How to completely remove a virus from an Honor Android phone manually: free methods

Viruses on smartphones Honor is a problem faced by every fifth Android user. Unlike PCs, where antivirus apps work reliably, on mobile devices malware is often disguised as system processes, adware, or even updates. The main difficulty: many "cleaners" from Google Play themselves contain spy scripts or show false threats in order to sell the premium version.

This article is a complete guide to manual virus removal without third-party apps. We'll look at how to identify infected files through hidden menus, which system folders to check first, and how to restore your phone's functionality if a virus has blocked access to the settings. All methods are tested on models Honor, which system folders to check first, and how to restore the phone’s functionality if a virus has blocked access to the settings. All methods are tested on models Honor 70/80/90/X6/X7 and are compatible with MagicOS 7.0+ and EMUI 13+.

Important: if the phone is already blocked by ransomware (screen asking for payment) or reboots every 2-3 minutes - go straight to the section "Emergency measures". In other cases, start with diagnostics.

Signs of a virus on Honor: how to distinguish from system glitches

Not every problem with a smartphone is related to viruses. For example, gaming or slow charging is often caused by battery wear rather than malware. But there are CPU overheating when gaming or slow charging is often caused by battery wear rather than malware. But there is 5 key symptomswhich with a 90% probability indicate infection:

• 📱 Advertising in unexpected places: banners on top of lock screens, in the call menu or even in the gallery. Often redirects to Google Play with an offer to download a "cleaner".
• 🔋 Rapid battery drain (more than 20% per hour in standby mode) + the phone heats up without load. Viruses-miners use the processor to mine cryptocurrency.
• 📥 Unknown applications in the menu or in the list of installed apps (Settings → Applications). Often disguised as “Google Services”, “System Update” or “Flash Player”.
• 📶 Suspicious traffic: mobile data consumption exceeds 1 GB/day without active use. Checked in Settings → Mobile network → Data usage.
• 🔒 Blocking functions: it is impossible to delete applications, change security settings or disable the device administrator.

If noticed at least 2 items from the list - start cleaning. But first turn off mobile data and Wi-Fiso that the virus cannot send data or download updates.

Preparation: what to do before removing the virus

The mistake of most users is to immediately rush to delete suspicious files. Without preparation, this can lead to data loss or completely blocking the phone. Follow the checklist:

Create a backup copy of important files|Write down the phone's IMEI|Connect a charger|Disable synchronization with Google|Find out the model and firmware version-->

1. Backup. Viruses often encrypt files, and some cleaning methods require a factory reset. Copy photos, contacts and documents to Google Drive or computer. Do not connect your phone to PC via USB, if it already has a virus, use the cloud or memory card.

2. IMEI and serial number. Write them down (you can find them in Settings → About phone → Status or on the box). Useful if you need to unlock after a reset.

3. Battery charge. The cleaning process may take up to 1-2 hours. Make sure that the charge is at least 50%, or connect the phone to the network.

4. Airplane mode. Activate it so that the virus cannot contact the server. On Honor this is done by swiping down from the top edge of the screen.

⚠️ Attention: If the phone was released before 2020 (for example Honor 8X or Honor 10 Lite), some system folders may be missing or have different name. Check the current structure through the file manager.

Manual virus removal through Android settings

Let's start with the safest method - cleaning through standard menus. This method will help if the virus has not yet received administrator rights.

1. List of installed applications. Go to Settings → Applications and notifications → Show all applications. Sort the list by installation date (three dots in the upper right corner → Sorting → By installation time). Remove everything suspicious, especially:

• 📦 Applications with names like com.android.system.update, flash.player, google.play.service (but not to be confused with real ones Google Play Services!).
• 🔍 apps with gear, shield or exclamation mark icons are typical masks for viruses.
• 📱 Applications that you did not install (check reviews in Google Playif the name matches legitimate software).

2. Device administrators. Viruses are often registered as administrators to block removal. Go to Settings → Security → Device administrators (on some models Honor path: Settings → Biometrics and password → Other security settings). Uncheck all unknown applications.

3. Accessibility. (for example, BankBot) use accessibility services to intercept SMS. Check the list in Settings → Accessibility → Installed services and disable suspicious ones.

Cleaning system folders: where viruses are hidden on Honor

Viruses are often disguised as system files in folders that are not accessible through the standard Explorer. You will need file manager with root access (for example, FX File Explorer or Solid Explorer). If there are no rights, skip this section and proceed to resetting the settings.

1. Folder /system/appPre-installed applications can be stored here. add files with the extension .apk or .odexhere. Look for files with a modification date later than the date of the last firmware update. You can delete only those that do not relate to Huawei/Honor (for example, HwSystemManager.apk - system, and FlashPlayer.apk - virus).

2. Folder /data/app. Contains user applications. Remove folders with names that match suspicious apps from the list of installed applications.

3. Hidden foldersEnable the display of hidden files in the file manager settings and check:

• 📁 /.cexec or /.estrongs - often used to store payloads of viruses.
• 📁 /sdcard/.thumbnails - sometimes contains executable files.
• 📁 /data/local/tmp - temporary files that can be malicious.

Folder	What to look for	Is it possible to delete
/system/priv-app	Files with non-standard names (for example, UpdateProvider.apk)	Only if it is definitely not a system file
/data/data	Folders with the names of applications you deleted	Yes, if the application has already been uninstalled
/cache	Files with the extension .dex or .so	Yes, but do not delete the entire folder
/sdcard/Download	APK files that you did not download	Yes

⚠️ Attention: Deleting files from /system without root access can lead to brik (breaking) the phone. If you are not sure, skip this step and reset. settings.

Removing a virus via ADB (for experienced users)

If the virus has blocked access to the settings, but the phone still responds to commands, you can use Android Debug Bridge (ADB). This method requires a computer and a USB cable.

1. Installing ADB: Download Platform Tools from the official Android website and extract to a folder C:\platform-tools.

2. Connecting the phone: Activate developer mode (click on the build number 7 times in Settings → About phone), then enable debugging via USB in Settings → System → Developer Options.

3. Commands for cleaning: Open the command line in the folder with ADB and enter:

adb devices

(the serial number of your phone should appear). Then:

adb shell pm list packages -f

This command will show all installed packages. Look for suspicious names (for example, com.android.fakeupdate) and remove them:

adb shell pm uninstall -k --user 0 package name

4. Clear cache: After removing the virus, do:

adb shell pm clear com.android.providers.media
adb shell pm clear com.google.android.gms

What to do if ADB does not see the device?

1. Check if USB debugging is enabled on your phone.

2. Install drivers for your Honor model (you can download it from the Huawei/Honor website).

3. Try another USB cable (preferably the original one).

4. Restart your phone and computer.

5. If you are using Windows, run the command line as an administrator.

Emergency measures: if a virus has blocked your phone

When a virus completely blocks access to the system (a screen asking for payment, endless reboots or the inability to open settings), there are two options left:

1. Hard Reset. Will delete all data, but return the phone to factory settings. For Honor:

• 🔄 Turn off the phone.
• 🔘 Press power button + volume up for 10 seconds until the logo appears.
• 📱 In the recovery menu, select Wipe data/factory reset (volume button control, confirmation - power button).
• 🔄 After the reset, select Reboot system now.

2. Flashing via eRecovery. If the reset does not help, restore the firmware through the built-in menu:

• 🔄 Turn off the phone.
• 🔘 Press power button + volume up, then select Download latest version and recovery.
• 📶 Connect to Wi-Fi (keep your finger on the network name to enter the password).
• ⏳ Wait for the firmware to download and install (takes 10-30 minutes).

⚠️ Attention: After During a hard reset, the phone may require you to enter the account Googlethat was linked before cleaning. If you don’t remember the data, use restoring access or contact support Honor with proof of purchase.

How to protect Honor from viruses in the future

Even after successful cleaning, the phone will remain vulnerable if protection measures are not taken. Follow these rules:

1. Application sources. Install apps Only from Google Play. If you need to download an APK (for example, for a beta version), check the file through VirusTotal.

2. App permissions. Don't give apps access to SMS, contacts or special features unnecessarily. Check permissions in Settings → Applications → [app name] → Permissions.

3. System updates. Honor regularly releases security patches. Check for updates in Settings → System → Software update.

4. Safe browser. Use Google Chrome or Firefox with phishing protection enabled (Settings → Security). Avoid sites with suspicious URLs (for example, go0gle-play-store.ru instead of play.google.com).

5. Backups. Set up automatic copying of photos and contacts to Google Photos i Google Contacts. This will help quickly restore data after a reset.

FAQ: Frequently asked questions about removing viruses from Honor

Is it possible to remove a virus without resetting settings?

Yes, if the virus has not received administrator rights. Try the methods from the sections "Cleaning system folders" and "Removal via ADB". If the virus blocks access to the settings, a reset is inevitable.

How to find out that the virus has been completely removed?

Check:

• 📱 Absence of suspicious processes in Settings → Applications.
• 📊 Normal battery and traffic consumption (monitor 1-2 days).
• 🔍 No advertising in unexpected places.

For reliability, scan your phone through Cheetah Mobile (free version).

The virus requires payment for unlocking. What should I do?

This is ransomware. Do not pay under any circumstances - after payment, the phone will still remain infected. Perform or reflash the device. (for example, hard reset or reflash the device. If there was important data on the phone, contact a data recovery laboratory (for example, Hetman Recovery).

After removing the virus, the sound/Internet/camera disappeared. How to restore?

Most likely, you deleted a system file. Try:

1. Restore the firmware via eRecovery (section "Emergency measures").
2. Reset settings to factory settings (don't forget to make a backup copy).
3. If the problem persists, contact to the service center Honor.

Is it possible to get a virus through SMS or a call?

Technically yes, but it is extremely unlikely on modern versions of Android. Viruses spread through SMS only if:

• You follow the link from the message and download the file.
• You have installed a vulnerable application for working with SMS (for example, old versions). GO SMS Pro).

Calls are safe - viruses are not transmitted over the voice channel. But scammers can call under the guise of support and ask to install a “security update” (this will be a virus).