Have you noticed that a suspicious application has appeared on your smartphone and cannot be removed using standard methods? It can masquerade as system software, block access to settings, or even recover after a reboot. These are classic signs malwarethat penetrated the system through roundabout routes. Such viruses are often distributed through third-party APK files, phishing sites, or vulnerabilities in outdated versions of Android.

Unlike regular apps, virus applications use administrative rights, replace system processes or are embedded in /system/app - folder, protected from changes without root access. Attempts to remove them via Settings → Applications usually end with the error “Removal is impossible” or “The application has been deactivated by the administrator.” In this article we will look at all possible methods —from safe (without superuser rights) to radical (resetting to factory settings).

1. Checking for administrative rights: the first step to removal

Many viruses block their removal by receiving status device administrator. This allows them to control the lock screen, track user activity and prevent uninstallation. Before trying complex methods, check this parameter:

  1. Open Settings → Security → Device Administrators (on some firmware the path may differ: Settings → Lock screen and security → Other security settings → Device administrators).
  2. In the list, find a suspicious application (often with a random type name com.system.update or android.service.secure).
  3. Uncheck the box next to it and confirm the action.

If after that the application has disappeared from list, try deleting it in the standard way via Settings → Applications. If not, go to the next method.

💡

Some viruses disguise themselves as legitimate services (for example, “Google Play Services” with a typo). Compare the name of the application with the official Google services in Play. Market.

2. Removal via ADB: for experienced users

The tool allows you to control the device via the PC command line. This method works even for applications that are not displayed in the Android interface. You will need: Android Debug Bridge (ADB) allows you to control the device via the PC command line. This method even works for apps that don't appear in the Android interface. You will need:

  • 🖥️ A computer with. installed drivers for your smartphone (you can download from the manufacturer’s website, for example Samsung Smart Switch or Mi PC Suite).
  • 🔌 USB cable (preferably original).
  • 📥 Utility ADB and Fastboot (part of the Android SDK).

Instructions:

  1. Enable on your smartphone Developer mode (click on Build number 7 times in Settings → About phone).
  2. Activate USB debugging in the developer menu.
  3. Connect the phone to the PC and enter in the command line line (terminal) in turn:
adb devices

(The serial number of your device should appear - this is confirmation of connection.)

adb shell

pm list packages | grep 'keyword'

(Replace keyword with part of the virus name, for example secure or update.)

pm uninstall -k --user 0 package_name

(Where package_name is what you found in the previous step, for example com.android.fakeupdate.)

If the command completed with an error DELETE_FAILED_INTERNAL_ERROR, the virus is protected at the system level. In this case, only removal via recovery or reset settings will help.

What to do if ADB does not see the device?

Make sure that:

1. The drivers are installed correctly (check in Windows Device Manager).

2. The original cable is used (cheap cables often do not transmit data).

3. Debugging is enabled on the phone for this PC (a prompt will appear the first time). connection).

4. The USB port on the PC is working properly (try a different port).

3. Using Safe Mode

Safe Mode loads Android without third-party applications, which allows you to bypass virus blocking. data-i="98">Safe Mode

How to launch:

  • 📱 On most smartphones: hold down the button power, then long press select "Turn off" (a prompt will appear to switch to safe mode).
  • 🔄 On some models (for example, Samsung): hold the power button + volume down while booting.
  • 🤖 On pure Android: hold down the power button → “Restart in safe mode.”

In safe mode:

  1. Go to Settings → Applications.
  2. Find the virus application and click “Uninstall” (if the button is active).
  3. If deletion is not possible, check Device administrators (see section 1) or use ADB.

After deletion, reboot the phone in normal mode.

📊 Which method have you tried first?
Standard removal via Settings
ADB
Safe Mode
Haven't tried it yet

4. Removal via Recovery Mode (for advanced)

If the virus has entered the system files, it can be deleted via Recovery mode. This method requires caution: incorrect actions can lead to data loss or “bricking” the device.

Preparation:

  • 🔋 Battery charge is at least 50%.
  • 📁 Backup of important data (photos, contacts, messages).
  • 📖 Instructions for logging into Recovery for your model (for example, for Xiaomi this is the power button + volume up).

Steps:

  1. Turn off the phone.
  2. Hold the combination of buttons to enter Recovery (usually Power + Volume up).
  3. Use the volume buttons to navigate, the power button to select.
  4. Select Mount → Mount /system (if there is such an item).
  5. Connect the phone to the PC and via ADB do:
adb shell

rm -rf /system/app/package_name


rm -rf /system/priv-app/package_name

If you are not sure of the folder name, use the command ls /system/app to view the contents.

⚠️ Attention: Deleting system files may not break Android. delete folders with names com.android. or com.google. —these are critical components of the system.

5. Reset to factory settings: last chance

If none of the methods worked, remains hard reset. This will delete all data from the device, including the virus, but will also be erased:

  • 📸 Photos and videos (if not saved in the cloud).
  • 📱 Installed applications and their data.
  • 📞 Contacts, SMS, call logs (if not synchronized with Google).
  • 🎮 Game saves (if not linked to an account).

How to reset:

  1. Make a backup copy of important data (via Google Drive, PC or third-party services).
  2. Go to Settings → System → Reset settings → Delete all data.
  3. Confirm the action (you may need to enter a PIN code or pattern).

On some devices (for example, Samsung or Huawei), a reset can be performed via Recovery:

  1. Enter Recovery (see section 4).
  2. Select Wipe data/factory reset.
  3. Confirm the action (Yes).
  4. After resetting, select Reboot system now.
⚠️ Attention: On some firmware (for example, MIUI or EMUI) after the reset, a link to the manufacturer's account may remain. Make sure you remember your login and password Mi Account, Huawei ID etc.

6. Antiviruses and specialized utilities

If a virus blocks access to settings, you can try to remove it using mobile antiviruses. However, not all apps are able to detect deeply embedded threats. Recommended tools:

Antivirus Advantages Disadvantages Link (Play Market)
Malwarebytes Specializes in adware and Trojans, a lightweight scanner. Does not remove system viruses without root. Download
Kaspersky Mobile Antivirus Deep scanning, real-time protection. Paid functions, may conflict with some firmware. Download
Bitdefender Mobile Security Minimal impact on performance, cloud scanner. Free version is limited. Download

How use:

  1. Download antivirus from Google Play (not from third-party sources!).
  2. Run a full scan (may take 10-30 minutes).
  3. If a virus is detected, follow the app's instructions to remove it.
  4. Restart the device.

If the antivirus does not find a threat, but you are sure of its presence, try scanning files manually through Settings → Storage → Files, paying attention to:

  • 📁 Folders with random names (for example, com.sec.android.update).
  • 📄 Files with the extension .apk in non-standard directories (for example, /sdcard/Download/.hidden).
  • 🔍 Processes in the task manager that consume a lot of resources (open via Settings → Battery → Battery usage).

7. Prevention: how to avoid re-infection

Removing the virus is half the battle. To prevent it from returning, follow the rules of digital hygiene:

Install an antivirus with a real-time scanning function

Do not install APK from unknown sources (Google Play only)

Update Android and applications regularly

Do not connect to public Wi-Fi without a VPN

Check application permissions before installation-->

Additional measures:

  • 🔒 Use ad blocker (for example, Blokada or AdGuard) to prevent loading of malicious banners.
  • 🛡️ Turn on Google Play Protect (Play Market → Menu → Play Protect).
  • 📵 Disable installation from unknown sources (Settings → Security → Unknown sources).
  • 🔄 Regularly check the list of device administrators (see section 1).

If you often install APKs from third-party sources (for example, modified games), use sandbox (Sandbox):

  • 📱 Shelter or Island (create an isolated profile for testing applications).
  • 🖥️ Genymotion or BlueStacks (Android emulators for PC).
⚠️ Attention: Some viruses spread through SMS or instant messengers (for example, WhatsAppDo not open links from unknown senders, even if). the message supposedly came from a contact in your address book.

FAQ: Frequently asked questions

Is it possible to remove a virus without losing data?

Yes, if the virus has not penetrated the system files Try the methods from sections 1–3 (administrators. devices, ADB, safe mode). If a virus blocks access to settings, use an antivirus or reset via Recovery without formatting the internal memory (option Wipe cache partition instead of Wipe data). However, the safety of the data can only be guaranteed with a backup.

The virus comes back after removal. What to do?

This is a sign that:

  1. The virus has superuser rights (if you have root, revoke them via SuperSU or Magisk).
  2. It is restored from backup (check folders /sdcard/backup or cloud storage).
  3. It is embedded in firmware (requires flashing via Odine, Fastboot or SP Flash Tool).

In the latter case, only a complete flashing or contacting a service center will help.

How to find the name of the virus package applications?

There are several ways:

  1. Via ADB: adb shell pm list packages -f | grep "keyword".
  2. Via App Inspector (App in Play Market).
  3. In the task manager: open Settings → Applications → Running and look at the full name of the suspicious process.

Viruses are often disguised as system applications, so compare the packages found with a list of legitimate system packages.

Will flashing via Fastboot help?

Yes, full flashing (not updating!) will delete all data, including viruses, but:

  • Requires unlocking the bootloader (on some devices this will reset DRM keys, for example, Sony Xperia stop working Bravia Engine).
  • You need official firmware for your model (you can download it at 4PDA or the manufacturer's website).
  • The process differs for different brands (instructions for Samsung, Xiaomi, Google Pixel different).

For Samsung use Odin, for Xiaomi — Mi Flash Tool, for Pixel — Fastboot.

Can a virus damage the hardware of a smartphone?

No, viruses on Android cannot physically damage processor, memory or screen. However, they can:

  • 🔋 Drain the battery quickly (due to background activity).
  • 📶 Overheat the device (constant load on the CPU).
  • 💸 Steal money (via SMS or banking applications).
  • 📸 Spy (access to camera, microphone, geolocation).

If after removing the virus the phone continues to heat up or discharges quickly, check the battery status through Settings → Battery → Battery status or the application AccuBattery.