Mobile security today is no less urgent than the protection of personal computers. Device owners are often faced with the question of how to conduct in-depth diagnostics of the gadget using more powerful resources of a personal computer. Connecting your smartphone to your PC gives you access to tools that are not available or work slower directly on a mobile device. This is especially true if complex Trojans are suspected that block the operation of anti-virus scanners inside the system.
There are several analysis methods: from simply scanning the internal memory with an antivirus to using professional debugging utilities. The choice of method depends on the degree of infection and your technical training. In some cases, a virus can masquerade as a system process, and only external analysis of the file structure will help identify the threat. Let's look at all the available options in detail.
Preparing the device and computer for scanning
Before starting any manipulations, it is necessary to ensure a stable connection between the devices. Use the original USB cableas cheap analogues often only support charging and do not transmit data. Connect your smartphone to your computer and wait for the device to be detected in Windows or macOS.
A request for permission to debug or access files will appear on the phone screen. Select mode File transfer (MTP). If you plan to use advanced diagnostic methods, you will need to activate developer mode. To do this, go to Settings → About phone and click 7 times on the build number.
After activating the developer menu, find the item USB debugging and enable it. Confirm permission on your computer by clicking "Always allow from this computer." This action will give the PC full access to the phone's file system, which is critical for deep scanning.
⚠️ Attention: Never enable USB debugging on other people's or public computers. This mode gives full access to your device data, and attackers can copy information without your knowledge.
Make sure that an up-to-date antivirus with updated signature databases is installed on your computer. Outdated software may miss new modifications of malicious code. The scan will be effective only if there are fresh threat definitions.
☑️ Preparing for scan
Using antivirus software on a computer
The easiest way is to use an antivirus installed on a PC. Modern solutions from Kaspersky, Dr.Web or ESET can scan connected mobile devices as external drives. This method is effective against file viruses, Trojan downloaders and adware stored in memory.
Run a full system scan or select a specific drive that matches your smartphone. The process can take from 15 minutes to an hour depending on the amount of data. The antivirus will check each file for compliance with known malware signatures.
However, it is worth understanding the limitations of this method. The scanner only sees files, but cannot analyze running processes or Android system services. If a virus is embedded in the system partition or masquerades as a legitimate application, a simple memory scan may not produce results.
Here are the main types of threats that can be identified in this way:
- 🦠 APK files of malware downloaded from unreliable sources
- 📁 Scripts and executables files hidden in download folders
- 💾 Infected documents or archives transferred to the phone
Before scanning, empty the trash on your phone and the "Downloads" folder to speed up the process and remove excess digital junk.
If the antivirus detects a threat, follow the app's instructions to disinfect or delete the file. After completing the procedure, be sure to restart your smartphone to apply the changes.
Manual analysis of the file system through Explorer
Sometimes automatic scanners miss threats, especially if they use polymorphic code. In such cases, manual inspection of the file structure helps. Open "My Computer" and go to your smartphone section. You need to look for suspicious files with extensions .apk, .exe or scripts .sh in unexpected places.
Pay attention to folders with names that imitate system ones, but are misspelled. For example, System instead of system or a folder with a set of random characters. Viruses often hide in root directories or folders Android/obb, posing as game caches.
Sort files by date modified. If you see newly created executable files in system directories, this is a warning sign. Remove any unknown APK files that you did not install knowingly.
How to distinguish a system file from a virus?
Android system files usually do not have the .apk extension in open directories. If you see a file with a name like "update.apk" or "system.apk" in the root or Download folder, there is a 99% chance that it is a virus.
Be careful when deleting files. Do not touch files with extensions .odex, .dex or files without extensions in the folder systemif you are not sure of their purpose. Removing critical components may cause the phone to stop booting.
⚠️ Attention: File manager interfaces and folder structure may differ depending on the version of Android and the manufacturer's shell (MIUI, OneUI, etc.). Always check the official documentation before deleting system files.
Advanced diagnostics via ADB (Android Debug Bridge)
There is a tool for advanced users ADB. It allows you to interact with the Android shell directly from your computer. This is a powerful method that allows you to see lists of installed applications and running processes that are hidden from the average user.
Download the package Platform Tools from the official Android developers website. Unpack the archive and open a command prompt in this folder. Enter the command to check the connection:
adb devicesIf everything is configured correctly, you will see the serial number of your device. Now you can request a list of all installed packages:
adb shell pm list packagesExamine the resulting list. Look for packages with strange names or ones you didn't install. Pay special attention to applications with administrator rights. To see them, use the command:
adb shell dumpsys device_policy- 🔍 Search for hidden processes through the console
- 🛡️ Checking administrator rights for dubious applications
- 🗑️ Removing viruses using commands without access to the phone interface
If you find a malicious package, it can be deleted with the command adb uninstall package_name. This method often helps get rid of viruses that block removal through the phone settings.
Analysis of event logs and network activity
Viruses often manifest themselves through network activity. They can send SMS, call toll-free numbers or transfer data to remote servers. You can track these attempts through your computer using traffic sniffers or analyzing logs.
Use utilities like Wireshark (if you have root access and configured traffic forwarding) or specialized mobile monitors, the data of which can be exported to a PC. Look for suspicious connections with unknown IP addresses, especially if the phone is in standby mode.
It's also worth checking your call and SMS history through backups or synced data in your Google account on your computer. The presence of outgoing messages that you did not send is a direct sign of Trojan activity.
The table below shows the main signs of infection that can be identified through activity analysis:
| Symptom | Probable cause | Test method |
|---|---|---|
| Rapid battery drain | Background mining or data transfer | Analysis of battery statistics in settings |
| Pop-up advertising | Adware virus in the system | Check list of recently installed applications |
| Account debits | SMS Trojan | Request details from the telecom operator |
| Interface slowdowns | High processor load | Process monitoring via ADB |
Network activity is the most reliable indicator of the presence of hidden malware, even if the virus files are successfully disguised.
Radical measures: Reset and flashing
If none of the methods helped, and the phone continues to behave suspiciously, the last resort remains - a full reset to factory settings. Before doing this, be sure to save important data (photos, contacts) to your computer or to the cloud, but do not save applicationsas they may be infected.
Reset through the Recovery menu. To do this, turn off the phone, then hold down the combination of buttons (usually Volume up + Power). Select item Wipe data/factory resetfrom the menu. This will remove all user data and viruses from the user partition.
In the most difficult cases, when a virus has penetrated the system partition (which is rare, but possible if you have root access), you will need to completely flash the device from the computer. Use official utilities: Odin for Samsung, SP Flash Tool for MediaTek or Fastboot for Google Pixel.
⚠️ Attention: Flashing the device will void the warranty and carries the risk of turning the phone into a “brick” if there is an error. Perform this procedure only if you are confident in your actions and the availability of suitable firmware.
After returning to factory settings, immediately install a reliable antivirus and update the system to the latest version. This will close vulnerabilities through which malware could get in.
When restoring data after a reset, do not install applications in bulk. Return them one at a time and check the phone's operation to identify the source of the problem if it returns.
Prevention and future protection
The best defense is preventing infection. Never download apps from third-party stores or suspicious sites. The official one has built-in protection, which scans applications before installation. Update your operating system regularly. Developers are constantly closing security holes that hackers exploit. Ignoring updates leaves your phone vulnerable to known exploits. Google Play has built-in protection Google Play Protect, which scans applications before installation.
Update your operating system regularly. Developers are constantly closing security holes that hackers exploit. Ignoring updates leaves your phone vulnerable to known exploits.
Don't give apps unnecessary permissions. If a flashlight asks for access to contacts and SMS, this is a clear sign of fraud. Remove such apps immediately.
Is it possible to check your phone for viruses without installing apps on your PC?
Yes, you can use online file scanners. Upload the suspicious APK file to a service like VirusTotal. It will scan the file with dozens of antivirus engines simultaneously. However, this will not check applications already installed on the system, only specific files.
Will resetting all viruses remove all viruses?
In 95% of cases, yes. A reset removes all data from the user partition, where viruses usually live. The exception is rare cases of infection of the system partition, which is only possible on devices with root access.
Is USB debugging mode dangerous for the average user?
The mode itself is safe, but it opens up wide access to the device. If you leave it on and connect your phone to an infected computer or public charging station, attackers could take control of the device. Turn off debugging when not in use.
Why doesn’t an antivirus on a PC detect a virus on a phone?
Antiviruses for PCs and Android use different signature databases and analysis methods. A virus written specifically for the ARM architecture and Android environment may be inactive or invisible to the Windows scanner while the file is simply lying in memory. For treatment, specialized mobile antiviruses are needed.
How to remove a virus if it does not allow you to enable USB debugging?
If the virus blocks access to settings, try booting into Safe Mode (usually by holding down the power button on the menu screen). In this mode, third-party applications will not launch and you will be able to delete the malicious file. If that doesn’t help, just reset via Recovery.