Smartphones of the series Honor 9, despite their advanced age, continue to be actively used due to their successful design and stable operation. However, like any device based on an operating system Android, this model is subject to the risk of unwanted software. Hidden apps can slow down your system, waste your battery power, or worse, steal your personal data in the background.
Detecting such utilities requires careful attention, as malware developers often disguise their products as system processes or simply remove shortcuts from the desktop. In this article, we will analyze in detail standard scanning methods, the use of the engineering menu and professional tools for deep scanning of the file system of your device.
Understanding where unnecessary apps are hiding will help you regain control of your gadget. We will consider both simple methods available to any user, as well as more complex technical manipulations for advanced users.
Analysis of the list of installed apps through settings
The very first and obvious step is checking the standard section Settings. In the shell EMUI, which is installed on Honor 9, the menu structure may differ slightly from the stock Android, but the logic remains the same. You need to go to the application management menu, where the full register of installed software is displayed, including system components.
Pay attention to the sorting of the list. By default, the system often lists apps in alphabetical order or by frequency of use, which can hide utilities that you rarely run. Change display settings by selecting Sort by size or By installation time. This will allow you to identify applications that take up a lot of space or were installed during a suspicious period of time when you did not download anything new.
Particular attention should be paid to apps without icons or with names consisting of a set of characters. Often, malware is disguised as Google services or system processes with similar names, for example System Update Service instead of the official one Google Play Services. If you see duplicate names or strange processes, this is a reason for a detailed check.
In this section you can also see the status of each application. Look for marks Disabled or Hidden. Some launchers allow you to hide icons directly from the interface settings, without uninstalling the application itself. Check to see if the Hidden Apps feature is enabled in your desktop settings.
⚠️ Attention: Do not delete system applications whose purpose you are not sure of. Removing critical components EMUI may lead to unstable operation of the phone or the inability to boot the system.
☑️ Checking the list of applications
Using developer mode and usage statistics
If the standard list did not reveal suspicious activity, It's worth digging deeper with battery and data usage statistics. Hidden applications running in the background inevitably consume resources. To see the full picture, activate developer mode on your Honor 9. To do this, go to Settings → About phone and quickly press 7 times on the item Build number.
After activation, a new section will appear in the main settings menu For developers. Here you should be interested in the item Process statistics or Running services. This screen shows all currently active processes, even those that do not have a user interface. The names of malware packages that are not visible in the regular list of applications often pop up here.
The section Battery in the main ones is also extremely informative settings. Click on the menu (three dots in the corner) and select Battery consumption. The system will show a detailed graph of energy consumption by each application. If you see a app with an unclear name that consumes 10-15% of the charge, although you have not used it, this is a clear sign of a hidden miner or spy.
For a more accurate analysis, you can use commands via ADB (Android Debug Bridge) by connecting the phone to the computer. This will unload the full list of packages, including those hidden from the user interface. The command to display a list of all packages is as follows:
adb shell pm list packages -fThis method requires drivers and a configured environment on the PC, but it gives the most objective picture of what is actually installed on the system.
What to do if the process cannot be stopped?
If in the process statistics you see an application that does not stop and is constantly restarted, most likely it has received device administrator rights. You need to go to Settings → Security → Device Administrators and revoke the rights of the suspicious app before attempting to remove it.
Checking administrator rights and special access
Modern viruses and hidden applications often protect themselves from removal by gaining extended privileges. On Honor 9 under control Android any user can check which apps have administrator rights. This is a critically important step, since an application with such rights can block its uninstallation through the standard menu.
Go to the section Settings → Security → Device Administrators. Here you will see a list of apps that have full control over the device. Normally, there should only be system services here, such as Find My Device (Search for device) or corporate clients if the phone is used for work. The presence of unknown applications in this list is a red flag.
In addition to administrator rights, it is worth checking the section Special access. In new versions Android dangerous permissions such as “On top of other applications” and “Access to notifications” are hidden here. An application that has the right to draw on top of other windows can replace the interfaces of banking apps or hide its own activity windows.
To find such permissions, use the path Settings → Applications → Special access. Go through each sub-item of this menu. Study especially carefully the list of apps that have access to Notifications. Attackers use this access to intercept SMS with confirmation codes from banks.
⚠️ Attention: If you revoke administrator rights from a system application, the phone may ask for confirmation or reboot. Make sure that you do not disable Google Play services or the system launcher.
Scanning the system with third-party analyzers
Standard tools Honor are good for a basic scan, but specialized software often finds what the system misses. For in-depth analysis, it is recommended to use analyzer applications that show the file system structure and dependencies between packages. One of the effective tools is Sensor Box or specialized antiviruses with a rootkit search function.
When installing a third-party scanner, make sure that you download it from the official store Google Play or AppGallery. Avoid installing hacked versions of antiviruses, as they themselves may contain malicious code. After installation, conduct a full scan of the system, allowing the application access to all files.
A special class of apps are hidden process analyzers, such as Hidden Settings or Activity Launcher. They allow you to see all activities recorded in the system, including hidden settings of the engineering menu and test modes that are usually inaccessible to the user. Through these utilities, you can find shortcuts for hidden applications and launch them for visual identification.
If the scanner detects a threat but cannot remove it, try booting your phone into Safe Mode. In this mode, only system applications are loaded, which makes it easy to find and remove malicious apps that are usually disguised or block removal.
| Application type | Risk for Honor 9 | Detection method | Removal method |
|---|---|---|---|
| Advertising virus (Adware) | High (spam, slowdowns) | Battery statistics, pop-ups | Removal through application settings |
| Spyware | Critical (data theft) | Checking microphone/SMS access rights | Resetting settings or root access |
| System Bloatware | Low (space occupied) | List of installed ones applications | Disable via ADB |
| Miner | High (overheating, wear) | CPU monitoring when idle | Full reset (Hard Reset) |
Before installing any analyzer, check its rating and reviews. Avoid applications with the name "Clean Master" from unknown developers, as they themselves are often a source of advertising.
Search through the file manager and engineering menu
An advanced search method involves manual inspection of the file system. The Honor 9 built-in file manager allows you to view the contents of the internal memory. Go to the root directory and look for folders with names that do not match the applications you have installed. Often hidden apps create their directories in the section Android/data or in the root of memory.
Look for folders with names containing a random set of letters and numbers, or masquerading as system ones, for example .sys_update (with a dot at the beginning, which makes the folder hidden in some explorers). To view hidden files, enable the appropriate option in the Explorer settings (usually three dots → Settings → Show hidden files).
You can also use the engineering menu to check the status of the phone. Enter the code ##2846579## in the Phone application. The ProjectMenu will open. Although there is no direct list of applications, the Network Information Setting or Software Upgrade section can show the firmware version and the presence of non-standard modifications. If the menu does not open or looks different, the system may be compromised.
Analysis of system logs can also provide clues. To do this, you will need to connect to a PC and use the utility logcat. Filtering logs by tags PackageManager or ActivityManager will show which applications are launched when the system boots, even if they do not have an interface.
⚠️ Attention: Making changes to the engineering menu without an accurate understanding of the consequences can lead to loss of the network or inoperability of communication modules. Use this section only to view information.
Radical measures: Reset and flashing
If none of the above methods helped get rid of suspicious activity, or if the hidden application has superuser rights (Root) and is not removed, the last option remains - a full reset settings. Before this procedure, be sure to create a backup copy of important data (photos, contacts) to an external drive or to the cloud, but do not save a backup copy of the applications themselvesso as not to restore the virus along with the data.
Perform a Hard Reset through the Recovery menu. Turn off the phone, then hold down the Volume up and Power buttons at the same time. In the menu that appears, select Wipe data/factory reset. This will delete all user data and return the phone to its factory state, destroying most types of malware that are not built into the firmware itself.
In extreme cases, when the virus is in the system partition (which is rare for ordinary users, but possible after installing custom firmware), you will need to flash the device via a computer using the utility Huawei eRecovery or HiSuite. The official firmware will overwrite the system partition, guaranteed to remove any modifications.
After returning to factory settings, be careful when installing applications. Enable the feature Play Protect in Google Play settings and avoid installing APK files from unverified sources. Regularly checking the list of applications will help prevent re-infection.
Hard Reset is the most reliable way to remove hidden applications if they are not built into the manufacturer's firmware.
Frequently asked questions (FAQ)
Can a hidden application work if the phone turned off?
No, the software cannot function on a completely turned off device, since the processor and memory are de-energized. However, some viruses can simulate turning off the screen, leaving the phone on in the background. If the phone gets warm in your pocket when the screen is “off”, check if some application is not working.
Why is the application not removed, is the “Delete” button inactive?
Most likely, the application has device administrator rights or is a system component of the firmware. First go to Settings → Security → Device Administrators and disable the rights for this app. After this, the delete button will become active. System applications will require uninstallation via ADB.
Is it safe to use applications to hide other apps?
Using legal tools to hide icons (for example, a built-in function in the launcher) is safe. However, downloading third-party “hidden safes” from untrusted sources is risky, as they may request excessive permissions to access your files and camera.
How to distinguish a system process from a virus in the application list?
System processes usually have the Android or manufacturer logo (Huawei/Honor) and names like Google Services Framework, Android System. Viruses often have strange names, no icons, or low-quality icons. Google the name of the suspicious process before deleting.
Does a factory reset remove viruses from the internal memory?
Yes, a standard factory reset (Factory Reset) formats the user memory section, deleting all installed applications and their data. Viruses located only in user space will be destroyed. Viruses in the system partition require flashing.