Viruses on Android smartphones are a problem that every fifth user faces. Unlike computers, where antivirus software has long been standard, many phone owners ignore threats until the device starts to slow down, display annoying ads, or send SMS messages to paid numbers on its own. Moreover 90% of infections occur due to the installation of applications from unverified sources even if you downloaded the APK file from a “reliable” forum.

In this article we will analyze all current methods of cleaning Android from virusesincluding manual methods for experienced users and automated solutions for newcomers. We will pay special attention hidden threats that are not detected by standard antiviruses to, for example, spyware masquerading as system processes. You will also learn how to distinguish a real virus from false positives and what to do if your phone is locked by ransomware.

Signs of infection: how to understand that there is a virus on Android

The first step to cleaning is confirming the fact of infection. Many “symptoms” of viruses coincide with signs of an overloaded system or outdated firmware. For example, slow operation may be caused by a lack of RAM, and pop-up advertising by an installed ad blocker with aggressive monetization. To avoid wasting your time, check these key markers:

  • 🔋 A sharp reduction in battery life (a virus can masquerade as a system process and consume up to 30% of the charge per hour).
  • 📱 Spontaneous actions: sending SMS, installing applications, changing settings.
  • 💰 Unauthorized payments (especially if you did not enable automatic payments).
  • 🔍 The appearance of unknown files in folders Download or DCIM (for example, config.apk, update.zip).
  • 🚫 Screen lock with a demand for payment (ransomware like Android.Locker).

If you notice at least 2-3 items from the list, the probability of infection exceeds 70% But before you start cleaning, rule out other reasons:

  • 📉 Check the CPU load in Settings → Battery → Battery Usage. If there is an unknown process with high consumption, this is a cause for concern.
  • 🔄 Make sure that the problem is not a system update. Go to Settings → System → Software update and install the latest patches.
📊 How often do you check your smartphone for viruses?
Never
Once every six months
Once a month
Only when something goes wrong

Method 1: Removing viruses manually (without an antivirus)

If you are sure In your technical skills, you can try to clean the system without third-party apps. This method is suitable for adware viruses (showing ads), Trojansmasquerading as legitimate applications, and spywarethat do not block access to the settings. The main rule: do not delete system filesif you are not sure about them. purpose!

Instructions for manual cleaning:

  1. Close all suspicious processes:
    • Open Settings → Applications.
    • Tap on the three dots in the upper right corner and select Show system processes.
    • Find applications with unfamiliar names (for example, com.android.system.update is a popular disguise for viruses).
    • Click Stop, then Delete data and Disable.
  2. Check administrator rights:
    • Go to Settings → Security → Device administrators.
    • Uncheck unknown applications (for example, Device Admin, Security Service).
  • Remove suspicious APK files:
    • Use any file manager (for example, Total Commander or Files by Google).
    • Check folders Download, DCIM, Android/obb for files with the extension .apk or .xapk.
    • Delete everything that you did not install deliberately.

      • Make a backup copy of important data|

      Check the battery charge (at least 50%)|

      Write down the names of suspicious processes|

      Prepare an alternative login method (PIN, pattern key)-->

      ⚠️ Attention: Some viruses block access to settings or the file manager. If after an attempt to remove the application appears again, this is a sign root virusthat has penetrated the system files. In this case, only a full reset or flashing will help. data-i="111">Attention:

      What to do if a virus has blocked the settings?

      If access to Settings or Application Manager is blocked, try:

      1. Enter safe mode (hold the power button → long tap on "Turn off" → "Safe Mode").

      2. Remove the virus using ADB commands. (PC and USB debugging required).

      3. Use an alternative launcher (for example, Nova Launcherto bypass the blocking.

      Method 2: Antiviruses for Android - which ones really work

      Standard antiviruses from Google Play are often criticized for their low efficiency, but they remain the easiest way for beginners. The main problem is false positives: many apps mark harmless files or even system components as viruses To avoid deleting something important, use only proven solutions:

      Antivirus Efficiency Features Cons
      Bitdefender Mobile Security 99.8% Scans in real time, blocks phishing sites Paid version (from 150 ₽/month)
      Kaspersky Internet Security 99.5% Protection against ransomware, checking Wi-Fi networks Slows down old smartphones
      Malwarebytes 98.7% Specializes in adware and spyware No real-time protection in free version
      Google Play Protect 85-90% Built into Android, works automatically Misses many new threats

      How to use an antivirus correctly:

      1. Install one of the listed applications (not several at the same time!).
      2. Run full scan (not fast!).
      3. If threats are found, remove them through the antivirus interface.
      4. Check the section Quarantine (quarantine) - sometimes the right ones end up there files.

    ⚠️ Attention: Some viruses block the installation of antiviruses. If during downloading Bitdefender or Kaspersky the error “Installation is prohibited” appears, try:

    • Download the APK file antivirus from the official website (not through the browser on your phone!).
    • Install it in safe mode.
    • Use another Google account to download.
      • 💡

      Before scanning, disable battery optimization for the antivirus. Go to Settings → Applications → [Antivirus] → Battery and select "No restrictions".

      Method 3: Cleaning through Safe Mode

      Safe Mode (Safe Mode) is an Android diagnostic mode in which all third-party applications are disabled. If the virus appears only in normal mode (for example, it shows ads or redirects in the browser), safe mode will help remove it.

      How to enter safe mode:

      1. Press and hold the button poweruntil it appears shutdown menu.
      2. Long tap on the option Turn off (on some models - Reboot).
      3. Confirm switching to safe mode (the message appears Safe Mode at the bottom of the screen).

      Next actions:

      • 🔍 Check the list of installed applications (Settings → Applications). Viruses are often disguised as: Settings → Applications (outdated software that has not been used for a long time)
        • com.android.system
        • Update Service
        • Flash Player (outdated software that has not been used for a long time)
      • 🗑️ Remove suspicious apps.
      • 🔄 Reboot your phone in normal mode mode.

      If the virus returns after a reboot, it is embedded in the system files. In this case, only resetting to factory settings or flashing will help.

      💡

      Safe Mode does not remove viruses automatically - it only disables them, giving you the opportunity to find and uninstall manually.

      Method 4: Resetting to factory settings (hard reset)

      This is the most radical, but also the most reliable way to remove all viruses, including those that disguise themselves as system processes. The downside is that you will lose all the data on your phone (photos, contacts, messages) if you don’t make a backup copy. However, some viruses block this too.

      How to reset settings:

      1. Save important data to the cloud (Google Drive, Yandex Disk) or PC.
      2. Go to Settings → System → Reset settings.
      3. Select Delete all data (factory reset).
      4. Confirm the action (you may need to enter a PIN code or pattern).

      ⚠️ Attention: On some infected devices, the virus blocks access to the reset menu. If after entering the password nothing happens or an error appears, try:

      • Reset via recovery-mod (press Power + Volume up when turning on).
      • Use ADB commands from a computer (developer rights required).

      After a reset:

      • 🔒 Do not restore data from a backup made after infection —the virus may return.
      • 📥 Install applications only from Google Play (disable installation from unknown sources).
      • 🛡️ Immediately install an antivirus and check the system.

      Method 5: Removing viruses via ADB (for advanced)

      If the virus has blocked all standard methods, it remains Android Debug Bridge (ADB) —a tool for controlling your phone from a computer. This method requires enabled USB debugging and basic knowledge of the command line.

      Step-by-step guide:

      1. Download ADB Tools on PC (official website Android Developers).
      2. Connect your phone to the computer via USB and enable debugging.
      3. Open the command line (Windows) or terminal (macOS/Linux) in the folder with ADB.
      4. Enter the commands in order:
      adb devices

      adb shell
      

      pm list packages -f grep | "suspicious_name"
      

      pm uninstall -k --user 0 package.name

      Example: if a virus masquerades as com.android.fakeupdate, the last command will be:

      pm uninstall -k --user 0 com.android.fakeupdate

      ⚠️ Attention: Incorrect use of ADB can lead to data loss or system damage. Do not delete packages with the names:

      • com.android.settings
      • com.google.android.gms
      • android
      How to enable USB debugging if the virus blocking?

      If debugging is disabled in Developer settings and cannot be enabled:

      1. Try activating it via Engineering Mode (enter ##36446337## in the dialer).

      2. Use Fastboot to temporarily obtain root access (for advanced users only).

      3. On some models Samsung and Xiaomi debugging can be enabled via Settings → About phone → Build number (tap 7 times).

      Method 6: Flashing the phone (as a last resort)

      If none of the methods helped, What remains flashing is a complete reinstallation of the operating system. This is guaranteed to remove all viruses, but requires:

      • 🔧 Skills in working with firmware (or willingness to learn it).
      • 💻 A computer with installed ones. drivers.
      • 📄 Backup of important data (after flashing the phone will be like new).

      How to reflash Android:

      1. Find the official firmware for your model on the manufacturer's website (for example, Samsung Firmware, Xiaomi Flash).
      2. Download the app for firmware:
        • For Samsung — Odin.
        • For Xiaomi — Mi Flash Tool.
        • For other brands - SP Flash Tool or Fastboot.
    • Follow the instructions for your model (usually this means loading the phone into mode Download Mode and connecting to PC).

    ⚠️ Attention: Incorrect firmware can turn your phone into a “brick” (inoperable device). If you have never done this before, it is better to contact a service center.

    💡

    Before flashing the firmware, check the phone model in Settings → About phone → Model. from another model (even if it looks similar) will lead to failure!

    How to protect Android from viruses in the future

    Cleaning your phone from viruses is only half the solution To avoid re-infection, follow these rules:

    • 🔒 Disable installation from unknown sources (Settings → Security → Unknown sources).
    • 📥 Download applications only from Google Play (even APK files from “trusted” sites can be infected).
    • 🔄 Update the system regularly (vulnerabilities are closed in new versions of Android).
    • 🛡️ Use an antivirus with real-time protection (for example, Bitdefender).
    • 🚫 Do not connect to public Wi-Fi without a VPN (it is easier for hackers to introduce a virus through an unprotected network).
    • 📧 Do not open links in SMS and letters from unknown senders.

    Pay special attention phishing sitesthat imitate bank pages or social networks. For example, if you received an SMS allegedly from Sberbank with a request to “update your data” via a link, this is 100% fraud.

    Also check application permissions during installation. If the flashlight asks for access to SMS or contacts, this is a reason to think about it.

    💡

    The most common cause of infection is the installation of pirated versions of paid applications (for example, Spotify Premium, Netflix Mod APKEven if the antivirus does not swear, such software often contains hidden modules for display). advertising or data theft.

    FAQ: Frequently asked questions about viruses on Android

    Is it possible to infect Android via Bluetooth or NFC?

    Theoretically yes, but in practice such cases are extremely rare. Modern versions of Android block the automatic installation of files via Bluetooth. However, if you accept and install unknown files (for example, .apk or .jar), there is a risk. NFC is used mostly for payments and is not a channel for the spread of viruses.

    Does turning off the Internet help stop it? virus?

    Partially. If the virus is already installed, it can continue to work in offline mode (for example, show ads from cached data). However, disconnecting the Internet breaking the connection of the virus with the control serverwill prevent:

    • Sending your data to attackers.
    • Downloading new virus modules.
    • Blocking the phone (ransomware requires a connection).

    But this does not cure the device - the virus will remain in the system.

    Can an antivirus remove a virus that has blocked a phone?

    No, if the blocking is already active. The antivirus must be installed before infectionto prevent blocking. If the screen is blocked by ransomware (for example, the message “Your phone is blocked by the FSB, pay the fine”), try:

    1. Reboot into safe mode and remove the virus.
    2. Connect to the PC via ADB and uninstall the malware.
    3. Reset settings to factory settings (if there is no important data).

    Paying extortionists impossible this does not guarantee unlocking and supports criminals.

    How to check your phone for viruses without an antivirus?

    There are several ways:

    1. Checking processes:
      • Go to Settings → Applications → Running.
      • See if there are any unknown processes with high CPU/battery consumption.
    2. Traffic analysis:
      • Use the application NetGuard or GlassWireto track which apps are sending data to the Internet.
  • Checking the file system:
    • Open the file manager and look for suspicious files (for example, *.apk in folders System or DCIM).

    You can also use online scanners (for example, VirusTotal), uploading suspicious files there.

    Viruses can steal data from banking applications?

    Yes, some viruses (for example, BankBot, Cerberus) specialize in stealing bank data. They work through:

    • Overlaying fake windows on top of a real bank application (you enter logins/passwords in a fake form).
    • SMS interception with confirmation codes.
    • Keylogging (recording all clicks on the screen).

    To protect yourself:

    • Use official banking applications (not web versions).
    • Enable two-factor authentication (not only via SMS).
    • Install specialized antiviruses (for example, Kaspersky Internet Security with banking protection).