How to clean Android from a Trojan: 7 proven methods (without resetting to factory settings)

Trojan apps on Android are becoming more and more sophisticated: they disguise themselves as legitimate applications, steal bank card data, spy on the user through a camera or microphone, and sometimes even block the device with a ransom demand. According to data Kaspersky for 2026, every fifth mobile virus refers specifically to Trojans - and their number is growing by 30% annually. However, most users find out about the infection too late, when the malware has already caused damage.

A contrasting feature of modern Trojans is that they often do not reduce the performance of a smartphone, as viruses did 5 years ago. Instead, they work in the background, remaining undetected for months. For example, a Trojan can collect logins and passwords for years, and intercept SMS with confirmation codes. How to identify and remove such an “invisible”? In this article we will analyze Anubis can collect logins and passwords for years, and Cerberus — intercept SMS with confirmation codes. How to identify and remove such an “invisible”? In this article we will analyze 7 working methodsincluding hidden Android functions that 90% of users do not know.

It is important to understand: a Trojan is not just a "virus", but targeted appthat performs specific destructive tasks. It can be downloaded along with a pirated APK, a fake system update, or even through a vulnerability in a legitimate application (as was the case with the Trojan Jokerthat penetrated games from Google Play). Therefore, standard advice like “remove suspicious apps” often does not work here - systemic measures are needed.

1. Signs of a Trojan infection: how to recognize a threat at an early stage

Trojans rarely show themselves with obvious symptoms such as constant notifications or sudden reboots. Instead, they act covertly, but leave indirect traces. Here 5 key signalsthat should alert you:

• 📱 Unexplained increase in traffic. Trojans often send data to remote servers. Check your mobile data consumption in Settings → Network and Internet → Data transfer. If background consumption has increased by 2-3 times without reason, this is an alarming sign.
• 💳 SMS with unfamiliar codes. Trojans like FluBot intercept SMS to bypass two-factor authentication. If you receive messages with codes from services that you have not used, your number is already in the attackers’ database.
• 🔋 Fast battery drain in standby mode. Modern Trojans are optimized for energy saving, but some (for example, mining ones) can drain the battery in 4-5 hours without active use.
• 📲 Appearance of unknown applications. Check the list of installed apps in Settings → Applications. Trojans are often disguised as system utilities with names like Android System WebView or Google Play Services Update.
• 🔍 Advertising in unexpected places. If banners appear on top of lock screens or in system menus, this is the work of a Trojan adver (HiddenAds). Such viruses can show up to 50 advertising windows per hour.

Trojans are especially dangerous. not displayed in the list of applications. They are embedded in system processes (for example, com.android.phone) and are removed only through ADB or resetting the settings. To identify such "ghosts", use the command:

adb shell pm list packages -f | grep"suspicious_keyword"

Replace suspicious_keyword with part of the name of the suspicious package (for example, bank, update, service). If the command returns the result, you definitely have a Trojan.

⚠️ Attention: Some Trojans (for example, BlackRock) block access to security settings. If you cannot open the section Settings → Security or antivirus, this is a sure sign of a deep infection. In this case, immediately go to method 7 (reset via Fastboot).

2. Method 1: Removing the Trojan through safe mode (works in 60% of cases)

Safe Mode (Safe Mode) loads Android with a minimal set of drivers and blocks all third-party applications., including Trojans. This is the only way to remove a virus that prevents you from opening settings or an antivirus.

To enter safe mode:

1. Hold the button power until the shutdown menu appears.
2. Hold your finger on the option "Turn off" (or "Restart" on some models Samsung/Xiaomi) until the request to go to Safe Mode.
3. Confirm the action appears at the bottom of the screen "Safe Mode".

Now follow these steps:

Pay special attention to applications with rights administrator. Trojans often request them under the pretext of "protecting the device." Security → Device Administrators

1. Go to Settings → Security → Device Administrators.
2. Uncheck unknown apps (for example, Device Admin, Security Service).
3. If the item is unavailable, this is a sign of a system Trojan. Go to Method 4.

Critical detail: some Trojans (for example, Triada) restore themselves after deletion. If the virus returns after exiting safe mode, this means that it is embedded in the system partition. In this case, only flashing or resetting via Fastboot.

3 will help. Method 2: Deep scan with an antivirus (but not what you think)

Standard antiviruses like Avast or Dr.Web often miss new generation Trojans. The fact is that modern malware uses polymorphic. code they change their signature every time they run, bypassing virus databases. Therefore, specialized tools are needed:

Antivirus	Specialization	Effectiveness against Trojans	Features
Malwarebytes	Search for rootkits and spyware	85%	Scans system processes, detects Trojans even without signatures
Kaspersky Mobile	Banking Trojans (Anubis, Cerberus)	92%	Has a protection module against phishing and SMS interception
Bitdefender Mobile	Trojan miners and botnets	88%	Uses cloud scanning to detect new threats
Zimperium zIPS	Android kernel vulnerabilities	79%	Identifies Trojans that exploit vulnerabilities in Mediaserver

For maximum efficiency, follow these steps:

1. Install two antiviruses from the table above (for example, Malwarebytes + Kaspersky).
2. Run full scan (not fast!) in safe mode.
3. If the antivirus finds threats, but cannot remove them - export the scan log and check the names of the packages through the service VirusTotal.
4. For Trojans masquerading as system files, use the command:

   adb shell"su -c'find /system -name"trojan_keyword"'

⚠️ Attention: Some Trojans block the installation of antiviruses, displaying the error "The application is incompatible with the device." data-i="150">via the link Malwarebytes follow the link https://www.malwarebytes.com/mobile).

4. Method 3: Manual removal via ADB (for experienced users)

Android Debug Bridge (ADB) is a tool that allows you to control your smartphone via the PC command line. With its help, you can remove even those Trojans that are not displayed in the Android interface. This method requires enabled USB debugging and works on all versions of Android, including Android 14.

Step-by-step guide:

1. Download Platform Tools from the official website Google (https://developer.android.com/studio/releases/platform-tools).
2. Connect your smartphone to the PC and enable USB debugging (enabled in Settings → About phone → Build number - press 7 times, then return to Settings → System → For developers).
3. Open the command line (Windows) or terminal (macOS/Linux) in the folder with platform-tools.
4. Run the commands in order:

   adb devices
   adb shell
   pm list packages | grep"suspicious"
   pm uninstall -k --user 0 com.trojan.package.name

If the Trojan has blocked ADB, try an alternative method via Fastboot:

adb shell"su -c'mount -o rw,remount /system'"
adb shell"su -c'rm /system/app/TrojanApp.apk'"
adb shell"su -c'rm /system/priv-app/TrojanApp.odex'"

For Trojans embedded in system libraries (for example, XHelper), a kernel patch will be required. In this case, it is easier to perform a full reset via Fastboot.

What to do if ADB does not see the device?

1. Check if they are installed. drivers (download for Windows Google USB Driver).

2. Try another USB cable (preferably the original one).

3. Enable the option USB debugging (security settings) in the developer settings and OEM unlocking.

4. If you use Miui or EMUI, additionally activate USB debugging (parameters security) in the developer menu.

5. Method 4: Removing the Trojan via TWRP (for flashed devices)

If you have a custom recovery installed on your smartphone TWRP, you have a unique opportunity to remove the Trojan even from the system partition. This method works on 90% of flashed devices and allows you to bypass the limitations of the standard one. mode.

Instructions:

1. Boot into TWRP (usually by holding Power + Volume Up when turning on).
2. Go to section Advanced → File Manager.
3. Open folders:
   • /system/app/
   • /system/priv-app/
   • /data/app/

Delete files with suspicious names (for example, com.android.update.service.apk, systemwebview.apk).

Wipe the cache (Wipe → Cache) and reboot.

For Trojans that modify build.prop, do additional steps:

adb pull /system/build.prop
Edit the file in Notepad, deleting the lines with:
ro.trojan.injected=1
persist.trojan.enable=true
adb push build.prop /system/
adb shell"chmod 644 /system/build.prop"

⚠️ Attention: Incorrect editing of system files through TWRP can lead to bootloop (loop reboot). If you are not sure of your actions, make a backup. section /system before changes (in TWRP this is an option Backup → System Image).

6. Method 5: Blocking the Trojan through the hosts file (temporary solution)

If the Trojan contacts remote server to receive commands, you can block this communication channel by editing the file. This will not remove the virus, but will stop its activity. The method works on all versions of Android, including Instructions: Download any file manager with access to the root folder. (for example, hosts. This will not remove the virus, but it will stop its activity. The method works on all versions of Android, including Android 13/14.

Instructions:

1. Download any file manager with access to the root folder (for example, FX File Explorer or Solid Explorer).
2. Go to the path /system/etc/hosts.
3. Open the file in a text editor and add the lines:

   127.0.0.1 trojan-server.com
   127.0.0.1 malicious-domain.net
   127.0.0.1 ad-tracker[.]xyz

   Replace the addresses with those used by your Trojan (they can be found in the antivirus logs or through ADB logcat).

4. Save the file and reboot the device.

To find the Trojan server addresses, use the command:

adb logcat | grep -i"connect to"

Or check network activity through NetGuard (traffic monitoring application).

This method is especially effective against:

• 📊 Spy Trojans (Pegasus, FinFisher), which transmit data to C&C servers.
• 💰 Banking Trojans (Anubis, Cerberus), blocking access to bank websites.
• 📱 Advertising Trojans (HiddenAds), downloading advertisements from external resources.

7. Fastboot (guaranteed removal)

If the Trojan is embedded in the system partition or blocks all removal attempts, all that remains is full reset via Fastboot. This method will erase all data on the device, including the virus, and will restore clean firmware. It works even if the smartphone is locked or does not boot.

Step-by-step guide:

1. Download the official firmware for your model from the manufacturer's website (for example, Xiaomi — https://new.c.mi.com/global/miuidownload/index, Samsung — https://samfw.com).
2. Unpack the archive with the firmware into a folder c platform-tools.
3. Load your smartphone into mode Fastboot (usually Power + Volume Down).
4. Connect the device to the PC and run the commands:

   fastboot devices
   fastboot flash boot boot.img
   fastboot flash system system.img
   fastboot flash recovery recovery.img
   fastboot flash userdata userdata.img
   fastboot erase cache
   fastboot reboot

For devices with an unlocked bootloader (Bootloader) the process is simplified:

fastboot -w
fastboot update firmware.zip

After the reset:

• 🔄 Do not restore data from a backup - the Trojan may return.
• 📱 Install an antivirus and check all downloaded APKs before installation.
• 🔒 Enable Google Play Protect in the settings Google Play.

⚠️ Attention: On some models (for example, Samsung s Knox), resetting through Fastboot may trigger the flag RMM/KG State: PrenormalThis will block the feature. use Samsung Pay and some banking applications. Before the procedure, check the status Knox via the command adb shell getprop ro.boot.warranty_bit (must be 0).

8. Method 7: Hardware solution (for non-unlockable devices)

If the Trojan has blocked the bootloader (Bootloader) or the device is in bootloop (infinite reboot), software methods will not help. In this case, you will need hardware interference via:

• 🔧 JTAG connector - allows you to reflash the memory directly, bypassing the bootloader. Suitable for Qualcommchips (for example, Snapdragon 865/888).
• 🔌 ISP (In-System Programming) - firmware through contacts on the motherboard. Used for Mediatekprocessors (Helio G90T, Dimensity 1200).
• 📱 EMMC reader - removing the memory chip and flashing the firmware through a programmer. An extreme measure, requires soldering.

These methods require special equipment and skills. The cost of the service in the service center is from 3 000 to 10,000 rubles depending on the model. For self-repair you will need:

• Adapter JTAG/ISP (for example, RIFF Box or Easy-JTAG).
• Programmer CH341A for operation c EMMC.
• Firmware in format .bin or .mbn for your model.

⚠️ Attention: Incorrect connection to the JTAG-connector can damage the motherboard On devices with UFS memory (For example, Samsung Galaxy S22, OnePlus 10 Pro) the risk of damage is higher - experience with a soldering station is required.

How to find the JTAG connector on the board?

Usually this is a group of 10-20 contacts labeled as JTAG, ISP or TEST POINT. On boards Qualcomm are often located next to the processor, on the Mediatek — EMMCchip. For the exact location, look for diagrams (schematics) your model on forums like 4PDA or XDA-Developers.

FAQ: Frequently asked questions about Trojans on Android

Is it possible to remove a Trojan without resetting the settings?

Yes, in 70% of cases the Trojan is removed via safe mode or ADB. However, system Trojans (like Triada or Ztorg) require flashing, as they modify files in the /system and /vendor, not available for standard methods.

The Trojan has returned after removal. What should I do?

This means that the virus has a self-healing mechanism. Most often it is hidden in:

• 📁 Folder /data/data/ (residual files).
• 🔄 Tasks cron (automatic launch according to schedule).
• 📱 Firmware recovery (if the Trojan replaced it with its own version).

In this case, only a full reset via Fastboot or hardware intervention will help..

How to protect yourself from Trojans in the future?

Follow these rules:

• 🛡️ Install an antivirus with real protection (not just a scanner). The best options: Kaspersky Mobile (for banking Trojans) or Bitdefender (for spyware).
• 🔒 Disable installation from unknown sources (Settings → Security → Unknown sources).
• 📱 Regularly check application permissions in Settings → Applications → Permissions. Trojans often request access to SMS, contacts and geolocation.
• 🔄 Update Android and applications. 80% of Trojans exploit vulnerabilities in outdated versions of the OS.

Can a Trojan damage the hardware of a smartphone?

A Trojan cannot cause direct damage to components (processor, memory). However, some types of malware are capable of:

• 🔥 Overheat the device due to cryptocurrency mining (Trojans Loapi, WAPDropper).
• 📴 Accelerate battery drain, reducing its resource.
• 📱 Block access to IMEI or Baseband (modem part), which will lead to loss of the network.

In extreme cases (for example, if infected Bootloaderthe motherboard may need to be replaced.

How does a Trojan get onto a smartphone if I don’t do anything downloaded?

Trojans are distributed not only through pirated APKs. Here are 5 non-obvious methods of infection:

• 📧 Phishing SMS/letters with links to a "security update" (Trojan FluBot).
• 🌐 Vulnerabilities in the browser. Just open a malicious website in Chrome with an outdated version.
• 📱 Fake updates via notifications (for example, "Your Android is outdated! Download the patch").
• 🔌 Infected USB devices (flash drives, powerbank-and with a hidden chip).
• 📡 Public Wi-Fi. Trojans like NotCompatible spread through vulnerabilities in the protocol ARP.