The situation when a smartphone begins to behave unpredictably occurs suddenly. Pop-up ads block your work, your battery drains within a couple of hours, and unfamiliar apps appear on your screen without your knowledge. These are sure signs that malicious code has penetrated the system, and standard cleaning methods may not cope with threats that have received administrator rights.
Using a personal computer in the fight against mobile threats provides a significant advantage. Powerful desktop antivirus scanners have more extensive signature databases and deeper analysis algorithms than mobile versions. In addition, connecting via USB allows you to access the file system at a level inaccessible to the infected device itself, which is critical for removing deeply embedded Trojans.
In this material we will analyze professional cleaning methods. You will learn how to use USB debugging, work with the ADB command line, and use specialized software to completely remove the threat. Preparation will take a little time, but the result will allow you to return your gadget to functionality and the security of personal data.
Preparing equipment and diagnosing the threat
Before starting active actions, you need to properly prepare the workplace. You will need a computer running Windows, macOS or Linux, a working USB cable and, preferably, an original one, since cheap analogues can only be used for charging and do not transfer data. Also make sure that a fresh antivirus with updated databases is installed on your PC.
The first step is visual diagnostics. Pay attention to the behavior of the system. If the phone heats up when idle or traffic is consumed abnormally quickly, this is the work of a miner or botnet. Write down the names of suspicious applications that you did not install. This information will be useful for manual removal via a computer.
⚠️ Attention: If a malicious app blocks the screen and demands a ransom (banner virus), do not try to solve the problem by paying. Proceed to the safe mode entry methods described below to bypass the interface lock.
It is important to check whether USB debugging is enabled on your device. Without this feature, the computer will only see the phone as a storage device, which will limit treatment options. If the menu is blocked by a virus, you will have to skip this item and immediately proceed to boot in safe mode to activate the setting.
Using anti-virus software on the computer
The simplest, but not always effective method is scanning the connected device with a desktop antivirus. Modern solutions from Kaspersky, Dr.Web or ESET can work with mobile files. Connect your smartphone in file transfer mode (MTP) and run a full scan of the disk corresponding to the phone.
However, this method has a significant drawback. Antivirus on a PC sees the file system, but does not have access to Android system processes running in memory. It can remove the installation file (APK), but will not be able to deactivate an already running virus if it has embedded itself in the system partition.
Nevertheless, this method is excellent for removing Trojans masquerading as media files or documents. In the scanner settings, be sure to enable the option to treat infected objects, and not just delete them, in order to save important data if a virus has penetrated into them.
Use the "Quarantine" function in your antivirus. If, after removing the virus, the phone stops booting, you can restore the file from quarantine and try another cleaning method.
If a standard scan does not produce results, a more in-depth intervention will be required. Proceed to using specialized utilities designed specifically for the mobile platform, which are installed on the computer but control processes on the phone.
Cleaning through safe mode and manual removal
Safe mode is a system state in which only standard applications are loaded. This is an ideal way to deprive the virus of its ability to autorun. To enter, you usually need to hold down the power button on the screen, and then hold down the “Shut down” or “Reboot” item for a long time until the corresponding request appears.
On different models, be it Samsung Galaxy or Xiaomi Redmi, button combinations may differ. Sometimes you need to hold down the physical volume down button while turning on the device. As soon as you see the words “Safe Mode” in the corner of the screen, connect your phone to the computer.
In this mode, you can safely remove the suspicious application through the settings. Go to Settings → Applications, find the malicious object and click "Delete". If the button is inactive, it means that the virus has received device administrator rights, and you need to remove them in the section Security → Device administrators.
☑️ Algorithm of actions in safe mode
After uninstall, be sure to reboot your device normally and check if the problem goes away. If the virus has returned, then its components are hidden in system folders, and you will need to use command line tools.
Removing viruses through ADB (Android Debug Bridge)
ADB tools are the most powerful tool for advanced users. It allows you to send commands directly to the operating system, bypassing the GUI, which can be blocked or corrupted by malware. To work, you need to download the package Platform Tools from the official website of the developers.
After unpacking the archive, open the command line in the tools folder. Connect your phone and enter the command adb devices. If a notification about allowing debugging appears on your smartphone screen, confirm it. The list should display the serial device.
adb shell pm list packages | findstr "virus_name"This command will display the exact system name of the malware package. Knowing it, you can forcefully uninstall the application, even if the uninstall button in the menu is blocked. Use the uninstall command with the -k flag to save data (if needed) or without it for a complete cleanup.
adb uninstall com.malicious.virus.package⚠️ Warning: Be extremely careful when entering package names. Removing an Android system component (for example
com.android.systemui) will result in the interface not working and will require flashing the device.
The ADB method is effective against spyware and ad modules that hide their icons. It allows you to see all installed packages, including hidden ones, which makes it an indispensable tool in the arsenal of a digital hygienist.
What to do if ADB does not see the device?
Make sure that ADB Interface drivers are installed. Try a different USB port, preferably USB 2.0. Check the cable for functionality with other devices. On some phones (for example, Huawei), you need to additionally enable the “Charge Only” item in the developer menu and switch it to file transfer mode.
Specialized utilities for treating Android
There is a class of apps that are installed on a PC, but scan the file system and Android processes. A striking example is Dr.Web CureIt! for mobile or specialized modules as part of desktop antiviruses. They work on a signature principle, comparing application code with a database of known threats.
The advantage of such utilities is automation. You don't need to know package names or write commands. The app itself will find infected files and offer treatment or removal. This is the best choice for users who do not want to understand the technical details of the operating system.
| Utility name | License type | Main function | Difficulty of use |
|---|---|---|---|
| Dr.Web CureIt! | Free | Search and remove Trojans | Low |
| Kaspersky Virus Removal Tool | Free | Treatment of active threats | Low |
| ADB AppControl | Freemium | Package management via ADB | Medium |
| Malwarebytes | Paid/Trial | Real-time protection | Low |
Before starting the scan, be sure to click the update button in the interface applications. New strains of viruses appear daily, and yesterday's database may not recognize today's threat.
A combined approach gives the best result: first scan the device with an antivirus on your PC, then use ADB to remove residual files that could not be removed automatically.
Extreme measures: resetting and flashing the device
If none of the above methods helped, and the virus continues to parasitize the system, a radical but completely effective method remains - a complete reset (Hard Reset). This procedure will erase all data from your phone, including contacts, photos, and apps, returning the device to its factory state.
Before performing a reset, it is critical to back up your important data to your computer or the cloud. Please note that if the virus has already entered the backup, it may return during recovery. Therefore, it is better to save only personal files (photos, documents), and reinstall applications manually.
The reset can be performed through the Recovery menu. To do this, turn off the phone, then hold down the combination of buttons (often this Volume up + Power). In the menu that appears, select Wipe data/factory reset. Confirm the action and wait for the process to complete.
⚠️ Attention: Resetting the settings does not remove viruses if they are located in the system partition that has been modified (for example, when installing a custom recovery or root access). In such cases, a complete flashing of the device is required, with all partitions cleared.
After the reset, the phone will be like new. Do not restore your application backup right away. Configure your device again, install a reliable antivirus, and only then start downloading files. This will ensure that you do not return the infection back to the clean system.
☑️ Post-reset checklist
Preventing re-infection
Removing the virus is only half the battle. To prevent the problem from recurring, you need to change your smartphone usage habits. The main attack vector is the installation of applications from dubious sources. Never download APK files from forums, file hosting services, or sites that promise “hacked” versions of games.
Update your operating system regularly. Developers Android constantly close security vulnerabilities in new patches. An outdated OS version is an open door for attackers. Enable automatic checking for updates in your phone settings.
Use DNS filtering or applications that block ads at the network level. Many viruses reach your device through advertising networks on legal websites. Blocking suspicious domains significantly reduces the risk of accidental infection when surfing the Internet.
Enable the "Google Play Protection" function in the application store settings. It scans installed apps even from third-party sources and warns of dangers before malicious code is executed.
Be careful when granting permissions to applications. If a simple flashlight asks for access to contacts, SMS and location, this is a clear sign of spyware. Deny suspicious requests and remove such applications immediately.
Is it possible to remove a virus without losing data?
Yes, in most cases, using anti-virus scanners or ADB commands allows you to remove a malicious application without affecting your personal files. A reset to factory settings is required only in the most extreme cases, when a virus has become embedded in the system.
Will formatting the SD card help?
If the virus is on the memory card, then formatting (in FAT32 or exFAT mode) will completely clear it. However, modern viruses most often reside in the internal memory of the phone, so clearing the SD card may not solve the problem.
Is it dangerous to connect an infected phone to a PC?
The risk of infecting your computer is minimal if you have a modern antivirus installed on your PC. Android viruses (APK) cannot be executed in the Windows environment. However, it is theoretically possible to become infected through driver vulnerabilities or if the virus disguises itself as an .exe executable file on a memory card.
What to do if the virus requires money to unlock?
Never pay. This is a scam. Boot into Safe Mode, uninstall the blocker app through Settings, or use ADB to deactivate it. After removing the malware, access to the phone will be restored.
Are root access needed to remove a virus?
No, having root access is not required. Moreover, having superuser rights often makes it easier for viruses to infiltrate a system. Standard access rights are quite sufficient to remove most threats through ADB or antiviruses.