Have you noticed that your phone has started to slow down, show strange ads, or install applications on its own? The antivirus detected the Trojan, but cannot remove it - or does it not see the threat at all, although the symptoms are obvious? This situation is familiar to many users Android, and it is much more dangerous than it seems. Trojan apps can steal bank card data, passwords from social networks, spy on you through a camera, or turn your device into part of a botnet for DDoS attacks.

The problem is that standard antiviruses (Avast, Kaspersky, Dr.Web) are often powerless against deeply embedded threats. New generation Trojans disguise themselves as system processes, block access to security settings or even get superuser rights (root), which makes them invulnerable to conventional removal methods. In this article - 7 proven methodshow to clean a Trojan from Androidif the antivirus cannot cope, including radical measures for advanced cases.

It is important to understand: some methods require technical skills or lead to data loss. We will sort them out from the safest to the most extreme so that you can choose the best option. If the phone is infected a banking Trojan (for example, Anubis, Cerberus), spyware (Pegasus, Hermit) or advertising virus with administrator rights, you need to act quickly and accurately.

📊 How long ago did you notice signs of infection?
Less than a week
1-2 weeks
More than a month
I don’t know, but the phone behaves strange

1. Checking for device administrator rights

Many Trojans receive administrator rightswhich allows them to block removal, hide from antiviruses and recover after a reboot. The first thing you need to do is check the list of applications with such rights and revoke them from suspicious apps.

How to do this:

  • 📱 Open Settings → Security → Device Administrators (on some firmware the path may differ: Settings → Biometrics and Security → Other Security Settings → Phone Administrators).
  • 🔍 Carefully review the list if you see unknown applications (for example, System Update, Android Security, Flash Player these are common ones. Trojan masks), uncheck next to them.
  • 🗑️ After revoking rights, try deleting the application in the standard way (press the icon → “Delete” or through Settings → Applications).

If you cannot uncheck the box (the button is inactive or an error appears), this means that the Trojan has blocked access. In this case, proceed to the next method.

⚠️ Attention: Some legitimate applications (for example, Find My Device from Google or corporate MDM solutions) also have administrator rights. recall them if you are not sure about the purpose of the app.
What to do if there is no "Device Administrators" item?

On some firmware (for example, MIUI or ColorOS) this section may be called otherwise:

  • Xiaomi: Settings → Passwords and security → Auto administration
  • Oppo/Realme: Settings → Biometrics and security → Device administration
  • Huawei: Settings → Security → Device administration

If not found - use the search in the settings (magnifying glass icon at the top).

2. Removal through safe mode

Safe mode (Safe Mode) loads Android only with basic system applications, blocking all third-party apps, including Trojans. if it interferes with normal operation.

How to start safe mode:

  • 🔄 Turn off the phone.
  • 🔘 Press the power button until the manufacturer's logo appears, then hold the volume down buttonuntil the device boots.
  • 📵 “Safe Mode” should appear at the bottom of the screen (Safe Mode).

In safe mode:

  1. Go to Settings → Applications.
  2. Find suspicious apps (sort by installation date).
  3. Click “Uninstall”. If the button is inactive, first revoke all permissions (Permissions → Cancel all).
  4. Clear cache and browser data (Chrome, Opera etc.), since some Trojans are distributed through malicious scripts on websites.

After removal, reboot the phone in normal mode. If the Trojan returns, it is either hidden in system files or has root access.

Make a backup copy of important data|Write down the names of suspicious applications|Disable mobile data and Wi-Fi|Prepare a charged device (minimum 50%)

-->

3. Manual removal via ADB (for advanced users)

If the Trojan is not removed by standard methods, you can try to remove it through Android Debug Bridge (ADB) —a debugging tool that allows you to control the device from a computer. This method requires. enabled USB debugging and is suitable for users who are ready to work with the command line.

Step-by-step guide:

  1. 🖥️ Install Platform Tools (enables adb) on the computer.
  2. 📱 On the phone, enable USB Debugging (Settings → About phone → Build number - press 7 times, then return to Settings → System → For developers → USB debugging).
  3. 🔌 Connect the phone to the PC via USB (select mode Transferring files or MTP).
  4. 💻 Open a command line (Windows) or terminal (macOS/Linux) in the folder with platform-tools and enter:
adb devices

(Your device should appear. If not, check your drivers.)

adb shell pm list packages -f

(Shows a list of all installed packages. Look for suspicious names.)

adb shell pm uninstall --user 0 com.example.virus

(Replace com.example.virus with the name of the Trojan package.)

If the command returns an error DELETE_FAILED_DEVICE_POLICY_MANAGER, then the Trojan has administrator rights - return to the first method.

⚠️ Attention: Removing system applications via ADB can lead to unstable operation of the phone. Do not delete packages named com.android., com.google. or associated with the manufacturer (com.xiaomi., com.huawei. etc.).

4. Reset to factory settings (Hard Reset)

If the Trojan is not removed by any of the above methods, a radical solution remains - full resetThis will remove all data from the phone, including the virus, but will return the device to the “out” state. box." Important: some Trojans (for example, xHelper) can be restored even after a reset if they have infiltrated the partition. /systemIn this case, flashing will be required.

How to do a Hard Reset:

  • 📲 Go to Settings → System → Reset settings → Delete all data.
  • 🔐 Enter your PIN code or pattern.
  • ⚠️ Confirm the action. The phone will reboot and begin the cleaning process (may take 10-30 minutes).

After the reset:

  • 🚫 Do not restore data from a backup (especially if it was created after infection).
  • 🔒 Do not log into your Google/Apple accounts until you install an antivirus and check the system.
  • 🛡️ Install a reliable antivirus (Bitdefender, Malwarebytes) and scan your phone before installing other applications.
Trojan type Survives after a reset? Additional measures
Advertising virus ❌ No Reset is enough
Banking Trojan (Anubis, Cerberus) ⚠️ Sometimes (if /system) Flashing or manual cleaning of the system partition
Spyware (Pegasus) ✅ Yes (uses kernel vulnerabilities) Flashing + security update
xHelper, Shuanet ✅ Yes (recoverable) Removal via fastboot or firmware replacement
💡

Before resetting, remove the SIM card and memory card. Some Trojans (for example, SimBad) can hide on external media and re-infect the phone.

5. Flashing the phone (for advanced users)

If the Trojan survives the reset, it means it has infiltrated the system files. The only way to delete it is on full flashing phone. This is a complex procedure that requires knowledge of terms like bootloader, recovery, fastboot, and carries the risk of “bricking” the device. But in the case of xHelper, Triada or other persistent Trojans, this is the only reliable method.

General algorithm:

  1. 🔍 Find official firmware for your model on the manufacturer's website (Xiaomi, Samsung, Huawei etc.) or on trusted forums (XDA Developers, 4PDA).
  2. 🔓 Unlock bootloader (instructions differ for each brand). For example, for Xiaomi you need to get resolution via Mi Unlock Tool.
  3. 💾 Install the firmware via fastboot or recovery (for example, TWRPThe commands may look like this:
fastboot flash boot boot.img

fastboot flash system system.img


fastboot flash vendor vendor.img


fastboot reboot

⚠️ Warning: Incorrect firmware can lead to loss of IMEI and a non-functioning camera). or the phone completely fails. If you are not sure, contact the service center.

After flashing:

  • 🔄 Update your phone to the latest version Android (many Trojans exploit the vulnerabilities of old ones versions).
  • 🛡️ Install an antivirus with a system file scanning function (Bitdefender Mobile Security).
  • 🚫 Avoid installing APKs from unknown sources.

6. Removing Trojans with root access

If a Trojan received superuser rights (root), it can hide in system folders, modify the kernel, or even block flashing attempts. In this case, you will need special tools like Root Explorer or Terminal Emulator.

How to proceed:

  1. 🔧 Install a file manager with root access (for example, FX File Explorer or Solid Explorer).
  2. 🔍 Check the following folders for suspicious files:
    • /system/app/
    • /system/priv-app/
    • /data/app/
    • /sdcard/ (external memory)
  • 🗑️ Delete those found files (names may contain update, service, helper etc.).
  • 💻 Through the terminal, run the commands:
    • su

    mount -o rw,remount /system
    

    rm -f /system/app/malicious_file.apk
    

    mount -o ro,remount /system
    

    reboot

    If the Trojan has blocked access to root, try:

    • 🔄 Reinstall Magisk or SuperSU (sometimes this resets the Trojan's rights).
    • 🛠️ Use scripts to remove malicious modules (for example, Universal Unroot).
    ⚠️ Attention: Working with root access may disrupt the stability of the system. If you are not sure of your actions, it is better to contact a specialist. Some Trojans (for example, Ztorg) disguise themselves as legitimate root applications, so delete only those files that you are sure of.

    7. data-i="211">If all of the above methods did not help, or you are afraid to flash the phone yourself, the best solution is to contact

    If all of the above methods did not help, or you are afraid to flash the phone yourself, the best way out is to contact official service center. This is especially true for:

    • 📱 Phones with blocked bootloader (for example, many models Samsung or Sony).
    • 🔒 Devices infected spyware Software (Pegasus, FinFisher), which can be hidden in hardware modules (modem, GPS).
    • 💸 Phones with banking Trojansif you have already entered card data on an infected device.

    What to do before visiting the service:

    • 📝 Write down all the symptoms (pop-up windows, strange SMS, overheating, etc.).
    • 🔄 Make a backup copy only important files (photos, documents) to an external drive, but do not restore it to a clean phone.
    • 🛡️ Ask the service not only to remove the virus, but also to update the firmware to the latest version with security patches.

    The cost of the service varies from 1,000 to 5,000 rubles, depending on the complexity. In official centers (Samsung Service, Xiaomi Authorized), the warranty on the device is maintained if infection is not a consequence. root access or unofficial firmware.

    💡

    If the Trojan steals bank card data or passwords, after cleaning the phone be sure change all passwords and revoke the linked cards at the bank.

    FAQ: Frequently asked questions about Trojans on Android

    🔹 Can a Trojan remain after flashing?

    Theoretically, yes, if it has embedded itself in bootloader or hardware modules (for example, a modem), but in practice, 99% of Trojans do. are removed by flashing. The exception is targeted attacks using chipset vulnerabilities (for example, DirtyCOW or Stagefright).

    🔹 How to understand that the Trojan has been completely removed?

    Signs of a clean phone:

    • ✅ Disappeared pop-up windows with advertising.
    • ✅ Unknown applications have stopped appearing.
    • ✅ Antivirus does not find threats after a deep scan.
    • ✅ Increased traffic/charge consumption has disappeared.

    To be sure, scan your phone via VirusTotal (download APK of suspicious files) or use Malwarebytes in deep scan mode.

    🔹 Is it possible to restore data after a reset?

    Yes, but only if a backup was created BEFORE infectionIf the copy was made after. appearance of a Trojan, restoring it is dangerous - the virus may return. To restore, use:

    • 📁 Local copies (if stored on a PC or external drive).
    • ☁️ Cloud services (Google Drive, Yandex Disk), if synchronization was enabled before infection.

    🚫 Do not restore SMS, call log or application settings - the Trojan could be hiding in this data.

    🔹 Why the antivirus does not see Trojan?

    Reasons:

    • 🕵️ The Trojan uses polymorphic code (changes its signature).
    • 🔄 The virus is new, and antivirus databases have not yet been updated.
    • 🛡️ The Trojan blocks the operation of the antivirus (for example, disables its services).
    • 📱 The virus has infiltrated system processes and disguises itself as legitimate files (com.android.system).

    Solution: use online scanners (VirusTotal, MetaDefender) or antiviruses with heuristic analysis (ESET Mobile Security).

    🔹 Can a Trojan infect other devices?

    Yes, some types of Trojans are distributed through:

    • 📎 Bluetooth/Wi-Fi Direct (for example, FluBot sends itself to contacts).
    • 📧 SMS/messengers (sends links to infection to other users).
    • 💽 External media (memory cards, flash drives).

    To prevent spread:

    • 🔌 Turn off Bluetooth and Wi-Fi on the infected phone.
    • 📵 Do not connect it to other devices.
    • 🛡️ Check all gadgets that were in contact with the infected phone with an antivirus.