A virus disguised as a message from the Ministry of Internal Affairs is one of the most common fraudulent schemes on Android. Attackers block the smartphone screen with a fake notification about an “offense,” demand payment of a “fine,” or mislead the user into installing malware. Unlike real notifications from government agencies, such messages never come via SMS or pop-ups on the screen.

The main danger of the Ministry of Internal Affairs virus is not only blocking the device, but also the theft of personal data, passwords from banking applications or social network accounts. In 2026, scammers are actively using new camouflage methods: from fake websites to phishing pages with logos. This article will help not only remove the virus, but also restore the phone’s functionality without losing data. Government services to phishing pages with logos Sberbank And Tinkoff. This article will help not only remove the virus, but also restore the phone’s functionality without losing data.

Signs of infection with the Ministry of Internal Affairs virus on Android

First signal — sudden screen lock with a message like: “Your phone is blocked by the Ministry of Internal Affairs for viewing prohibited content". The window can imitate an official document with stamps, article numbers of the Criminal Code of the Russian Federation and a requirement to pay a fine via Qiwi, UMoney or a bank card. Important: real government agencies never block smartphones and do not demand payment through instant messengers or cryptocurrency.

Other symptoms:

  • 📱 The screen locks immediately after unlocking, preventing you from opening the menu.
  • 🔒 Pop-up windows appear with warnings about “pornography”, “piracy” or “terrorism”.
  • 📴 The phone itself starts sending SMS to short numbers (check the costs in your personal account operator).
  • 🔄 The heating of the device and battery consumption increase - the virus works in the background.
  • 📎 Unknown apps appear in the list of installed applications (for example, System Update, Android Security).

If you notice at least 2-3 signs from the list, your smartphone is almost certainly infected. Don’t panic: the Ministry of Internal Affairs virus is removed without contacting to the service center, but you need to act quickly - some versions of malware encrypt files on the device.

📊 How did you first encounter the MVD virus?
Through a pop-up window in the browser
After installing an application from an unknown source
Via SMS from suspicious link
Another option

First steps: how to unlock your phone and stop the virus

If the screen is completely blocked by a message from the Ministry of Internal Affairs, try emergency. rebootFor this:

  1. Press the power button for 10-15 seconds until the phone turns off.
  2. Wait 30 seconds and turn on the device again.
  3. Immediately after loading, try to open Settings (swipe down from the top edge of the screen and tap on the gear).

If a virus blocks access to settings, use safe mode:

  • 🔧 With the phone turned off, hold down the power button.
  • When the manufacturer's logo appears, hold down the button volume downuntil safe mode loads (at the bottom of the screen there will be an inscription Safe Mode).
  • 📱 In this mode, the virus is not active - remove suspicious applications (see the next section).
⚠️ Attention: Do not enter bank card details or passwords while the virus is running not deleted! Fraudsters can intercept input from the keyboard.
💡

If the phone does not respond to buttons, connect it to the charger for 10-15 minutes - sometimes the virus locks the screen when the battery is low.

Manual removal of the Ministry of Internal Affairs virus through the Android settings

If you managed to log into Settings, follow these instructions:

  1. Remove the device administrator:
    • Go to Settings → Security → Device Administrators (on some phones Samsung or Xiaomi the path may be different: Settings → Biometrics and security → Other security settings).
    • Find unknown applications in the list (for example, Device Admin, Security Service) and disable their rights.
  • Remove malware:
    • Open Settings → Applications.
    • Tap on the three dots in the upper right corner and select Show system ones.
    • Check the list for suspicious applications (see table below). Remove them by clicking Uninstall or Disable.
    Name of the virus in the system Symptoms Action
    Android Security Suite Imitates an antivirus, requires payment Delete
    System Update or Software Update Requests to update the OS through a third-party site Delete + clear cache
    Flash Player or Adobe Flash Outdated software, often used for hacking Delete
    com.android.security System virus name Ministry of Internal Affairs Disable + delete data

    If the application is not removed (the button is inactive), it means that the virus has acquired superuser rights. In this case, only resetting to factory settings or flashing it will help.

    ☑️ Check for residual traces of the virus

    Done: 0 / 4

    Reset to factory settings: last resort

    If manual deletion did not help, perform hard resetThis method will delete all data from the phone, including the virus, but photos, contacts and applications will also be erased. First, make a backup copy of important files (if the phone works even a little):

    • 📸 Photos and videos: copy to your computer via USB or upload to Google Photos.
    • 📞 Contacts: export to a VCF file via Contacts → Settings → Import/export.
    • 📝 SMS and call log: use applications like SMS Backup & Restore.

    Reset instructions (relevant for most Android phones 10–14):

    1. Turn off phone.
    2. Hold down the button combination to enter recovery mod:
      • Samsung: Power + Volume up + Bixby.
      • Xiaomi/Redmi: Power + Volume up.
      • Google Pixel, OnePlus: Power + Volume Down.
  • In the recovery menu, select Wipe data/factory reset (control volume buttons, confirm - power button).
  • After resetting, select Reboot system now.
    • ⚠️ Attention: On some phones (for example, Huawei or Honor) To reset, you need to enter your account password Google or Huawei ID. If you have forgotten it, restore access in advance through another device.
    What what to do if the virus returns after the reset?

    This means that malware is flashed into the system partition. In this case, only flashing via Fastboot or ODIN (for Samsungwill help). model.

    Removing a virus through a computer (ADB method)

    If the phone is blocked immediately after turning on, but USB debugging was enabled earlier, you can remove the virus through Android Debug Bridge (ADB)This method is suitable for experienced users.

    You will need:

    • 🖥️ Computer with Windows/macOS/Linux.
    • 🔌 USB cable (preferably original).
    • 📦 Utility Platform Tools from Google.

    Steps:

    1. Connect your phone to your computer and open Command Prompt (cmd on Windows or Terminal on macOS/Linux).
    2. Go to the folder with platform-tools and enter the command: 
      adb devices

      If the device is shown in the list, run:

      adb shell pm list packages | grep "suspicious_keyword"

      (replace suspicious_keyword with part of the virus name, for example security or admin).

    3. Remove the found packages with the command: 
      adb shell pm uninstall -k --user 0 com.example.virus

      (replace com.example.virus with the real name of the package).

    If ADB is not recognizes the device, check whether USB debugging is enabled in the developer settings (Settings → About phone → Build number - tap 7 times, then return to Settings → System → For developers).

    How to restore data after removing a virus

    If you do not have time to make a backup before resetting, try restoring files using specialized apps:

    Data type app for recovery Features
    Photos, videos DiskDigger, Recuva Works only if the data has not been overwritten
    Contacts, SMS Dr.Fone, Tenorshare UltData Requires root access for full recovery
    Notes, documents EaseUS MobiSaver Supports recovery from a memory card

    Important: do not write new files to the phone after a reset - this reduces the chances of restoring old data. Use a memory card or cloud services (Google Drive, Yandex Disk) to save the recovered data. files.

    ⚠️ Attention: Data recovery apps often contain advertising or trial restrictions. Download them only from official sites (diskdigger.org, drfone.wondershare.com) and turn off the Internet on your phone while working to avoid reoccurrence. infection.

    How to protect yourself from the Ministry of Internal Affairs virus in the future

    Prevention is the best way to avoid infection. Follow these rules:

    • 🔒 Do not install applications from unknown sources. Even if the APK file was sent by a friend, check it through VirusTotal.
    • 🛡️ Use an antivirus. Free versions Kaspersky Mobile, Bitdefender or Malwarebytes effectively block phishing sites.
    • 🌐 Do not follow links in SMS or messengers. Fraudsters often disguise a virus as notifications from banks or delivery services.
    • 🔄 Update Android regularly. New versions of the OS have closed the vulnerabilities that viruses exploit.
    • 📱 Configure installation blocking from unknown sources: Settings → Security → Unknown sources (disable for everyone applications).

    If you often download applications outside Google Play, create a separate account Google to test new apps. This way the virus will not gain access to the main data.

    💡

    MVD virus cannot block your phone if you have disabled installation from unknown sources and have regular antivirus checks enabled.

    FAQ: Frequently asked questions about the MVD virus on Android

    You can Is it possible to remove the MVD virus without resetting the settings?

    Yes, if the virus has not received superuser rights (root). Try manual removal via Settings → Applications or safe modeIf the virus blocks access to the settings, use the method ADB (see section above).

    The virus requires you to pay a fine. What should you do?

    Do not transfer money under any circumstances. This is a scam! Ministry of Internal Affairs arrive by mail or via Government services, but never through pop-up windows on your phone. Immediately turn off the Internet (airplane mode) and start removing the virus.

    After removing the virus, the phone began to slow down.

    The virus has probably damaged system files or left behind background processes. Try:

    1. Clear the cache via Settings → Storage → Cache data.
    2. Delete remaining unknown applications.
    3. Run optimization through the built-in tools (on Xiaomi: Settings → About phone → Optimization).

    If the brakes remain, do a factory reset settings.

    Can the Ministry of Internal Affairs virus steal money from a bank card?

    Yes, if you entered card data into a fake “fine” payment window. Immediately:

    • Block the card through the bank’s mobile application.
    • Call bank support and report fraud.
    • Check your transaction history for suspicious charges.

    The virus can also intercept SMS with confirmation codes, so after removing the malware, change the passwords for your bank accounts.

    Is the phone rooted?

    Yes, with rights root The virus is capable of:

    • Installing itself in the system partition (can only be removed by flashing it).
    • Encrypt files and demand ransom.
    • Disguise as system processes (for example, com.android.system).

    If you have root, after removing the virus:

    1. Check the system folders (/system/app) for suspicious files.
    2. Remove root access via Magisk Manager or SuperSU.
    3. Reset your settings.