A virus app on Android cannot be deleted: 7 ways to get rid of it forever

Are you trying to remove a suspicious application, but the system displays the error “Removal is impossible” or the uninstall button is inactive? This is a classic sign of a virus that disguises itself as legitimate software and blocks its own removal. Such apps often gain administrator rights, replace system processes, or even encrypt data for blackmail. In this article - 7 proven methods remove a stubborn application, including methods for devices without root access and with them.

It is important to understand: if a virus penetrated the system, it could already change security settingsadd itself to startup or gain access to SMS/banking data. Therefore first of all, turn off mobile data and Wi-Fito interrupt the connection between the malware and the attackers’ server. Next, follow the instructions below - from simple methods to radical ones.

1. Checking device administrator rights

Many viruses block removal by registering as device administrators. This allows them to monitor the lock screen, track user activity, and recover after a reboot. To remove such an application:

1. Go to Settings → Security → Device administrators (on some firmware the path may differ: Settings → Biometrics and security → Other security settings → Phone administrators).
2. Find a suspicious application in the list (often with an unreadable name or gear icon).
3. Uncheck the box next to it and confirm the action.
4. Go back to the list of applications and try to remove it with the standard one way.

If the item with administrators is missing, use the search in the settings (magnifying glass icon in the upper right corner) and enter the query “administrators”. Xiaomi this section may be hidden in Settings → Passwords and security → Application privileges.

2. ADB (without root access)

Android Debug Bridge (ADB) is a debugging tool that allows you to control the device through a computer. You can use it to forcefully uninstall even system applications. You will need:

• 💻 Computer with Windows/macOS/Linux
• 📱 USB cable (original, do not damage it). connector!)
• 🔧 Installed drivers for your device (download from the manufacturer’s website, for example, Samsung Smart Switch or Mi PC Suite)
• 🛠️ Platform Tools from Google (unzip to the root of the C: drive)

Instructions:

1. Enable on your phone Developer mode: go to Settings → About the phone → Build number and tap on it 7 times. Go back and find the new section For developers.
2. Activate USB debugging in this section.
3. Connect the phone to the computer, select the mode File transfer (MTP).
4. Open a command line (Windows) or terminal (macOS/Linux) and go to the folder with platform-tools:

cd C:\platform-tools

5. Check the device connection:

adb devices

If the phone is shown in the list, enter the command to delete (replace com.virus.app to the real application package, which can be found through adb shell pm list packages | grep 'keyword', where keyword is part of the name of the virus):

adb shell pm uninstall -k --user 0 com.virus.app

How to find the name of the application package?

If you do not know the exact name of the package, use the command adb shell pm list packages -f | grep -i "keyword", where keyword is any word from the name of the suspicious application. For example, to search for applications with the word "clean" enter: adb shell pm list packages -f | grep -i "clean".

3. Using an antivirus with a forced removal function

Some antivirus apps (for example, Kaspersky Internet Security, Bitdefender or Malwarebytes) have tools for removing stubborn viruses. They work at the system level and can bypass blocking algorithms:

1. Download the antivirus from the official website (not from the Play Market, since the virus can block the installation!).
2. Install it in safe mode (see advice above).
3. Run a deep scan of the system.
4. If the antivirus finds a threat, select the “Delete” or “Quarantine” option.

For maximum efficiency, use portable versions of antiviruses (for example, Dr.Web CureIt!), which do not require installation and work from a flash drive. This is relevant if a virus blocks installers from launching.

4. Reset to factory settings

If the previous methods did not work, it remains hard resetThis will delete all data from the device, including the virus, but photos, contacts and applications will also be erased. Make a backup copy first important files to an external drive or cloud (if the virus does not block access).

Reset instructions:

1. Go to Settings → System → Reset settings (on some devices: Settings → General → Reset).
2. Select “Factory reset” → “Remove everything.”
3. Confirm the action (entering may be required PIN code or pattern key).

If a virus blocks access to settings, perform a reset via Recovery mode:

1. Turn off the phone.
2. Hold down the button combination (depending on models):
   • 📱 Samsung: Volume up + Power + Home (or Volume up + Bixby + Power for new models).
   • 📱 Xiaomi/Redmi/Poco: Volume up + Power.
   • 📱 Google Pixel: Volume down + Power.

In the Recovery menu, select Wipe data/factory reset (control - volume buttons, selection - power button).

Confirm the action and wait for completion.

5. Removal via TWRP (for advanced users)

If you have custom recovery TWRPinstalled on your device, you can manually remove the virus files. experience, since errors can lead to brick (breakdown) of the phone. Procedure:

1. Boot into TWRP (the button combination is the same as for the standard Recovery).
2. Select Advanced → File Manager.
3. Go to the folders:
   • /data/app/ —user applications are stored here.
   • /system/app/ or /system/priv-app/ —system applications (delete only if you are sure!).

Find the folder with the name of the virus (the package name can be found through ADB, as described above) and delete it.

Reboot the device.

After removal, check the integrity of the system via TWRP → Advanced → Terminal with the command:

e2fsck -f /dev/block/mmcblk0pX

(replace X with the partition number, usually p25 for /data).

Make a backup via TWRP (Backup)

Check the battery charge (at least 50%)

Download the current firmware in case of recovery

Make sure that the device model supports TWRP-->

6. Reflashing the device

If a virus has damaged system files or you suspect it has rootkit (malware embedded in the system kernel), the only reliable way is full flashingThis will return the phone to a “clean” state, but will require:

• 🔧 Official firmware for your model (download only from official sites manufacturer or trusted resources like XDA Developers).
• 💾 Tools for firmware: Odin (for Samsung), Fastboot (for Google/Pixel/Xiaomi), SP Flash Tool (for Mediatek).
• 🔋 Battery charge is at least 80%.

Example of firmware via Fastboot (for devices with an unlocked bootloader):

1. Extract the firmware to the folder with platform-tools.
2. Load the phone into mode Fastboot (usually Volume down + Power).
3. Connect to the computer and check the connection:

fastboot devices

4. Flash each file in turn (example for Pixel):

fastboot flash bootloader bootloader.img
fastboot flash radio radio.img
fastboot flash boot boot.img
fastboot flash system system.img
fastboot flash vendor vendor.img
fastboot flash product product.img
fastboot flash data data.img

For Samsung use Odin with files BL, AP, CP, CSC (carefully make sure it matches the model!).

7. Contacting the service center

If all attempts to remove the virus yourself have failed, or you are afraid of damaging the device, contact our specialists. access to: authorized service center. Specialists have access to:

• 🔧 Specialized software for diagnostics (for example, UFED from Cellebrite).
• 📄 Official firmwarenot publicly available.
• 🛡️ Tools for data recovery after removing the virus.

The cost of the service varies from 1,500 to 5,000 rubles, depending on the complexity Before the visit:

• Remove the pattern/PIN (if possible).
• Tell the technician what methods you have already tried.
• Check whether the warranty will be retained after the intervention (on some devices, for example, Samsung Knox triggered when unlocking bootloader).

How to choose a reliable service center?

Check the reviews on Yandex.Maps or 2GIS (pay attention to the latest reviews for the last 3 months).

Ask if the center has certificates from the manufacturer of your device.

Check whether the work is guaranteed (at least 3 months).

Avoid workshops that they offer “password hacking” without documents for the phone - this could be a scam.

Table: Comparison of virus removal methods

Method	Difficulty	Requires root?	Deletes system viruses?	Risk of data loss
Disable administrator rights	Low	No	No	No
ADB	Average	No	Partially	No
Antivirus	Low	No	No	No
Reset to factory settings	High	No	Yes	Total loss
TWRP	Very high	Yes	Yes	High (with errors)
Flashing	Expert	Partially	Yes	Complete loss

FAQ: Frequently asked questions

Is it possible to remove a virus without losing data?

Yes, if the virus has not penetrated into the system files. Try the methods with ADB or antivirus in safe mode. However, some viruses (for example, ransomware) block access to files, and then you cannot do without resetting. backup copies in advance!

The virus comes back after removal. What to do?

This is a sign that the malware:

• Added itself to autoload (check through Settings → Applications → Autoload).
• Has backup APK in folders /sdcard/ or /system/.
• Uses vulnerability in the firmware (update Android!).

In this case, only full reset or flashing the firmware will help.

How to protect your phone from viruses in the future?

Basic rules:

• 🚫 Do not install APKs from unknown sources (even if they are “hacked games”).
• 🔒 Use installation blocker from unknown sources (Settings → Security → Unknown sources).
• 🛡️ Install an antivirus with real protection (not an empty shell).
• 🔄 Regularly update your firmware and applications.
• 📱 Do not connect to public Wi-Fi without a VPN.

Does the virus require payment for unlocking?

Never pay ransomware! This does not guarantee unlocking, but will only confirm that your device is vulnerable to new attacks. Instead:

1. Try to remove the virus through safe. mode or ADB.
2. If the data is encrypted, check whether there is decryptor for your type of virus.
3. Contact the police (in Russia - Ministry of Internal Affairs, abroad - IC3).

Is it possible to restore data after a reset?

Yes, but with reservations:

• 📁 Photos/videos: If they were stored on an SD card or in the cloud (Google Photos, Yandex.Disk), there will be no problems.
• 📞 Contact: Restored from Google account (if synchronization was enabled).
• 💬 Messages: Without a backup (for example, via SMS Backup & Restore) - no.
• 🎮 Application data: Restored only if there was a cloud save (for example, in games via Google Play Games).

For the future: set automatic backup to Settings → System → Backup.

⚠️ Attention: If the virus blocks access to settings or asks you to enter a password for "unlock", do not enter real data! This may be a phishing page masquerading as a system window. Try rebooting the phone into safe mode or connecting it to the computer for diagnostics via ADB.

⚠️ Attention: On devices with MIUI (Xiaomi/Redmi/Poco) and EMUI (Huawei/Honor) some system applications can be protected from deletion even through ADB. In this case, only flashing or rolling back to the stock version of the software through official utilities will help (Mi Flash Tool for Xiaomi, HiSuite for Huawei).