Removing viruses from Android system files: a step-by-step strategy

Infection with malware, which is deeply integrated into the Android system partition, is one of the most difficult problems faced by users of modern smartphones. Unlike ordinary applications, which can simply be removed through the settings, system viruses are disguised as critical components of the operating system or are embedded directly into the partition /system. This makes them invisible to standard antivirus apps and blocks the ability to uninstall them using conventional methods.

Symptoms of such an infection can range from intrusive advertising that pops up on top of all windows, to theft of confidential data and complete blocking of the device. The user often notices abnormal behavior of the gadget: rapid battery drain, heating of the case during idle mode, or the appearance of unknown icons that cannot be removed. Understanding the nature of the threat is the first step to regaining control of your smartphone.

In this article, we will look at advanced methods of combating threats hidden in system files. We will not limit ourselves to simple advice like “install an antivirus,” since in the case of root Trojans and system miners this is often not enough. You will learn about working with superuser rights, using the ADB debug bridge and radical measures to restore the factory image of the system.

Diagnostics of hidden threats in the system partition

Before taking active removal steps, you need to accurately identify the malicious object. System viruses often use obfuscation techniques, changing their names to names similar to legitimate Android processes, such as com.android.systemui or google.services. However, careful analysis may reveal inconsistencies in digital certificate signatures or unusual resource consumption.

For initial diagnostics, it is recommended to use specialized utilities that can scan not only user applications, but also the system cache. Pay attention to apps that were recently installed, especially if you downloaded APK files from third-party sources. Such apps often request device administrator rights, which allows them to protect themselves from being uninstalled.

Check the list of applications with administrator rights in the security settings menu. If you find an unknown application or a app with a suspicious name there, revoke these rights immediately. Without this step, any attempt to delete will be blocked by the system. It is also worth paying attention to the battery usage statistics: a sharp jump in energy consumption by an unknown process is a sure sign of malicious code activity.

⚠️ Attention: Some advanced Trojans can replace system icons and names, masquerading as “System Update” or “Google Play Services”. Always check the application developer in detail.

Use the following signs to identify a threat:

• 🔍 The appearance of advertising banners on the desktop or in the lock screen menu.
• 🔋 Abnormally fast battery drain even with minimal user activity.
• 📉 A sharp drop in performance and frequent interface freezes.
• 🌐 An inexplicable increase in traffic in the background without using heavy applications.

Cleaning through Android safe mode

Safe Mode is a diagnostic profile of the operating system, in which only basic components and pre-installed applications are loaded. All third-party apps, including potential viruses, are deactivated in this mode. This is an ideal way to confirm the presence of an infection and be able to remove malware if it has not embedded itself in the firmware image itself, but has simply acquired system rights.

To enter safe mode, you usually just need to hold down the power button on the screen, and then (hold) the “Power” or “Reboot” button until the corresponding request appears. On different smartphone models, such as Samsung, Xiaomi or Pixel, the key combination may differ slightly, so you should check the documentation of the specific manufacturer. After the reboot, you will see “Safe Mode” in the corner of the screen.

While in this mode, go to application settings and try to remove suspicious apps. If the “Delete” button has become active for an application that was previously blocked, it means that the virus does not have deep system integration. After removing all suspicious items, simply reboot your device as normal. If the problem disappears, then the threat has been neutralized.

It is important to understand the limitations of this method. If malicious code has already modified files in the partition /system/app or /system/priv-app, then it will still be active in safe mode, since the system considers it part of the kernel. In this case, moving to more complex methods such as using ADB or flashing it becomes inevitable.

Using ADB to remove system applications

Android Debug Bridge (ADB) is a powerful command line tool that allows you to interact with your device at a deep level without the need for root access. With its help, you can forcefully remove or disable system packages that cannot be removed through the GUI. This method requires connecting your smartphone to your computer via a USB cable and pre-configuring debugging.

First, activate developer mode on your device. To do this, go to Settings → About phone and quickly click 7 times on the “Build number” item. After this, a new section “For Developers” will appear in the settings menu, where you need to activate the “USB Debugging” switch. Connect your phone to the PC and make sure that confirmation of trust in this computer appears on the smartphone screen.

Open the command line or terminal on the computer and enter the command to check the connection:

adb devices

If your device appears in the list with status device, you can start searching for malicious packages. Enter the command adb shell pm list packagesto list all installed packages. Carefully examine the output, looking for suspicious names or packages that you did not install.

To remove a specific package, use the command:

adb shell pm uninstall -k --user 0 package name

Replace package name with the real name of the malicious application. The flag --user 0 indicates the removal of the application for the main user, which effectively hides it from the system, although the file may physically remain on the system partition until the next flashing. This is a safe way to combat system viruses that does not require unlocking the bootloader.

Obtaining root access and manually cleaning the system

If soft methods did not help, you may need to obtain superuser rights (Root). This gives you complete control over the file system, allowing you to directly edit or delete files from protected partitions. However, this process is complex, risky and often leads to loss of device warranty, so it should be resorted to only in extreme cases.

The procedure for obtaining Root access varies depending on the processor model and manufacturer. For devices based on MediaTek utilities like SP Flash Tool are often used, while for Qualcomm requires unlocking the bootloader and flashing a modified recovery, for example TWRP. After installing superuser rights, you will be able to use file managers with Root support, such as Root Explorer or Solid Explorer.

Go to directory /system/app or /system/priv-app. System applications are stored here. Find the folder or APK file corresponding to the virus and delete it. Be extremely careful: removing critical system components may result in your device becoming bricked, causing it to become unbootable. Always create a backup copy before making any changes.

Directory	Description of contents	Risk of deletion	Required access
/system/app	User and some system applications	Medium	Root
/system/priv-app	Critical system services	High	Root
/data/app	User installed applications	Low	Normal/ADB
/system/vendor	Drivers and software from the manufacturer	Critical	Root

⚠️ Attention: Recovery interfaces and methods for obtaining root access is constantly updated by manufacturers. What worked on Android 10 may not work on Android 14. Always check the latest guides for your specific model on the relevant forums before starting the procedure.

What to do if the phone does not boot after deleting the system file?

If after deleting the file the device freezes at the logo, you will need to enter Recovery mode and perform a factory reset (Wipe Data/Factory Reset). If this does not help, you will have to reflash the device through the computer using the original firmware image.

Radical measures: resetting and flashing the device

When the virus has penetrated too deeply and has modified the boot sectors or key system libraries, the only reliable way to clean it is a complete flashing. Resetting to factory settings (Factory Reset) through the recovery menu may not help if the malicious code is in the recovery image itself or in a section /systemthat is not cleared during a standard reset for some types of viruses.

The most effective solution is to download the official stock firmware for your smartphone model from the manufacturer's website. The use of custom or modified firmware in this situation is not recommended, since you cannot guarantee their purity. The firmware process will completely erase all memory sections, including infected areas, and return the device to its original state.

For devices Samsung the app is used Odin, for Xiaomi — Mi Flash Tool, and for Pixel and other devices with unlocked bootloader - utility Fastboot. Before starting the procedure, be sure to unlock the bootloader, if necessary, and put the phone in the appropriate mode (Download Mode or Fastboot). The process takes from 10 to 30 minutes and requires a stable connection to the computer.

Key stages of flashing:

• 💾 Downloading the full image of the official firmware for your exact model.
• 🔓 Unlocking the bootloader, which will entail deleting all data.
• 💻 Installing the necessary drivers and software for firmware on the PC.
• ⚡ Connecting the device in a special mode and starting the image recording process.

Preventing system re-infection

After successfully cleaning the device, it is critical to change your usage habits to prevent re-infection. The main attack vector is the installation of applications from unverified sources. In your security settings, disable the ability to install applications from unknown sources unless absolutely necessary, and never ignore browser or antivirus warnings.

Regularly update your operating system and installed applications. Android developers are constantly closing security vulnerabilities that are exploited by virus writers. An outdated version of a security patch is an open door for malware. It is also recommended to use reliable antivirus solutions from reputable vendors such as Kaspersky, ESET or Bitdefenderthat have real-time scanning capabilities.

Be careful with granting permissions. If a simple flashlight or calculator asks for access to contacts, microphone, or device administrator rights, this is a clear sign of fraud. Deny such requests and remove such applications immediately. Digital hygiene is the best shield against modern threats.

Is it possible to remove a virus without losing data?

In most cases, if the virus is located in the user partition, removal is possible without losing data. However, if malware has infiltrated system files, a full reset or flashing is often required to guarantee cleaning, which will inevitably lead to the deletion of all user data if a backup copy has not been made.

Will a regular antivirus help against a system virus?

Regular mobile antiviruses have limited access to the system partition without root access. They can detect the threat, but often cannot remove it if the virus has administrative rights or is hidden in a protected area of ​​the system. In such cases, manual methods via ADB or flashing are required.

Is it safe to obtain root access to remove a virus?

Obtaining root access in itself carries security risks, since it gives full access to the system not only to you, but also to potential attackers. You should only do this if you are confident in your actions and understand how to roll back changes. For the average user, a safer option is flashing the stock image.

What to do if a virus has locked the screen and demands a ransom?

This is a typical ransomware virus. Don't pay the ransom. Try booting into safe mode and uninstalling the blocker app. If this does not help, you will need to enter Recovery mode and reset the settings to factory settings. In extreme cases, only flashing through a computer will help.