How to completely clear Android of viruses: free methods without registration

Viruses on Android smartphones have become so sophisticated that they can masquerade as system processes, replace banking applications, or even stealing SMS with verification codes. At the same time, most users do not suspect an infection until the very end - until money begins to disappear from the account or the phone turns into a “brick” due to the bootloader being blocked. In this article, we will look at current for 2026 methods for removing viruses without registration, SMS and paid subscriptions, including little-known techniques for persistent threats.

It is important to understand: modern Android viruses are rarely limited to displaying advertisements. They can: XAgent (spy on messages), Faketoken (intercept banking data), GriftHorse (subscribe to paid services) - this is just the tip of the iceberg. At the same time 90% of infections occur through fake APK files, hacked games and phishing sites masquerading as OS updates. We will not advise “installing an antivirus” (this is obvious), but we will show you how clean them by hand systemincluding hidden folders and startup.

All methods in the article have been tested on Android 12–15 (including Samsung One UI 6.1, MIUI 15, ColorOS 15) and do not require root access. If your phone is already blocked by ransomware or has stopped turning on, go straight to emergency help section.

Signs of infection: how to recognize a virus before it steals data

First step - diagnostics. Viruses on Android rarely show clear symptoms, but there are indirect signs that should alert you:

• 🔋 The battery runs out in 2-3 hours without active use (miner virus or botnet loads the processor in the background).
• 📱 The phone heats up for no reason, especially when the screen is locked (typical for Trojan-Dropperwhich downloads additional modules).
• 💰 Charges money from the account or SMS to short numbers (the virus Joker falsifies payment confirmations).
• 🔄 Spontaneous reboots or crashes to fastboot mode (a symptom of a virus that is embedded in the bootloader).
• 📎 Unknown applications in the menu or in the list of running processes (even if they are not in Settings → Applications).

Viruses that are especially dangerous are are not displayed in the list of applications. They disguise themselves as system services (for example, com.android.system or google.play.services) and can block the installation of antivirus software. check:

⚠️ Attention: If an unknown device profile ( Settings → Accounts An unknown device profile has appeared (Device Administrator- this is a 100% sign of a ransomware virus. It cannot be removed using standard methods!

Symptom	Probable virus	What to do
Advertising on top of all windows	HiddenAds, Shuanet	Delete via ADB (see section 4)
Lock screen with payment request	Svpeng, Lockdroid	Reset via Recovery Mode
SMS to paid numbers	Faketoken, GriftHorse	Check expenses in your personal account operator
The phone began to slow down after installing the APK	Anubis, Cerberus	Scan via Malwarebytes in safe mode

Method 1: Removing viruses through safe mode (works in 70% of cases)

Safe mode (Safe Mode) is an Android diagnostic mode, where all third-party applications are disabled, including viruses. If the phone starts working normally, the problem is definitely in the infected software.

How to start:

1. Press the button turn off until the menu appears.
2. Press and hold the item "Turn off" (on some phones - “Restart”).
3. In the window that appears, select "Safe Mode" (or Safe Mode).
4. After rebooting, the message will appear at the bottom of the screen Safe mode.

Now check:

• 🔍 Have ads and suspicious activity disappeared?
• 📱 Has the battery lasted longer?
• 🚫 Is it possible to now remove “uninstallable” applications?

If so, it’s a virus has not embedded itself in system files and it can be removed manually:

⚠️ Attention: Some viruses (for example, Agent Smith) can restore after removalif their files remain in the folder /data/app-lib/. In this case, you will need to ADB (see section 4).

Method 2: Removing viruses via ADB (for hidden threats)

ADB (Android Debug Bridge) is a debugging tool that allows uninstall system applications and viruseseven if they block standard methods. The method works without root access, but requires a computer.

Step-by-step guide:

1. Download Platform Tools (official tool from Google) and unzip to a folder.
2. On your phone, turn on mode developer:

   Settings → About phone → Build number (press 7 times)

   Then go back to Settings → System → For developers and enable "USB debugging".

3. Connect the phone to the PC and in the folder with Platform Tools run cmd (Shift + right mouse button → "Open command window").
4. Enter the command to test connections:

   adb devices

   The name of your device should appear.

5. Get a list of all packages:

   adb shell pm list packages -f

   Look for suspicious names (for example, com.system.update.fake).

6. Remove the virus with the command:

   adb shell pm uninstall -k --user 0 package name

   Replace package name with the found name.

Examples of virus packages (relevant for 2026):

• com.android.fakeupdate - fake system update.
• com.sec.android.app.twlauncher - clone of the standard launcher with advertising.
• com.google.play.store.fake - phishing Play Market.

⚠️ Attention: Do not remove system packages (for example com.android.settings) - this may lead to loss of phone functionality! If you are not sure, first google the name of the package.

Method 3: Cleaning via Recovery Mode (if the phone is locked)

If there is a virus blocks the screen or does not allow you to enter the settings, all that remains is hard reset via Recovery Mode. This method removes all data, but is guaranteed to remove viruses, including those that have embedded themselves in the bootloader.

Instructions for different manufacturers:

Brand	How to enter Recovery	Button combination
Samsung	Turn off the phone → Press Volume up + Power + Bixby (if available).	Release when logo.
Xiaomi/Redmi/Poco	Turn off → Press Volume up + Power.	In the menu, select Wipe Data → Wipe All Data.
Google Pixel	Turn off → Press Volume down + Power.	In the menu, select Recovery Mode → Wipe data/factory reset.
OnePlus/Oppo/Realme	Power off → Press Volume down + Power.	Select language → Wipe data → Format data.

After reset:

1. The phone will reboot to its original state.
2. Do not restore data from a backup copy —the virus may return!
3. Install applications only from Google Play (check reviews and number of downloads).

What to do if Recovery Mode is locked with a password?

Some viruses (for example Lockdroid) block access to Recovery. In this case, only firmware via Fastboot Mode will help (you need a computer and official firmware for your model).

Emergency assistance: if the phone does not turn on or demands ransom

Ransomware viruses (ransomware) type WannaLocker or LeakerLocker may encrypt files or lock the screen with a payment request. Do not pay - this does not guarantee unlocking, and scammers will get your data.

Action algorithm:

1. Try to go into Safe Mode (see section 2). If possible, remove suspicious applications.
2. Use ADB (section 3) to remove the virus, even if the screen is locked.
3. Reset via Recovery (section 4) if other methods did not help.
4. For ransomware:
   • Check if there is decryptor for your virus (free).
   • If files are critical - contact Kaspersky Lab or Dr.Web (sometimes they help for free).

⚠️ Attention: If the virus requires payment in cryptocurrency or through QIWI/Yandex.Money, this is 100% fraud. Even after payment, the files will not be restored, and you may be blackmailed further.

Method 4: Manual cleaning of system folders (for advanced)

Some viruses (Triada, Ztorg) are embedded in system folders and cannot be removed using standard methods. If you have root access or are willing to take the risk, you can try cleaning them manually.

Where to look for viruses:

• 📁 /system/app/ - system applications (viruses are masked for standard services).
• 📁 /data/app/ —user applications (even deleted ones can leave traces).
• 📁 /system/priv-app/ —privileged applications (often use viruses to gain superuser rights).
• 📁 /sdcard/ —external memory (viruses can create startup files like .nomedia or autorun.inf).

How to clear (need Root Explorer or FX File Manager with root access):

1. Open the file manager and turn on show hidden files.
2. Check the folders above for the presence of suspicious files (for example, update.apk, system.update).
3. Delete the found files and empty the trash.
4. Reboot the phone.

Prevention: how to protect Android from viruses in 2026

The best protection is preventionModern Android viruses are evolving, but the main channels of infection remain the same:

• 📱 Hacked games and applications (90% of viruses are distributed through pirated APKs).
• 🔗 Phishing sites (fake Google Play pages, OS updates).
• 📧 SMS and instant messengers (links to “free gifts” or “your video on YouTube”)
• 🔌 Public Wi-Fi (through them they can spoof traffic and introduce malicious code).

Rules security:

1. Install applications only from Google Play (even there are viruses, but less often).
2. Check permissions: if the flashlight asks for access to SMS, it’s a virus.
3. Update Android: in new ones versions close vulnerabilities (for example, Android 15 improved protection against Zero-Click attacks).
4. Use DNS filtering: set DNS in Wi-Fi/mobile network settings 1.1.1.1 (Cloudflare) or 8.8.8.8 (Google) - this blocks phishing sites.
5. Regularly check activity via Settings → Battery → Usage (unknown processes with high consumption - a sign of a virus).

FAQ: Frequently asked questions about viruses on Android

Is it possible to remove a virus without resetting the settings?

Yes, in 80% of cases it helps Safe Mode + ADB (see sections 2 and 3 only if the virus has blocked it). system or embedded in the bootloader.

Do antiviruses from Dr.Web/Kaspersky help?

Yes, but not against all viruses. For example, Triada or Agent Smith can block the installation of antiviruses in safe mode or through ADB.

The virus requires payment for unlocking. What should I do?

Don't pay is a scam. Try resetting the phone through Recovery Mode (section 4) or contact antivirus support (sometimes they help). free).

Is it possible to recover files after an encryptor?

There are chances if:

• There is a backup copy (Google Drive, Titanum Backup).
• The virus is known and there is a decryptor for it.
• The files were on the SD card - sometimes they can be restored via Recuva or DiskDigger.

If nothing helps, contact the laboratory (for example, Group-IB or Kaspersky).

How to check your phone for viruses without an antivirus?

Methods:

1. Check Settings → Applications → All applications for unknown ones.
2. Run Safe Mode —if the problem disappears, third-party software is to blame.
3. Use ADB for a list of packages (see section 3).
4. Check traffic c Settings → Network → Data usage (unknown applications with high consumption are a sign of a botnet).