Modern mobile threats have become much more complex, and standard antiviruses on smartphones do not always cope with deep system infections. When a device begins to behave unpredictably, the best solution is often to connect it to a desktop computer. This allows you to gain wider access to the file system and use powerful scanning tools that are not available in a mobile environment.
Using a PC makes it possible not only to delete a file, but also to completely block the possibility of its reactivation through system services. In this article, we will look at professional cleaning methods, ranging from simply scanning the drive to using debugging tools to forcefully remove malicious code.
Diagnosing symptoms of infection before connecting
Before taking active steps, you need to clearly identify the problem. Users often confuse system crashes or lack of RAM with a virus attack. If your Android smartphone begins to discharge after several hours in standby mode, this is a clear sign of background malware activity.
Pay attention to pop-up advertisements. If banners appear on the desktop or on top of other applications, it means that a suspicious extension or service is installed on the system. Also an alarming bell is the sudden disappearance of application icons or the inability to enter security settings.
- 📉 A sharp drop in performance and strong heating of the case without load.
- 🔒 Screen lock with the requirement to unlock via SMS or money transfer.
- 📡 Unexplained expense Internet traffic in the background.
It is important to understand that some types of threats, such as ransomware Trojans, can operate covertly until activated. Therefore, even in the absence of obvious symptoms, but if there are suspicious actions on the part of the user (downloading APK from unverified sources), a preventive check will not hurt.
⚠️ Attention: If a virus blocks the screen and demands a ransom, do not send money under any circumstances. This will not unlock the phone, but will only confirm to attackers that you can be manipulated.
Basic cleaning through storage mode
The simplest and most accessible method that does not require the installation of complex software is to switch the phone to USB storage mode. In this case, the computer operating system sees the internal memory of the smartphone as a regular flash drive. This allows you to run a full scan with the antivirus installed on your PC.
First, connect the device with a cable to the computer. A notification about the connection mode will appear on the phone screen. Select option File transfer or MTP. If you have an old device, you may need a mode USB Mass Storagethat mounts the memory as a disk.
Run your antivirus on your computer (for example, Kaspersky, Dr.Web or ESET) and select scanning the removable drive. This method is effective against file viruses that are stored in a folder Download or on a memory card, but it is powerless against system Trojans integrated into the firmware.
Before scanning, be sure to remove the microSD memory card and check it separately on the PC, since it often carries infected files.
If the antivirus finds threats, it will offer options for action. It is best to choose complete file deletion rather than just treatment. After cleaning, be sure to reboot your smartphone to make sure that the malicious process has not restarted.
Using specialized software for Android
For a deeper scan, there are utilities designed specifically for interacting with mobile operating systems via a PC. The leader in this niche is Dr.Web CureIt! for mobile devices, which can be launched remotely, or complex solutions like 360 Total Security.
These apps can analyze not only files, but also installed application packages. They check digital signatures and compare file hashes with a database of known threats. This allows you to identify modified versions of popular apps in which malicious code is embedded.
| Utility name | Scan type | Need for Root | Efficiency |
|---|---|---|---|
| Dr.Web LinkScanner | Network traffic | No | High |
| Kaspersky Virus Removal Tool | File | No | Average |
| Malwarebytes Anti-Malware | Behavioral | No | High |
| ESET Mobile Security | Complex | No | High |
The installation process for such software is standard: download the installer to your PC, connect your phone and follow the instructions of the setup wizard. The app will automatically detect the device and offer the optimal test scenario. In some cases, you may need to install an agent application directly on your phone to provide access rights.
Remember that the virus databases are updated daily. Before running the scan, make sure that your anti-virus software on your computer has the latest version of signatures. An outdated database may miss new strains of Trojans developed in recent weeks.
Manual removal via USB debugging (ADB)
This is a method for advanced users that allows you to remove a virus that cannot be erased by conventional methods. The tool ADB (Android Debug Bridge) gives access to the device command line from a computer. It allows you to manage application packages even if the phone interface is blocked by malware.
First, you need to activate developer mode on your smartphone. Go to Settings → About phone and quickly click 7 times on the item Build number. Then in the menu that appears For developers turn on the toggle switch USB debugging.
adb devicesAfter connection Enter this command at your computer's command prompt. If everything is configured correctly, you will see the serial number of your device. Next, you can get a list of all installed packages to identify suspicious ones.
adb shell pm list packagesFind the name of the virus package (often it differs from the name of the icon, for example, com.android.system.update.fake). To remove, use the uninstall command. This method requires caution, since removing a system package may lead to unstable operation of the OS.
⚠️ Attention: ADB commands have high privileges. An error in the name of the package may remove critical system components, which will require flashing the device.
☑️ Preparing to work with ADB
Removing viruses with Superuser rights
If the virus has received rights device administrator, it is almost impossible to remove it using standard methods. It will automatically restore its files every time you try to delete it. In such cases, access to the root directory of the system is required.
Presence root access allows file managers on the PC (such as Root Explorer if you have the appropriate software on the phone or through ADB with superuser rights) to see hidden system partitions. You can manually find the virus executable file in the /system/app or /data/app folders and delete it.
However, obtaining root access on an infected device is a risky operation. The virus can hijack the rooting process and infiltrate even deeper. It is recommended that you first try resetting administrator rights in the security settings, and only then resort to drastic measures.
How to find a virus in system folders?
Look for files with a recent modification date in the /system/priv-app or /data/local/tmp folders. Malware is often disguised as system process names, for example, com.google.service.check, but has a different size or signature from the original.
After manually deleting files, you need to clear the Dalvik/ART cache so that the system does not try to launch deleted components from temporary storage. This can be done through the recovery menu or a special command through the terminal.
Radical measures: Reset and flashing
When none of the software methods help, the only guaranteed way remains is a complete reset (Hard Reset) or flashing. The reset deletes all user data and returns the phone to its factory state, erasing the partition /data.
To perform a reset via a computer, you can use the manufacturer's proprietary utilities. For Samsung it is Odin, for Xiaomi - Mi Flash Tool, for devices running pure Android - Fastboot. These tools load a clean image of the system, completely replacing the contents of memory.
Before the procedure, be sure to back up important data (photos, contacts), but do not save a backup copy of applications, since the virus can be saved in the archive and restored along with them. Save only media files and documents.
⚠️ Attention: The flashing procedure via a computer is irreversible. All data on the internal drive will be destroyed without the possibility of recovery.
Full flashing via a computer is a 100% guarantee of removing any software virus, since the entire system partition of the device is replaced.
After successfully installing the new firmware, the phone will boot like new. You'll need to re-set up your Google account and install apps. At this stage, it is important not to restore settings from an old backup, so as not to return the problem.
Prevention and protection in the future
After successful cleaning, it is important to change your smartphone usage habits to avoid re-infection. The main reason for viruses is the installation of applications from third-party sources. Try to use only the official store Google Play.
Regularly update the operating system and installed applications. Developers are constantly closing security vulnerabilities that hackers exploit. Enable the function Google Play Protection in the settings, which automatically scans applications for threats.
- 🛡️ Do not follow suspicious links in SMS and instant messengers.
- 🚫 Disable installation from unknown sources in the security settings.
- 👀 Carefully read the permissions that applications request during installation.
Use a reliable antivirus with web protection. Even free versions of popular antiviruses can block transition to phishing sites and warn about attempts to install dangerous software.
Frequently asked questions (FAQ)
Is it possible to remove a virus if the phone does not turn on?
Yes, if the phone responds to connecting to a PC, you can try entering Recovery mode or Fastboot and perform a data reset (Wipe Data) through the computer using ADB commands or proprietary utilities.
Is it dangerous to connect an infected phone to a personal computer?
The risk is minimal if an active antivirus is installed on the PC. Viruses for Android (APK files) cannot be executed in the Windows environment. However, you should avoid opening files from your phone directly without first scanning.
Will photos be saved after cleaning via a computer?
When using anti-virus scanning in drive mode - yes. When using a Hard Reset or flashing, all data will be deleted, so a backup is required.
How to understand that the virus has been completely removed?
Main signs: pop-up advertising has disappeared, battery consumption has returned to normal, the phone has stopped heating up when idle, unknown applications have disappeared from the list of installed apps.