).
    • 🔄 Update Android —vulnerabilities are closed in new versions (for example, in Android 14 fixed 45 critical bugs).
    • 🔒 Do not give applications unnecessary permissions (for example, access to SMS or contacts for the game).
    • 🌐 Do not follow suspicious links (especially in SMS and messengers).
    • 📶 Avoid public Wi-Fi without a VPN (viruses can spread through vulnerabilities in networks).
    • 📱 Set up Google Play Protect (Play Store → Profile → Play Protect → Scan device).

    Additional measures for advanced users:

    • 🔐 Encrypt device (Settings → Security → Phone encryption).
    • 🛠️ Install custom recovery (for example, TWRP) to create full backups.
    • 📋 Check application permissions regularly via Settings → Applications → Permissions.
    💡

    Even legitimate applications from Google Play may contain malicious code. In 2026 Google removed more than 100. 000 applications Always read reviews before installing!

    FAQ: Frequently asked questions about viruses on Android

    Is it possible to remove a virus without resetting the settings?

    Yes, in 80% of cases the virus is removed by an antivirus or manually through the settings. A reset is required only if the virus has acquired administrator rights or has infiltrated system files. Try first safe mode + manual cleaning.

    The virus requires payment to unlock the phone. What to do?

    This is ransomware (ransomware virus). Do not pay under any circumstances - this does not guarantee unlocking. Try:

    1. Log in safe mode and remove suspicious applications.
    2. Reset the phone via recovery (if the lock prevents you from logging in).
    3. Contact No More Ransom —there are tools for decrypting some types of ransomware.
    The antivirus finds the virus, but cannot remove it. Why?

    This happens if:

    • The virus has administrator rights (revoke them in the security settings).
    • Application built into the firmware (needs reset or flashing).
    • Virus disguises as a system process (try deleting in safe mode).

    If all else fails, do reset to factory settings.

    Can a virus damage the phone's hardware?

    No, viruses cannot physically damage the processor or battery. However, they can:

    • 🔋 Accelerate battery wear (continuous work in the background).
    • 📡 Overheat the device (cryptocurrency miners load the processor).
    • 📱 Lead to "brick" (if a virus damages boot sector).

    After removing the virus, check the battery status through Settings → Battery → Status.

    How to check your phone for viruses from a computer?

    You can connect Android to your PC and scan it using desktop antiviruses:

    1. Connect your phone via USB in file transfer mode.
    2. Install on PC Kaspersky Total Security or Dr.Web CureIt.
    3. Select the option to scan external devices.
    4. Wait for the scan to complete and remove the threats found.

    ⚠️ This method will find viruses in files, but will not be able to remove those running in the phone's memory.