How to completely remove a Trojan virus from an Android phone: a step-by-step guide

Trojan viruses on Android are one of the most dangerous threats to your smartphone. Unlike regular ad viruses, Trojans can steal passwords, bank data, send paid SMS messages, or even turn your phone into part of a botnet. The main problem is that they disguise themselves as legitimate applications and often go undetected for months.

This article will help not only detect a Trojan, but also remove it completely from the device - even if it has blocked access to settings or antivirus. We will look at both standard methods (via safe mode and antivirus scanners) and advanced ones (manual removal via ADB and factory reset). Important: some Trojans are able to survive after flashing, so the methods given here take into account such cases as well.

If your phone starts to slow down, spontaneously open ads, overheat or discharge in a few hours, this is a reason to check the system for Trojans. Even if there are no symptoms, a preventative check every 2-3 months is recommended for all Android users.

Signs of infection with a Trojan virus

Trojans rarely reveal their presence with clear symptoms, but there are indirect signs that should alert you:

• 📱 Unknown applications in the list of installed apps (especially with names like "System Update", "Flash Player" or "Google Play Service").
• 💰 Money debits from your account or SMS to short numbers that you did not send.
• 🔋 A sharp increase in battery consumption (check in Settings → Battery - if the process is unknown consumes >15%, this is suspicious).
• 🌐 Redirection in the browser to suspicious sites (for example, when you open Google you end up on "google-security-alert.com").
• 📥 Spontaneous installation of applications or the appearance of advertising on top of all windows.

Trojans are especially dangerous. disguise as Android system processes (for example, "com.android.system" or "android.process.media"). They are difficult to detect without special tools, since they do not appear in the standard application menu.

⚠️ Attention: Some Trojans (for example, Anubis or Cerberus) can obtain rights device administrator. This allows them to block removal through standard means. If you see unknown applications in Settings → Security → Device administrators this is a critical sign of infection.

Preparing for deletion: safe mode and backup

Before you start cleaning, you need put the phone into safe mode. This disables all third-party applications, including the Trojan, and allows you to work without its intervention.

Methods for starting safe mode depend on the phone model:

• 📱 Samsung, Xiaomi, Google Pixel: Hold down the power button → long tap on "Turn off" → "Safe mode."
• 📱 Huawei, Honor: Press the power button → "Turn off" → hold your finger on the screen until the request appears.
• 📱 Universal method: Turn off the phone → turn it on by holding the button decrease the volume until boot.

In safe mode, the inscription “Safe Mode” (Safe Mode) will appear at the bottom of the screen. Now you can start diagnosing. But first back up your important data:

⚠️ Attention: Do not connect the infected phone to the computer without first checking with an antivirus (for example, Kaspersky Virus Removal Tool). Some Trojans (for example Triada) can spread via a USB connection.

Method 1: Removing the Trojan through antivirus applications

If the Trojan has not blocked the installation of new apps, the easiest way is to use specialized antiviruses. However, not all of them are equally effective against Trojans. We recommend the following tools:

Scanning instructions:

1. Install the selected antivirus from Google Play (do not download APK from third sites!).
2. Run full scan (not fast!). This may take 30-60 minutes.
3. If threats with the mark Trojan, Backdoor or Spyware are found, remove them through the antivirus interface.
4. Reboot the phone into normal mode and check the symptoms.

If the antivirus does not find the Trojan, but the symptoms remain, try another scanner (for example, after Malwarebytes run Kaspersky). Some Trojans block the work of antiviruses - in this case, proceed to the following methods.

Method 2: Manual removal of the Trojan through Android settings

If the Trojan has not received administrator rights, it can be removed manually. To do this:

1. Open Settings → Applications (or "All applications").
2. Tap on the three dots in the upper right corner and select "Show system processes".
3. View the list for suspicious applications. Pay attention to:

• 📦 Applications with unclear names (for example, "Update Service", "Android Helper").
• 📅 Applications with installation datewhich you do not remember.
• 📥 Applications with zero size or very small (for example, 10 KB).
• 🔍 Applications that cannot be stopped (the "Stop" button is inactive).

If you find a suspicious application:

4. Tap on it → "Delete" (or "Disable" if the delete button is inactive).
5. If the error "Failed to uninstall" appears, proceed to method 4 (uninstallation via ADB).

Pay special attention to the sections:

• Settings → Security → Administrators devices —there may be Trojans with extended rights here.
• Settings → Accessibility —some viruses disguise themselves as accessibility services.

Method 3: Removing the Trojan via ADB (for experienced users)

If the Trojan blocked removal through the interface or received administrator rights, you can use Android Debug Bridge (ADB). This is a debugging tool that allows you to control your phone through the command line of your computer.

You will need:

• 💻 Computer with Windows, macOS or Linux.
• 🔌 USB cable (preferably original).
• 🛠️ Installed drivers for your phone (download from the manufacturer's website).
• 📥 ADB and Fastboot (official package from Google).

Instructions:

1. Turn on phone USB debugging:
   • Go to Settings → About phone.
   • Tap 7 times on the "Build number" item (the message "You have become a developer" will appear).
   • Go back to Settings → System → For Developers and enable "USB Debugging".

adb devices

adb shell pm list packages -f

adb shell pm uninstall -k --user 0 package name

⚠️ Attention: Removing system packages via ADB can lead to phone malfunction. Do not remove anything unless you are 100% sure that it is a virus. To check, use services like VirusTotal (download the APK of the Trojan and check the reports).

Method 4: Removing the Trojan via Recovery Mode (if the phone is locked)

If the Trojan has completely blocked the phone (does not allow you to enter the settings, constantly opens ads or demands a ransom), you can try to remove it via Recovery ModeThis method does not require a computer. but will reset all application settings.

Instructions:

1. Turn off the phone.
2. Hold down the button combination to enter Recovery:
   • Samsung: Power + Volume up + Bixby.
   • Xiaomi/Redmi: Power + Volume up.
   • Google Pixel: Power + Volume down (after vibration, release the power).
   • Huawei: Power + Volume up (hold for 10 seconds).

If the Trojan returned after the reset (this happens with viruses like xHelper), which means it is built into the firmware. In this case, only flashing via Fastboot (method 5) will help.

Method 5: Reflashing the phone (extreme case)

If the Trojan survived after a factory reset, it most likely built into the firmwareThis is typical for viruses that spread through fake firmware or infected updates. (for example, Triada or Loapi).

In this case, it is necessary completely reflash phone official firmware from the manufacturer. The instructions depend on the model, but the general algorithm is as follows:

1. Download official firmware for your model from the manufacturer's website:
   • Samsung: SamFW or Samsung Firmware.
   • Xiaomi: Official MIUI website.
   • Google Pixel: Google Factory Images.

fastboot flash bootloader file_name.img
fastboot reboot-bootloader
fastboot flash radio file_name.img
fastboot reboot-bootloader
fastboot -w update firmware_name.zip

⚠️ Attention: Incorrect firmware can turn your phone into a brick. If you are not sure of your actions, contact the service center. Also note that flashing the firmware will reset it DRM keys (on some phones this will lead to loss of camera quality or sound).

After flashing:

• Do not restore data from a backup (the Trojan may return!).
• Install an antivirus and scan everything downloaded files.
• Update all applications via Google Play.

How to protect your phone from Trojans in the future

The best protection against Trojans - preventionFollow these rules to minimize risks:

• 🔒 Do not install APKs from unverified sources (torrents, forums, sites with “hacked” games).
• 🛡️ Use an antivirus with real protection (not just a scanner). Set up automatic scanning once a week.
• 🔄 Update Android and applications. Many Trojans exploit vulnerabilities in older versions.
• 📱 Disable installation from unknown sources (Settings → Security → Unknown sources).
• 🌐 Do not connect to public Wi-Fi without a VPN (for example, ProtonVPN or Windscribe).
• 💳 Do not enter banking data in the browser on your phone (use official bank applications).

You need to be especially careful with:

• 🎮 "Hacked" games (90% of them contain Trojans or miners).
• 📺 Applications for "free" viewing of movies/series (for example, Cinema HD, TeaTV).
• 💼 Fake "investors" or "cryptocurrency wallets" (a popular method of distribution Anubis).

FAQ: Frequently asked questions about removing Trojans from Android