Modern mobile devices, despite built-in protection mechanisms Google Play Protect, often become targets for malware. Particularly dangerous are Trojans and miners that disguise themselves as system processes or gain administrator rights, blocking the ability to remove them in normal operation. In such situations, the user needs to know how to run the antivirus in Android safe mode in order to isolate the threat and clean the device.
Safe Mode (Safe Mode) is a diagnostic environment of the operating system in which only basic components and pre-installed applications are loaded. All third-party apps, including potentially dangerous ones, are temporarily disabled. This allows you to conduct a deep scan without the risk that the virus will block the scanner or generate a false error message.
The procedure for entering this mode may vary depending on the manufacturer of your smartphone: Samsung, Xiaomi, Huawei or clean Android. Below we will analyze in detail the algorithms of actions for different interfaces, methods for forcing a scan, and steps for finally removing threats that cannot be eliminated using standard methods.
Why do you need a safe mode when treating a smartphone
The main purpose of use safe mode is to prevent autoloading of malicious scripts. Many modern viruses use the “survivability” technique: as soon as you try to delete their file or stop the process, the malicious app instantly restarts itself or blocks access to application settings.
In a normal environment, an antivirus may encounter resistance: the virus will try to close the protection application, disable the Internet, or replace security certificates. In Safe Mode mode, third-party code simply does not receive the right to execute, which makes it vulnerable to removal.
⚠️ Attention: If your smartphone is already locked with a ransom banner or does not respond to touches, entering safe mode may not be possible through the menu. In such cases, you will need to use hardware buttons or connect to a PC via ADB.
In addition, this mode is useful for diagnostics. If in safe mode the phone works stably, does not overheat and the battery discharges normally, then the problem is guaranteed to lie in one of the applications you installed. This narrows the search to a minimum.
Some advanced users use this mode to manually delete files through file managers with root access, but for most cases, the capabilities of standard or third-party antivirus software are sufficient antivirus software.
Ways to enter safe mode on different devices
The algorithm for activating the diagnostic mode depends on the version of the operating system and the manufacturer’s shell. There are two main methods: software (via the shutdown menu) and hardware (using physical buttons).
For most modern smartphones based on Android 6.0 and higher, a universal method is suitable. You must press and hold the power button on the screen until the reboot menu appears. Then you need to press and hold your finger on the “Turn off” or “Reboot” item.
After this, a pop-up window will appear on the screen asking you to switch to safe mode. Confirm the action and the device will reboot. In the lower left corner of the screen you will see the corresponding inscription Safe Mode.
- 📱 Universal method: Long press on the "Power off" icon in the power menu.
- 🔘 Hardware method: Hold down the volume down button while turning on the device (until the logo).
- ⚙️ For Samsung: After the logo appears, release the power button, but continue to hold the Volume Down button.
- 🔄 For Xiaomi/Redmi: Often you need to hold both volume buttons after vibration when turned on.
If standard methods do not work, your device’s firmware may have a modified bootloader. In this case, you should refer to the documentation of a specific model or try a combination of buttons Volume Down + Power immediately after turning off the phone.
Selecting and launching an antivirus scanner
After successful loading into Safe Mode you must immediately run a system scan. You can use either the built-in scanner or pre-installed third-party solutions. It is important that the antivirus signature database is updated to the latest version before entering this mode.
It is recommended to use proven solutions such as Kaspersky Internet Security, Dr.Web Light, ESET Mobile Security or Malwarebytes. These applications have heuristic analysis that can identify unknown threats by behavior, not just by behavior.
Launch the application and select the "Full Scan" or "Deep Scan" option. A superficial scan may miss files hidden in system directories or browser cache. The process may take from 10 to 30 minutes depending on the amount of memory.
Before starting a scan in Safe Mode, make sure your phone is connected to a charger. A deep scan of the processor and memory significantly increases energy consumption.
During the scanning process, the antivirus will sequentially check installed applications, system files, memory card (SD card) and RAM. If a threat is detected, the app will offer options for action: treatment, quarantine or removal.
In safe mode, removal is most effective, since the malicious process is not active and cannot resist. However, if a virus has entered the system partition (which is rare for ordinary users), you may need to obtain root access for complete cleanup.
Manual removal of uninstallable applications
Sometimes an antivirus can only point to the problematic application, but not remove it automatically. This often happens with apps that have received rights device administrator. In safe mode, these rights are usually temporarily removed or become inactive, which allows you to uninstall the application through the settings
Go to the Settings → Applications → All applicationssection. Find the suspicious app. Often, malware is disguised as system utilities with names like “System Update”, “Wi-Fi Service” or has a blank icon. Pay attention to the installation date and size of the application.
If the "Uninstall" button is active, just click it. If it is inactive (gray), you need to check the access rights. Go to Settings → Security → Device administrators (the path may differ depending on the model, for example, Device protection).
| Virus sign | Act in safe mode | Risk in normal mode |
|---|---|---|
| No icon | Delete through the app menu | High (hidden mining) |
| Request administrator rights | Revoke rights and delete | Block deletion |
| Pop-up advertising | Calculate by appearance time | Redirect to phishing |
| High consumption traffic | Check usage statistics | Identity theft |
After revoking administrator rights, return to the applications menu and uninstall. If the application tries to gain rights again or is restored after deletion, it may have a hidden companion component that needs to be found and disabled separately.
☑️ Manual removal algorithm
Clearing the cache and resetting the browser settings
Not all threats are full-fledged applications. Many of them are introduced through the browser in the form of malicious scripts, push notifications or changed home page settings, traces of the virus may remain in the browser. cache.
You need to clear the data of all installed browsers: Chrome, Firefox, Opera and the manufacturer's standard browser. Go to Settings → Applications, select the browser and click "Storage" (or "Memory").
Press the button Clear cache and, more importantly, Clear data. This action will reset all browser settings to factory settings, delete saved passwords and history, but is guaranteed to remove malicious scripts.
⚠️ Attention: Clearing browser data will delete all saved logins and passwords. Make sure you remember data from important accounts or they are synced with the cloud before performing this procedure.
Also check the list of installed extensions in your browser. Viruses are often disguised as harmless plugins to block ads or change the theme. Remove any extensions that you have not personally installed or that are suspicious.
Exiting Safe Mode and Final Scan
After the scan is completed, malicious files are deleted, and browser settings are reset, you need to reboot the device into normal mode. Exiting Safe Mode is usually done by simply restarting the smartphone.
Press and hold the power button, select "Restart" or "Power off", and then turn on the phone as usual. The "Safe Mode" text in the corner of the screen should disappear. If the phone boots into safe mode again, check whether the volume button is pressed, or try removing the battery (if the design allows) for a few seconds.
After loading in normal mode, perform a control scan with an antivirus. Make sure the system is stable, no ads are appearing, and battery consumption is back to normal. It is also recommended to check the list of applications for new, strange apps that may have installed automatically.
What to do if the phone gets infected again?
If the virus returns after a complete clean and reset, the problem may be in the backup. When restoring data from the cloud, you may accidentally return an infected file. Try to restore only contacts and photos, and reinstall the applications manually.
As a preventive measure, activate the function Google Play Protect in the application store settings. It provides constant monitoring of installed apps and can block the installation of dangerous software in the future.
The full treatment cycle includes not only removing the virus, but also resetting the browser settings, since malicious code is often hidden in the cache of web pages.
Frequently asked questions (FAQ)
Can I log into safe mode if the screen is blocked by a banner virus?
Yes, this is possible. Because Banner is an application, it does not load in Safe Mode. Use a combination of hardware buttons (usually Volume Down + Power) to turn on the phone. As soon as you see the manufacturer's logo, hold the volume button until it boots completely. The banner will not appear, and you can remove the malicious application through the settings.
Will safe mode delete my personal photos and contacts?
No, entering safe mode and working in it does not in any way affect your personal data (photos, videos, contacts, messages). This mode only temporarily disables third-party applications. However, if you decide to do a full Factory Reset, then all data will be deleted.
Why is the "Delete" button inactive for some applications?
This means that the application has device administrator rights or is a system component of the firmware. In Safe Mode, administrator rights can often be revoked through the security menu. If the application is system-based and cannot be removed using standard methods, a more complex procedure may be required through ADB or flashing.
How can you tell if the phone is definitely cleared of the virus?
Signs of successful cleaning are: the absence of intrusive advertising, normal speed of the interface, no overheating in idle mode and stable battery consumption. To be sure, rescan with two different anti-virus utilities after exiting safe mode.