Removing viruses from Android via a computer: step-by-step guide

Detecting malware on a smartphone is always stressful, especially when the device begins to behave unpredictably: intrusive banners appear, money disappears from accounts, or the phone simply refuses to respond to commands. In such situations, standard cleaning methods directly on the device are often powerless, since the virus blocks access to settings or hides the icon of the malicious application. This is where a personal computer comes to the rescue, becoming a powerful diagnostic and treatment tool.

Using PC for virus removal with Android gives the user a number of undeniable advantages. Firstly, the computer has large computing resources and access to extensive databases of threat signatures, which allows you to scan the smartphone’s file system in more depth. Secondly, control via a USB cable or Wi-Fi allows you to bypass locks imposed by malicious code on the touch screen of a mobile device. However, this process requires care and strict adherence to the sequence of actions so as not to damage system files.

In this article we will look in detail at how to turn your computer into a rescue center for an infected gadget. We will look at working with official utilities from manufacturers, using the ADB command line and radical cleaning methods. Remember that the speed of the reaction directly affects the safety of your personal data, so you should not put off the treatment procedure.

Preparing your computer and smartphone for the treatment procedure

Before taking active steps to scan and remove threats, you need to properly prepare your workplace. Chaotic attempts to connect your phone to the first antivirus you come across without prior configuration can lead to the PC simply not recognizing the device or, worse, getting infected itself when transferring files. The first step should always be to install the latest drivers and enable special debugging modes.

For successful interaction of the Windows or macOS operating system with your smartphone, you must activate the mode USB debugging (USB Debugging). This feature is located in the hidden "For Developers" menu, which is disabled by default. To unlock it, go to Settings → About phone and click 7 times on the item Build number. After this, a new section will appear in the main settings menu where you need to find the debugging switch and activate it.

⚠️ Attention: When connecting the phone to a PC with the During debugging, a request will appear on the smartphone screen to allow access from this computer. Never confirm this action if you are not sure of the security of the computer you are connecting to.

The next important step is to select reliable anti-virus software for the computer itself. Even if your goal is to cure your phone, the PC's protective perimeter must be impenetrable. It is recommended to use solutions such as Kaspersky Total Security, Dr.Web CureIt! or Bitdefender. These apps have modules for scanning connected mobile devices and can detect threats at the file system level, provided they are connected correctly.

It is also worth preparing a high-quality USB cable in advance. Cheap “charge-only” cables do not transmit data, which will make in-depth diagnostics impossible. Use an original cable or a certified analogue that guarantees stable data exchange between the device ports.

Use of official software from device manufacturers

Many users underestimate the capabilities of proprietary software that comes with the smartphone or is available for download on the manufacturer’s website. apps such as Samsung Smart Switch, Xiaomi Mi PC Suite or Huawei HiSuitehave deep access to the system partitions of the device. They can not only create backup copies, but also check the integrity of system files, and in some cases, forcefully reinstall the firmware, which is guaranteed to remove any viruses.

The treatment process through a proprietary utility usually looks like this: after connecting the device, the app conducts an initial diagnosis. If critical errors or signs of tampering with the system code are detected, the user is offered a recovery function. For example, in the tools Samsung there is an “Emergency Recovery” option, which completely reflashes the phone, erasing all user data along with malicious code.

Manufacturer	Utility name	Flashing option	Scan for viruses
Samsung	Smart Switch / Odin	Yes (full)	Indirect (through integrity)
Xiaomi	Mi Flash Tool	Yes (full)	No (cleaning only)
Huawei	HiSuite	Yes (recovery)	Basic
Sony	Xperia Companion	Yes (recovery)	No

It is important to understand that using such tools often results in a complete data reset. Therefore, if possible, before starting the recovery procedure, you should try to copy important photos and documents to your computer’s hard drive manually, going into the phone’s memory like a regular drive. However, if the virus encrypts files or blocks access to memory, this step will have to be skipped in order to save the device itself.

Manual removal of malicious files via ADB

For advanced users who want precise to remove a virus without losing all data, Android Debug Bridge (ADB)will be the ideal tool. This is a universal utility included in Android SDK Platform-Toolsthat allows you to send commands directly to the smartphone operating system from your computer. Through the console, you can get a list of all installed applications, identify suspicious processes and force them to be removed.

After installing the platform and connecting your phone with debugging enabled, open the command line on your PC in the folder with the utility. The first command should always be a connection check:

adb devices

If your device appears in the list with status device, then the connection has been established successfully. Next, you need to get a list of all packages (applications) installed on the system. This will allow you to find the name of the malicious app, even if it has hidden its icon:

adb shell pm list packages

After examining the command output, look for suspicious names that do not correspond to applications you know. Viruses often disguise themselves as system processes, using names like com.android.system.update (if this is not the original file) or a set of random characters. Having found the package-name of the virus, use the command to remove it:

adb shell pm uninstall --user 0 package.name of the virus

⚠️ Attention: Be extremely careful when removing packages through ADB. Removing a critical system component may cause the phone to fail to boot (bootloop). Delete only those applications whose origin you are 100% sure of.

This method allows you to precisely cut out the attacker, while preserving personal photos, contacts and messages. However, it requires some technical literacy. If you are not sure which file is a virus, it is better to use the full scan or reset methods.

What to do if the uninstall command does not work?

If the virus has acquired device administrator rights, the normal uninstall command may be blocked. In this case, you first need to revoke the administrator's rights with the command: adb shell dpm remove-active-admin --component-name name.package.virus, and only after that try to remove the application.

Scanning the phone's memory with antiviruses for PC

The classic approach to treatment is to connect the phone in storage mode (MTP) and run a full antivirus scan on the computer. Although modern versions of Android limit direct access to system folders for third-party apps, scanning external memory and user directories is still an effective method of detecting Trojans masquerading as apk files or scripts.

When connecting, select the file transfer mode. Launch your antivirus on your PC and add drives corresponding to the phone’s internal storage and SD card to the scanning area. Particular attention should be paid to the folders Download, DCIM and Android/obb, where installation files of malware are most often hidden. The antivirus will be able to detect known signatures and quarantine infected files.

It is worth noting that this method has limitations. It will not be able to remove a virus that has already embedded itself in the system partition and is running as a background process. In this case, the antivirus on the PC will see the file, but will not be able to delete it, since it is occupied by the phone’s operating system. However, this is an excellent way to find and neutralize “dormant” threats that have not yet been activated.

If the antivirus finds an infected file, but cannot delete it, try renaming the file extension manually through Windows Explorer by adding to the end of `.bad` and then reboot your phone. Sometimes this breaks the chain of execution of malicious code.

Radical method: Factory reset via Recovery

When none of the soft methods help and the phone continues to show signs of infection, the only guaranteed method remains - a hard reset. You can perform this procedure through a computer using Fastboot commands or special flashing utilities, which is especially important if the phone menu is blocked by a ransomware virus.

For devices with an unlocked bootloader, you can use the Fastboot command to clear the data partition. Put your phone into Fastboot mode (usually by holding down the volume and power buttons when turning it on) and connect it to your PC. At the command line, enter:

fastboot -w

This command will completely erase the partition userdata, deleting all applications, settings and, unfortunately, personal files, but any virus will disappear along with them. This is a “clean slate” for your operating system.

⚠️ Attention: The reset procedure via Fastboot or Recovery is irreversible. All data not saved in the cloud or on your computer will be lost without the possibility of recovery. Make sure you have a backup of important information.

If using the command line seems too complicated, many utility utilities (mentioned in the second section) have a "Wipe Data" or "Factory Reset" button in the GUI. The principle of operation is the same: complete formatting of the user partition. After the process is completed, the phone will reboot in the state it was in when purchased.

Prevention of re-infection and data protection

After successfully removing the virus, it is critical to analyze the cause infection so that the situation does not repeat itself. In most cases, the culprit is the user himself, who accidentally installed the application from an unverified source or followed a phishing link. Change your digital hygiene habits: stop downloading APK files from third-party forums and torrent trackers.

Be sure to change all passwords that you entered on the infected device. This applies to Google accounts, social networks, banking applications and email services. The virus could intercept data input from the keyboard or take a screenshot of the screen at the time of authorization. Don't be lazy to enable two-factor authentication wherever possible - this will create an additional barrier for attackers.

Regularly update the Android operating system and installed applications. Developers constantly release security patches that close vulnerabilities exploited by viruses. Enable the function Google Play Protect in the application store settings - it automatically scans the phone for threats in the background.

Is it possible to remove a virus from Android via a PC without losing data?

Yes, this is possible if you use ADB commands to specifically remove a malicious package or if an antivirus on a PC can neutralize the file in mode drive. However, if the virus has acquired deep access rights or has encrypted files, it is unlikely to be possible without a full reset (Hard Reset).

Why does the computer not see the phone when connected for treatment?

The most common reasons: a faulty USB cable (charge only), lack of ADB or MTP drivers on the computer, or the phone is in the “Charge Only” mode. Check the cable, install the drivers and select the “File Transfer” mode in the notification on your phone.

Will resetting the settings remove the virus if it is on the SD card?

No, a standard reset via the menu or Recovery usually formats only the internal memory of the phone. If the virus is on the memory card, you need to remove it manually through a computer or format the SD card itself separately.

Is it safe to enter bank passwords immediately after removing the virus?

It is recommended to wait at least 24 hours and make sure the system is stable. It is best to change passwords from another, obviously clean device (for example, from the same PC from which the treatment was carried out) before entering them on a cleaned phone.