How to completely remove viruses from Android: 7 proven methods

Viruses on Android smartphones have become a real epidemic: according to Kaspersky, in 2026, every third user encountered malware at least once. From annoying ads to spyware that steals bank card details, the consequences of an infection can be catastrophic. But there is good news: 92% of viruses can be removed yourselfwithout the help of service centers.

In this article you will find not just general advice, but specific instructions taking into account the features of modern versions of Android (from Android 12 to Android 15). We will look at both standard methods (using safe mode and antiviruses) and advanced techniques (like ADB commands to remove system viruses). We will pay special attention hidden threats that disguise themselves as system processes and are not detected by conventional scanners.

Signs of infection: how to understand that there is a virus on your phone

The first step is correct diagnosis. Many users confuse viruses with regular system crashes or memory overload. Here exact symptomsthat indicate malware:

• 📱 Spontaneous installation of applications - icons of apps that you did not download appear on the screen (often with names like "System Update" or "Flash Player").
• 💸 SMS to paid numbers —the message history contains SMS sent to short numbers (for example, 1234, 5678) with text like "YES" or "SUB".
• 🔋 Instant battery drain —the phone is discharged in 2-3 hours even in standby mode, while in Settings → Battery visible unknown processes consuming 30%+ of the charge.
• 🌐 Redirection to browser — when you open any site, you are automatically redirected to pages with advertising or “you have won a prize.”
• 📊 Suspicious activity of mobile traffic —in Settings → Data transfer it is clear that unknown applications “eat up” 1-2 GB per day.

If you observe although If only 2-3 signs from the list - the probability of infection is 85-90%. But there are also false positives: for example, rapid battery drain can be caused by a worn-out battery, and browser redirects can be caused by an installed VPN. To eliminate the error, check your phone using instructions in the next section.

⚠️ Attention: Some viruses (for example, Triada or GriftHorse) specifically mask their activity. They can turn off data usage notifications or hide themselves from the list of installed applications. If the phone starts to slow down for no apparent reason, this is already a reason to check.

Diagnostics: how to find a virus on Android

Before removing viruses, you need to accurately determine their location. Modern malware can hide in:

• 📁 Regular applications (most often in pirated games or hacked versions of paid apps).
• 🔧 System files (viruses like Agent Smith replace legitimate APK files with infected).
• 📱 Recovered data (if you transferred files from an old infected phone).
• 🌐 Cache browser (scripts can be executed even after the site is closed).

To search, use a combination of 3 methods:

Method 1: Checking through Android Settings

Open Settings → Applications → All applications and sort the list by installation date. Pay attention to:

• 🔍 apps with names in Chinese or a random set of letters (for example, com.system.update.v7).
• 🔍 Applications without an icon or with a standard Android icon.
• 🔍 apps that cannot be removed (the "Delete" button is inactive).

Method 2: Analyzing access rights

Viruses often ask for suspicious permissions. Check in Settings → Applications → Permissions:

• 📱 Access to SMS - if it is asks for a game or flashlight, this is 100% a virus.
• 📱 Device Administrator - legitimate apps rarely require such rights.
• 📱 Reading call log - often used by spyware.

Method 3: Checking via ADB (for experienced)

If the virus is hidden from standard methods, connect the phone to the PC and run the command:

adb shell pm list packages -f | findstr "suspicious_keyword"

Replace suspicious_keyword with part of the name of the suspicious package (for example, flash, update, system). This will help you find masquerading viruses.

Type of virus	Where it hides	How to detect
Advertising software	In ordinary applications	Constant advertising, even when all apps are closed
Banking Trojan	In system files or administrator rights	SMS to paid numbers, requesting rights to access messages
Spyware	In the background as a system process	High traffic consumption, overheating of the phone when idle
Rootkit	In the system kernel	It is impossible to remove using standard methods, a flashing is required

Method 1: Removing viruses through a secure mode

Safe Mode (Safe Mode) is an Android diagnostic mode in which all third-party applications are disabled. 70% of viruses cannot work in this mode, which makes them easy to remove.

How to start safe mode:

1. Press and hold the button Shutdown on the lock screen.
2. In the menu that appears, press and hold the option Turn off (or Reboot on some models Samsung/Xiaomi).
3. Confirm entering safe mode ("Safe Mode" will appear at the bottom of the screen).

Now:

• 📱 Go to Settings → Applications.
• 📱 Look for suspicious apps (they will be marked as "Disabled").
• 📱 Click Delete (if the button is inactive, first click Disable, then delete).

If the virus is not removed:

• 🔧 Try first clear cache and data applications.
• 🔧 If the error "Deleting is impossible" appears, the virus has acquired administrator rights (see section about administrator rights).

⚠️ Attention: Some system functions do not work in safe mode (for example, fingerprint or Face ID). Don't be alarmed - this is normal. The main thing is not to restart the phone until you remove all viruses.

Launch safe mode|Check the list of applications|Delete suspicious apps|Clear browser cache|Reboot the phone-->

Method 2: Using antiviruses (which work in 2026)

Antiviruses for Android are often criticized for their low efficiency, but modern solutions (2026-2026) have learned to detect even polymorphic virusesthat change their code. The main thing is to choose the right tool.

Top 5 antiviruses for Android in 2026 (according to AV-Test):

• 🛡️ Bitdefender Mobile Security the best for detecting banking Trojans (99.8% efficiency).
• 🛡️ Kaspersky Internet Security —strong against spyware and rootkits.
• 🛡️ Norton 360 —includes VPN and phishing protection.
• 🛡️ Malwarebytes —specializes in advertizing viruses.
• 🛡️ ESET Mobile Security —minimal impact on performance.

How to scan correctly:

1. Install an antivirus from the official store (Google Play or Galaxy Store for Samsung).
2. Run full scan (not fast!). It will take 15-30 minutes.
3. If threats are found, click Delete everything (do not ignore "low-risk" viruses - they can be scouts for more dangerous software).
4. After removal reboot phone —some viruses are restored before rebooting.

Important: do not install several antiviruses at the same time —they can conflict and reduce protection. Also avoid antiviruses from unknown developers (especially if they ask for administrator rights).

Why do free antiviruses sometimes fail? viruses?

Free versions of antiviruses often have a truncated signature database (list of known viruses). For example, they may not detect new viruses that appeared less than a month ago. Also, some “free” antiviruses themselves contain advertising modules that are difficult to distinguish from viruses. The best option is a paid version with a trial period (7-14 days). data-i="185">Method 3: Removing viruses with administrator rights

Method 3: Removing Viruses with Administrator Rights

Some viruses (for example, FakeApp or OpFake) receive device administrator rights, which blocks their removal using standard methods. In this case, you must first revoke rightsand then remove them. app.

Instructions:

1. Go to Settings → Security → Administrators devices (on some phones the path may be different: Settings → Biometrics and security → Other security settings → Phone administrators).
2. Find a suspicious application in the list (often with a name like "Device Admin", "System Service" or in Chinese).
3. Uncheck the box next to it and confirm the action.
4. Return to Settings → Applications, find the same application and delete it.

If a virus blocks access to administrator settings:

• 🔧 Try deleting via safe mode (described above).
• 🔧 Use ADB command:

adb shell dpm remove-admin com.virus.package.name

Replace com.virus.package.name with the real name of the package (you can find out through adb shell pm list packages).

⚠️ Attention: Some viruses (for example, NotCompatible) can restore administrator rights after a reboot. In this case, you will have to use the method with ADB or factory reset settings.

Method 4: Removing viruses via ADB (for advanced)

ADB (Android Debug Bridge) a debugging tool that allows you to control your phone via the PC command line. With its help you can remove even those viruses that disguise themselves as system processes.

What you will need:

• 💻 A computer with Windows/macOS/Linux.
• 🔌 USB cable (preferably original).
• 📱 Enabled USB debugging on the phone (Settings → About phone → Build number - press 7 times, then return to Settings → System → For developers → USB debugging).
• 🛠️ Installed ADB drivers.

Step-by-step guide:

1. Connect your phone to the PC and open the command line (or Terminal on Mac/Linux).
2. Check the connection with the command:

adb devices

The name of your device should appear.

3. Get a list of all packages:

adb shell pm list packages

Search suspicious names (for example, containing flash, update, system, service).

4. Remove the virus with the command:

adb shell pm uninstall -k --user 0 com.virus.package.name

If an error appears DELETE_FAILED_DEVICE_POLICY_MANAGER the virus has administrator rights (see previous section).

To remove system viruses (if they are not removed standard command), use:

adb shell
su
mount -o rw,remount /system
rm /system/app/VirusApp.apk
rm /system/priv-app/VirusApp.apk
exit
exit

⚠️ Attention: Deleting system files can lead to unstable operation of the phone. Do this only if you are sure that the file is a virus. Re-flashing may be necessary to restore it.

Method 5: Reset to factory settings (last chance)

If no methods help, it remains hard reset (hard reset) all data from the phone, including viruses, but the following will also be erased:

• 📱 All installed applications and their data.
• 📱 Photos, videos and music (if not saved to an SD card or to the cloud).
• 📱 Wi-Fi settings, accounts and passwords.
• 📱 Call and SMS logs (if not synchronized with Google).

How to reset:

1. Create a backup copy of important data (via Google Drive or on a PC).
2. Go to Settings → System → Reset settings → Delete all data.
3. Confirm the action (you may need to enter a PIN code or pattern).
4. Wait for completion (takes 5-15 minutes).

After the reset:

• 🔧 Do not restore data from an old backup —the virus may return.
• 🔧 Install an antivirus before data recovery and scan the files before transferring.
• 🔧 Update Android to the latest version via Settings → System → Software Update.

On some phones (for example, Xiaomi or Samsung) there is an option "Reset network settings" —it can be used separately if the problem is only in redirecting traffic.

⚠️ Attention: On phones with an unlocked bootloader (bootloader) virus can survive the reset if it has penetrated into the partition /system or /recovery. In this case, a complete flashing will be required via Fastboot or Odin (for Samsung).

Method 6: Flashing the phone (for system viruses)

Flashing is a last resort measure that is used if the virus:

• 🔧 Infiltrated into system files (/system/app, /system/priv-app).
• 🔧 Survives a factory reset.
• 🔧 Blocks access to ADB or safe mode.

For firmware you will need:

• 💻 A computer with drivers installed (Samsung Kies, Mi Flash Tool for Xiaomi etc.).
• 📱 Official firmware for your model (download only from official sites: samobile.com for Samsung, miui.com for Xiaomi).
• 🔌 USB cable (preferably original).
• 🔋 Battery charge is at least 50%.

General instructions (details depend on the model):

1. Extract the firmware to a folder on your PC.
2. Start the phone in firmware mode:
   • For Samsung: Volume up + Volume down + Power → Volume Up to continue.
   • For Xiaomi: Volume down + Power.
   • For Google Pixel: Volume down + Power → select Recovery Mode.

Connect the phone to the PC and run the firmware app (Odin, Mi Flash Tool, Fastboot).

Select the firmware file and start the process (usually button Start or Flash).

Wait for completion (do not disconnect the cable!). The phone will reboot automatically.

After flashing:

• 🔧 Do not restore data from backups made after infection.
• 🔧 Install an antivirus and scan all files before transferring.
• 🔧 Update all applications via Google Play.

⚠️ Attention: Unprofessional firmware can lead to “brick” (breakage) of the phone. If you are not confident in your abilities, contact the service center. that the firmware will reset the counter Knox to Samsung, which may void the warranty.

How to protect your phone from viruses in the future

Removing the virus is half the battle. — prevent re-infection. Here are proven methods of protection:

1. Sources of application installations

• 📱 Install apps only from Google Play (the risk of viruses there is 10 times lower than in third-party stores).
• 📱 Disable installation from unknown sources: Settings → Security → Unknown sources (disable for all applications).
• 📱 Before installing, check:
  • 🔍 Application rating (must be ≥4.0).
  • 🔍 Number of downloads (suspicious if a “popular” game has only 100 downloads).
  • 🔍 Reviews (look for complaints about advertising or viruses).

2. System updates

Manufacturers regularly release security patches that close vulnerabilities. Check for updates monthly: Settings → System → Software updates data-i="337">monthly security patches

• 📱 Settings → System → Software Update.
• 📱 For Google Pixel and some other models are available monthly security patches - Be sure to install them.

3. Browser security

• 🌐 Do not download files from suspicious sites (especially APK files).
• 🌐 Use a browser with anti-phishing protection (Google Chrome, Mozilla Firefox with extension uBlock Origin).
• 🌐 Do not enter bank card details on websites without HTTPS (check the 🔒 icon in the address bar).

4. Additional measures

• 🔒 Install password manager (Bitwarden, 1Password) - this will protect against data theft through keyloggers.
• 🔒 Use VPN in public Wi-Fi networks (for example, ProtonVPN or Windscribe).
• 🔒 Regularly check application rights: Settings → Applications → Permissions.

Remember: 90% of infections occur due to the installation of pirated content (hacked games, movies, apps). If you want to save money, use legal alternatives (for example, Google Play Pass or Netflix with a family tariff).

Frequently asked questions (FAQ)

Is it possible to remove a virus without antivirus?

Yes, in most cases, viruses can be removed manually through safe mode is also suitable. data-i="364">application settings or application settingsAn antivirus is needed to detect hidden threats or if a virus blocks access to settings. For experienced users, the method with ADB.

The virus returns after removal. What should I do?

This means that the virus:

• 🔧 Has administrator rights (see section about administrator rights).
• 🔧 Infiltrated into system files (required flashing).
• 🔧 Restored from a backup (do not restore data after a reset!).
• 🔧 Downloaded automatically from the Internet (check the list of downloads in browser).

If all else fails, do full reset and install an antivirus before data recovery.

How to remove a virus if the phone is locked?

If a virus locks the screen (for example, requires payment for unlocking):

1. Try going into safe mode (hold the power button + volume up while booting).
2. If that doesn’t help, connect the phone to the PC and remove the virus via ADB (see the corresponding section).
3. For phones Samsung you can use Find My Mobile (service from Samsung) to unlock the device remotely.
4. As a last resort - do reset via Recovery (hold down the combination of buttons when turning on, usually Volume up + Power).

Do not pay extortionists - even after payment, blocking may occur to stay.

What viruses are the most dangerous for Android in 2026?

According to Kaspersky i ESET, in 2026 the greatest threat is posed by:

• 🔧 GriftHorse a Trojan that subscribes users to paid SMS services.
• 🔧 Agent Smith - replaces legitimate applications with infected versions.
• 🔧 Joker - steals SMS and bank card data.
• 🔧 FluBot - spreads via SMS and steals passwords.
• 🔧 BlackRock - spyware that steals data from 450+ applications.

A combination of viruses is especially dangerous when one