Sudden locking of the smartphone screen with a requirement to transfer money for unlocking is a nightmare for any user. Ransomware virus On Android it can appear after installing a dubious application or following a malicious link. The screen is completely blocked, preventing access to the desktop or settings.
In this situation, the main thing is to remain cool and not panic. Fraudsters they rely specifically on the fear of losing data or access to the device. Often, the ransom demand is just a bluff, and after payment, access is not returned, and the virus remains in the system.
In this article we will analyze proven methods of dealing with blockers. You will learn how to remove malware through safe mode, how to use ADB commands and in which cases a complete data reset is necessary. Action algorithm Depends on the type of blocking, so we will consider all options.
Primary diagnosis and determination of the type of threat
Before taking radical measures, you need to understand what exactly you are faced with. Not all screen locks are viruses. Sometimes these are legitimate notifications from antiviruses or parental controls that the user has configured incorrectly.
Try pressing the Home button or the recent applications button. If the interface is responsive, but there is a banner on top, it means that the virus works like a regular application and steals the focus. If the screen only responds to clicks inside the banner, and the physical buttons do not work, this is a more serious form of blocking, often called Screen Locker.
⚠️ Attention: Never enter your bank card details on the lock screen. Even if the interface looks like the website of a bank or payment system, it is a phishing page created by attackers to steal funds.
Evaluate the behavior of the device. Is there sound when pressing buttons? Does vibration work? These signs will help you understand whether the system is completely frozen or whether the malicious code is simply blocking the image. Diagnostics at this stage is critical for choosing the correct removal method.
Removing a virus through safe mode
The most effective way to remove a virus without losing personal data is to boot in safe mode mode. In this mode Android it starts only with system applications, and all third-party software, including viruses, is disabled. This allows you to find and delete a malicious file through standard settings.
The login procedure may differ depending on the smartphone model. On most modern devices, you need to hold down the power button, and when the shutdown menu appears, press and hold the “Power off” or “Reboot” icon on the screen until a confirmation message appears to enter safe mode.
On older models or devices with a removable battery, you may need a physical action: turn off the phone, hold down the volume down button and, while holding it, turn on the device. Hold the button until the system boots completely.
☑️ Entering safe mode
After loading, you will see the inscription "Safe Mode" in the corner of the screen. Now go to Settings → Applications. Sort the list by installation date or review it carefully. Look for applications with suspicious names, without an icon, or with a name for system services that you did not install.
Click on the suspicious application and select the button Delete. If the button is inactive, first click Stop, then delete. After removing all suspicious objects, simply restart your phone as usual.
If you cannot find the virus in the list of applications, pay attention to applications with administrator rights. They often disguise themselves as system utilities and block their removal.
Revocation of device administrator rights
Many advanced ransomware viruses gain rights device administrator. This allows them to block the uninstall button in the application menu and prevent standard uninstallation. If the "Delete" button is grayed out in normal mode or safe mode, this is the problem.
To bypass this protection, you must revoke the administrator rights of the malicious application. Go to security settings. The path may look like Settings → Security → Device Administrators or Settings → Biometrics and Security → Other Security Settings → Device Administrator Applications.
| Threat Type | Symptoms | Removal method | Risk of data loss |
|---|---|---|---|
| Advertising banner | Pop-up windows, advertising | Removing the application | No |
| Screen locker | Full interface lock | Safe Mode / Reset | Low / High |
| Encryptor | Files are unavailable, ransom demand | Reset settings (data lost) | High |
| SMS ransomware | Sending paid SMS in the background | Revocation of rights / Delete | No |
In the list of administrators you will see checkboxes next to active applications. Uncheck the suspicious application. The system may try to intimidate you with a warning, but agree to revoke your rights. After that, return to the application menu and remove the virus as usual.
Sometimes the virus disguises itself as an empty field in the application list. If you see a line without a name and without an icon that has administrator rights, this is almost certainly malicious code. Deleting such an "empty" application often solves the screen lock problem instantly.
Using ADB to force uninstall
If the virus blocks entry even to safe mode or prevents you from opening settings, you will need to use a computer and utilities ADB (Android Debug Bridge). This method allows you to control your phone through the PC command line, bypassing the screen lock.
For the method to work, USB debugging must have been previously enabled on your phone. If this option has been disabled, the method will not work and you will have to proceed to reset the settings. Connect the phone to the computer via a USB cable.
adb shell pm list packages
adb shell pm uninstall --user 0 virus package name
The first command displays a list of all installed packages. You need to find the package name of the malicious application (this is usually different from the name that is visible on the lock screen). The second command removes the application for the current user, which deactivates the virus.
This method requires minimal technical knowledge, but is very powerful. You can delete an application that cannot be deleted in any other way through the smartphone interface. The main thing is to correctly identify the package name.
How to find the name of the virus package?
If you cannot go into your phone settings to see the package name, try installing on your phone any legitimate application from the Play Market that shows a list of installed apps (for example, App Inspector). Run it through safe mode, find the virus and copy its full package name.
Reset the settings to factory settings (Hard Reset)
When none of the software methods help, the last resort is a complete data reset. This method is guaranteed to remove any virus, as it erases the entire user memory section and returns the phone to its out-of-the-box state.
It is important to understand that all your photos, contacts, messages and installed applications will be deleted. Data on a memory card (SD card) is usually saved, but the virus itself may be there, so it is better to check the card separately on your computer.
⚠️ Attention: Make sure you remember the password for your Google account. After resetting the settings, the phone will ask for authorization of the last used account (FRP protection). Without it, the device will remain locked forever.
To perform a reset, you must enter Recovery mode. Turn off your phone completely. Then press the key combination: usually it is Volume Up + Power or Volume Down + Power. The combination depends on the manufacturer (Samsung, Xiaomi, Pixel etc.).
In the Recovery menu, movement is carried out using the volume buttons, and selection is made using the power button. Find the item Wipe data/factory reset. Confirm the action. After the process is completed, select Reboot system now.
Hard Reset is a “nuclear weapon” against viruses. It removes everything, including malicious code, but requires a backup copy of important data.
Prevention and protection against future attacks
After successfully removing a virus, it is important to analyze how it got into the system to avoid a recurrence. Most often, the reason is the installation of applications from third-party sources (APK files from forums, torrents or dubious sites).
Enable protection against the installation of unknown applications in the settings. In modern versions Android this function is called "Play Protect" and works automatically, scanning applications even from the official store.
- 🛡️ Install a reliable antivirus from a well-known vendor (Kaspersky, ESET, Dr.Web) to periodically scan the system.
- 🚫 Never grant administrator rights to applications that do not need them (flashlights, simple games, wallpapers).
- 🔄 Regularly update the operating system and security patches that cover vulnerabilities.
Be careful with links in SMS and instant messengers. Phishing sites may automatically offer to download a “player update” or “codec”, which is actually a Trojan. Vigilance The user is the main element of security.
Frequently asked questions (FAQ)
Can I delete virus without resetting your phone?
Yes, in 80% of cases, entering safe mode and manually removing the malicious application helps. Resetting the settings is only required in complex cases when the virus has penetrated deeply into the system or has encrypted files.
What to do if, after removing the virus, the phone continues to slow down?
Perhaps the virus left behind junk files or damaged system settings. Try clearing the application cache through settings or resetting application settings (not data) in the recovery menu.
Does the antivirus help remove the blocker if the screen is already locked?
No, the antivirus will not be able to start and scan the system if the interface is locked. First you need to unlock access to the system through safe mode or Hard Reset, and only then carry out treatment.
Will they return my money if I paid the ransom?
It is extremely unlikely. Attackers do not value their reputation and, after receiving money, simply disappear or demand even more. Paying a ransom only finances criminal activity and does not guarantee the return of access.