If your lg phone caught a virus, how to fix it. How to remove a virus from your phone - what to do if your phone is attacked by malware

How to remove viruses from Android via a computer if the phone does not perform certain actions after infection?

Android is a rapidly developing operating system for smartphones and tablet personal computers.

Due to its prevalence and flexible security requirements, OS users are often attacked by viruses. software. There are these main types of infections on the OS " Android»:

Trojans;
banner viruses;
malware embedded in installed programs;
ransomware viruses.

Removing a Trojan via a computer

Cleaning your phone from viruses via a computer does not require presence superuser rights, so in one removal process you can easily get rid of all malware. A Trojan for Android is an infection that infects a device through a browser.

By following the links, the user can download the file to hidden mode- this is a Trojan. The task of such sores is to remember all entered and saved user data (passwords, logins, email addresses, mobile numbers, bank cards and other data).

Removing a Trojan from a computer is very simple.

Connect your phone to your computer in storage mode;

Open your antivirus and select scan separate files and folders;
In the drop-down menu, select the connected folder smartphone or tablet;
Wait until the scan is completed and delete the folder with the program that is identified by the defender as malicious.

Removing embedded viruses

Even when disabled, the program consumes large number RAM devices;
Application malfunctions. Due to the built-in virus, the program may not perform some functions;
Mobile antivirus recognizes the utility as an infection.

Removal occurs in two ways: using the device itself or from a computer. To remove a virus using only your smartphone, download from official store reliable antivirus , scan the system with it and remove the infected program found.

If the mobile defender does not find any abnormalities in the operation of the program, you should use a computer.

Dr antivirus must be pre-installed on your PC. Web, Avast, NOD32 or Kaspersky– these defenders operate the largest updated database of viruses not only for PCs, but also for smartphones and tablets.

Install the program on your PC Android Commander– it allows you to manage everything installed programs devices.

Cleaning a smartphone from a banner virus

These types of infections can be caught while working with the browser. If you don't have an ad blocker installed on your phone, there is a high probability of clicking on one of the banners that invisible mode will download the virus to the device.

In the future, when working with the phone, advertising banners will pop up.

Removal occurs as follows:

Scan your device using a computer antivirus;
Remove any malicious content found;
Go to the folder with your smartphone data;
Using Android program Commander, delete all cache and download data from your browser app.

AND getting rid of ransomware viruses

Ransomware viruses block work smartphone. To unlock the device, they require the user to send a certain amount to an online wallet. Most of this malware can be removed without paying any fees. Follow the instructions:

Connect your phone to your computer;
Load Recovery mode on your smartphone or tablet. To do this, hold down the power and volume up button for 10 seconds;

In the menu that opens on your phone, find the wipe data/factory rest directory and open it;

Click OK and the phone will start to reboot;
Now on your computer, find the folder with the contents of the connected device, save everything necessary files on a PC (scan them for viruses) and format the contents of the smartphone’s removable drive;
Wait until your phone reboots. Its configuration will be returned to factory settings.

Have a nice time!

Many viruses on the phone are insidious because for the time being they do not manifest themselves in any way: until suddenly you discover that the funds on your mobile have disappeared somewhere. This is where doubts creep in, whether Android has caught some kind of virus...

In general, the most common signs of Android infection are:

pop-up banners, intrusive advertising (where it has never existed before);
loss of money from the phone balance;
frequent device freezes and reboots;
spontaneous installation and updating of applications;
inability to visit some sites, etc.

I should note that currently the number of viruses for Android devices is growing at some rate (apparently due to the fact that it is easier to “profit from” something from a phone than from a PC).

In general, in this article I want to look at several simple and effective options for removing viruses from Android devices (phone, tablet). I will also give the most common tricks and tricks of virus writers, and the main protective measures to counter them.

I hope the information will help you get your device back into working order and save money. Now, closer to the point...

If the menu opens and you can install applications

Using antivirus on Android

Perhaps this is the most obvious and quick way(will help against most viruses).

The algorithm of actions is approximately the following:

Unfortunately, some viruses cannot be removed in this way (they can actively block some functions of the security software and interfere with cleaning).

Addition!

Some viruses block access to Google Play Market. In this case, to download the antivirus, use its analogues:

Using Antivirus on your computer

Some Android phones can be connected to a computer like USB drive(note: if it is a USB drive, it means that it can be scanned for viruses, like an ordinary disk!).

Algorithm:

If some menus and settings do not open

A more problematic option. Often, some user data is lost. I recommend that before resetting your phone, try booting it into safe mode (very similar to safe mode Windows: will also boot only the most required applications, without which the norms cannot be implemented. telephone operation).

Removing via Safe Mode

A lot of virus software works fine in normal phone mode, but absolutely cannot in safe mode (for example, various banners, pop-up and flashing messages, browser add-ons, etc. “garbage”).

To enter safe mode:

Press and hold the power button until the service menu with a suggestion to turn off/restart the phone;
next item "shutdown" (not to be confused with physical button on the side of the phone) press and hold for 2-5 seconds;
A window should appear asking you to switch to safe mode - just click OK. See example below.

Note: to exit safe mode, simply restart your device.

In safe mode you can also go to Google Play Market, download an antivirus and check the phone with it (moreover, since the phone started with minimum set Software - then most likely, no pop-ups and banners will bother you!).

An example in the screenshot below. Please note that when you boot your phone in safe mode, you will see a notification about this at the bottom of the window (some applications will be unavailable (gray icons)).

Resetting the phone (Hard Reset)

This method should help even in the most difficult situations. Please note that after the reset, all your previous data and settings will be deleted (along with viruses), i.e. the phone will return to initial state(as it was new when purchased).

How to reset:

Addition!

Detailed instructions for resetting Android settings to factory presets (the article will help you delete all data from your phone and tablet (including viruses)) -

Prevention measures (how to avoid infecting your phone in the future)

In most cases, phone infection occurs due to the user’s carelessness or carelessness. Many people, visiting various entertainment sites (torrents, sites for making money, collections of games, etc.), do not pay attention to some messages, and easily “fall” for scammers. Below I will give a few typical examples.

Let's say you are looking for a file and want to download it (in general, an ordinary situation). You come across a forum where the first message contains a link to a file, and then 10-15 people. actively thank the author of the topic. In 99% of cases, this is a scam, after downloading and running the file: you will either send a paid SMS (you will get a subscription) or catch some kind of virus.

Also be very careful when installing games. During installation, Android, by the way, always shows what permissions are required for a particular application. Please note that the fake game (most likely it is infected with some kind of “good”) requires permission to send SMS (of course, after permission to install it, you will lose part of your mobile balance).

By the way, even if you yourself do not visit various “gray” sites, it may happen that scammers will send you an ill-fated SMS to your phone. Most often, this can be associated with the most popular sites: VK, OK, Avito, etc. (after all, many have a profile there, and it’s quite easy to interest an inexperienced person).

According to statistics, 2-5 people will click on the message below. out of 100!

Another extremely popular method of infection is various offers to check the device for viruses, or speed up its performance (some promise as much as 2-3 times!). Naturally, these are all fake messages.

If you want to check your device for viruses, go to the Play Market, download an antivirus from a reputable manufacturer, and check your phone with it (rather than agree to various “good” offers).

try to install applications only from (and preferably only well-known developers);
don't get it root rights (if the virus gets to them, it will be much more difficult to remove);
install one of these on your phone (and check the device regularly);
do not follow suspicious links, do not agree to various “anti-virus” checks on little-known sites, etc. (I discussed some of the “tricks” above);
install protection on your phone or other devices from “foreign” hands;
do not connect control bank account via SMS, auto-replenishment (for example, if a virus starts sending paid SMS, then bank auto-payment will “help” it empty your account).

In general, I personally would give one more piece of advice: for work, get yourself a simple and most regular phone; for entertainment - use Android with dozens of applications. In my opinion, such a measure will seriously protect your funds and nerves.

That's all. Additions on the topic are welcome!

IN lately The number of virus programs written for the Android OS is growing rapidly. And it’s very easy to get them for your mobile device. Smartphones and tablets are often stored confidential information and resources for e-wallet transactions. Attackers are trying to get hold of this data to steal it. cash using virus programs. Therefore, it is important to know the signs of a device infection, as well as how to remove a virus from an Android phone and protect it from re-infections.

Unfortunately, the Android OS is open to virus threats. Fortunately, it is curable :)

Malicious programs can significantly affect the operation of a smartphone and even cause it to fail. Below are some signs of a gadget being infected with a virus:

the phone takes longer to start than usual, slows down a lot, or suddenly reboots;
without your knowledge, paid SMS messages are sent or outgoing calls appear;
if funds are debited from your phone account;
the appearance of annoying advertisements in the browser or on the desktop;
screen lock with a requirement to transfer money to an unknown account to unlock it;
if it is impossible to access electronic wallets or there are monetary transactions that you did not make;
an unknown person has gained access to your account on social networks, which you use from a mobile device;
Applications do not start or some functions are blocked;
The phone battery drains very quickly.

If one or more of these symptoms appear, it is recommended that you scan your device for viruses.

If you notice symptoms on your phone viral infection- don’t despair. Follow the instructions below

Ways to fight viruses in Android OS

There are different ways to successfully remove a virus from your phone.

To avoid the need to fight the virus, it is best to prevent it from getting into your gadget. A simple rule is that you should only install apps from official app stores, e.g. Play Store or PlayMarket.

Cleaning your phone with antivirus

Also reliable protection provide all kinds of antiviruses for Android. The most popular of them: Dr. Web, Avast, Kasperskiy and others. It is recommended to download this software from the official website of the developer. Typically, antivirus programs operate in background and if a threat is detected, they report the problem.

Before you clean Android from viruses, you need to run a full scan of the device’s internal memory and memory card. If the antivirus detects a malicious program, you should select the “Delete” function. In this case, it is better to quarantine a neutralized copy of the application if the protection program mistakenly identified it as a virus.

It should be noted that scanning applications does not help to detect and remove malicious software in all cases. Many virus programs are protected against deletion and can be restored. In addition, the device may be partially or completely blocked and it is generally impossible to run anti-virus programs. Therefore, the question arises of how to remove a virus from an Android phone if it is not removed by an antivirus.

How to clean your smartphone in safe mode

If you were unable to remove dangerous software in normal mode, you can try to do it in safe mode. Since virus programs are usually not active in the device’s safe mode, you can try to destroy them.

To switch the gadget to safe mode for a version higher than Android 4.0, press the power button. Then, in the menu window, hold your finger on the “Turn off power” line until a window with the message “Enter Safe Mode” appears. Click OK.

For Android versions 4.0 and below, you need to turn off and turn on the device again in the usual way. During startup, when the Android logo appears on the screen, press the volume up and down buttons simultaneously. You need to hold them until the system is fully loaded.

Now the device has entered a safe operating mode and you can scan it with an antivirus program. If your phone does not have one or it does not start, you should install it from the application store.

This effectively removes viruses that push advertisements or download them to your smartphone. various applications to boost ratings.

To return to normal mode, you just need to reboot the device.

How to remove a virus from an Android phone via a computer

Another way is by connecting it to a computer. It is used when smartphone functions are partially or completely blocked.

Typically, your computer's antivirus automatically requests a scan when you connect any device to your PC. But if such a function is missing, then you need to manually select the phone memory to scan in the settings of your computer’s antivirus program.

To do this, you need:

When connecting your smartphone to your computer, select the “As USB storage” option.
In the “Computer” folder on your desktop PC you will see logical drives, indicating the gadget’s internal memory and SD card, if available.
IN context menu Select the “Scan for viruses” function on each disk. Scanning has started.

Resetting your phone on Android

If none of the methods yielded results and the virus is not removed, then you should resort to the last resort - resetting the settings to factory settings. Although this operation is the most effective method, however, this deletes all user information from internal memory.

Therefore, the necessary photos, music, videos and documents must be copied to other media before resetting. At the same time, be careful not to accidentally transfer the virus along with your data.

To restore factory settings via system menu, you need to go to “Settings” and open the “Personal” folder. Next click “ Backup" and select the "Reset with restoration of factory settings" function. After the device restarts, you will be offered a choice of language and other settings.

Prevention of virus infection of Android devices

It is better to prevent the threat of viral infection than to fight it malicious software. Therefore, to protect your mobile device, you should follow these simple tips:

You need to download and install applications from official websites and do not use hacked programs.
Install antivirus program and activate it.
Do not put your gadget into developer mode. This may make it more vulnerable to viruses.

Let's start with the “fresh” thing - Triad today can be considered the newest and “bulletproof” virus for smartphones. It was discovered only in March 2017.

It is unique in its proximity to classic viruses, and not ransomware Trojans, as is usually the case on Android. You still need to manage to pick it up from “unverified sources,” but then a much fun “action movie” begins:

Triada is a virus that not only misbehaves in the system, but wedges itself into its vital areas

Triada turns on after you install and give permissions to your favorite music downloader from VKontakte, for example. Afterwards, the program quietly finds out the model of your smartphone, firmware and Android version, volume free space on drives and a list of installed applications. AND sends this information on the Internet, to your servers. There are a huge number of these servers, they are scattered in different countries, that is, it will not even be possible to come and organize a “mask show” at the location of the server with the malware.
In response to Triada receives instructions(really, an individual approach to the patient!), how best to hide yourself specifically in this version of Android and this smartphone, is embedded in each (!) of the installed applications and takes control of system components to hide yourself in the list of installed applications and running processes. After this, the part of the virus standing alone in the system “covers up” its tracks - it no longer works as separate application, but coordinates its actions with the help of pieces of the infected system.
Done, the system is conquered! From this moment on, the smartphone turns into a “puppet” to which attackers give commands at a distance and receive information on any of the available servers. Now Triada operates in a primitive way - it finds out the details of your bank card, withdraws money from it, extracts the codes needed for payment from incoming SMS messages, and “draws” false numbers about the balance to the owner.

But with the ability to “gut” any installed application or install a new one at a distance - these are just “flowers” - the peculiarity of the “Triad” is that it is a modular virus, you can attach the most different types remote tricks.

As you can see, viruses for Android are not only primitive “your phone is blocked, you’re charged a hundred bucks”, which you can get rid of by deleting the application. And, if new versions of Android at least make it more difficult to access getting root and you can see something suspicious at the stage of requesting rights by the application, then older versions (Android 4.4, 4.3 and older) are absolutely defenseless against a new infection - only a complete flashing will save you.

Marcher

The so-called “banking malware” was developed back in 2013, but its “finest hour” came only in the summer of 2016. Famous for good camouflage and “internationalism,” so to speak.

Marcher is a simple Trojan that does not do anything supernatural, but simply replaces the service pages of a huge number of banks using pop-up windows. The mechanism is as follows:

Trojan penetrates the system along with the infected application. The peak of Marcher's popularity came with the "freshly stolen" versions of Super Mario Run from Nintendo. If you don’t remember, this is such a super-promoted “runner” from the creators of Pokemon GO!
Searches for banking applications on your smartphone and online shopping applications selects “blanks” in accordance with which bank you use.
Sends a “bait” to your smartphone- a message in the notification shade with a bank/store icon and a message in the style of “N rubles have been credited to your account”/“75% discount coupon for any product today only!”
Owner smartphone clicks on the notification. After which the Trojan opens exact copy , a 1-in-1 page similar to the one you are used to seeing in official application. And it says something like “the connection to the network has been interrupted, please re-enter your bank card details.”
Owner smartphone enters bank card details. There's a lot of money here!

“Dude, I somehow forgot your card number. Don't you remind me?

In this simple way, the Trojan faked the process of buying airline tickets, purchasing goods in online stores and software on Google Play, and the operation of banking applications. Users of bank cards in Germany, France, Poland, Turkey, the USA, Australia, Spain, Austria and the UK were targeted. Initially, the virus was “sharpened” for Android 6.x; there were significantly fewer smartphones running other versions.

Loki

Not even just one, but a whole cascade of “chameleon” Trojans, not as criminally severe as Triada, but just as painful for the operating system. Antivirus specialists paid attention to the malware at the beginning of 2016, and the malware began to penetrate en masse into people’s smartphones already in December 2016.

Loki is such an organized robbery by prior conspiracy in your smartphone

The malware acts so quickly and smoothly that you want to give them a standing ovation. Just look at this “multi-move”:

The first Trojan enters the system with secure application and starts with it. After this, it immediately “requests reinforcements,” that is, it downloads the second Trojan from its sources and installs it with a pack of tools to obtain root rights. It monitors the system, waits for the smartphone user to turn off the display, and in this mode extracts root. Then he launches his “colleague”.
Second Trojan intercepts root rights, gains access to the /system partition (“factory” firmware files, which are saved even after resetting the settings), unpacks a couple more Trojans and shoves them into “fireproof” system partitions.
Third Trojan comes to life in this very section /system, in which it replaces the part of the system responsible for loading and removes the standard “gibles” of Android. If by some miracle the owner removes all previous viruses and gets to the third Loki, with its removal the smartphone firmware will “die.”
At this time fourth of the Trojan cascade operates from a secure system folder, from where it downloads another pack of viruses, runs ads, or simply increases the counters of application downloads/website visits on the infected smartphone. Blocks the downloading and installation of antiviruses, improves its protection.

It is impossible to “uproot” the traces of this violent activity from the smartphone’s brain, so the infection can only be “cured” using Loki complete flashing with loss of all data.

Faketoken

If previous Trojans deliberately act on the sly so that the smartphone user does not realize about the infection until the last moment, then Faketoken is simple and straightforward in its approach, like an experienced gopnik - it demands to be given the rights to any actions with the smartphone, and if the owner refuses, the algorithm comes into play “Listen, why don’t you understand? Then I’ll repeat it!”

First, the user is forced to give administrator rights to the virus

Install you mean application with the usual label from some site vasyapupkinsuperwarez.net. You launch it, and after that they begin to “torture” you.
The Trojan opens a system window asking for administrator rights. In the best democratic traditions, the owner of a smartphone has two options - to allow the Trojan to access the system, or not to allow it. But in case of failure, Faketoken will open again request window system rights , and will do this constantly until the smartphone user capitulates.
After this, using the same thermorectal cryptanalysis method, the Trojan obtains rights to display pop-ups and replacing myself standard application to send SMS.
After success in the Trojan conquests contacts its command and control server on the Internet and downloads from there template phrases in 77 languages, which he will then use to blackmail the mobile phone user.
Then, using prepared phrases, Faketoken begins to mess with the system full screen messages in the style of “confirm the name and password of your Gmail account” and “we now have to link a card in Google Play, enter the required data.” Until the bitter end, of course.
The Trojan frolics in the system, sends and receives SMS, makes calls, downloads applications. And finally, it locks the screen, encrypts all files in internal memory and microSD and demands "ransom".

Godless

The Godless Trojan impresses not even with its, so to speak, functionality, but with its camouflage - long time Even the vaunted system did not recognize its presence in applications antivirus scan on Google Play. The result is a little predictable - the malware infected over 850 thousand smartphones around the world, and almost half of them belong to residents of India, which seems to hint at the origin of the Trojan.

If you download a flashlight from Google Play, you get an undeletable virus with encryption and root rights

The functionality of the Trojan is slightly different from its many colleagues in 2016; only the “beginning” is new:

Smartphone user downloads application from Google Play, turns it on, as a result of which the Trojan is launched along with the application. Just don't think something bad about Google check, because there is no malicious code in this “kit” - the Trojan downloads the malicious code when it is first launched.
To begin with Godless mines on a smartphone root rights, free without SMS. Using approximately the same set of tools as in your Towelroot, for example. The Trojan carries out such operations when the screen is turned off.
After this, the arrogant Trojan sends itself to the /system folder (from where it can no longer be deleted without flashing) and encrypts itself using an AES key.
With full Godless permissions starts little by little steal personal data users from a smartphone and install third party applications. In its initial versions, the Trojan, by the way, hid the standard Google Play from the user’s eyes and replaced it with a “parody” through which it stole the name and password from the account.

Among the applications that Godless was most often “attached” to were numerous “flashlights” and clones of famous Android games. viruses. worms , Trojans , adware (intrusive advertising) And "horror stories", but almost no one cares about such subtleties. They say that viruses are viruses.

The differences between the “grades of joy” are as follows:

Virus is a malicious program that sneaks onto your computer unnoticed due to system vulnerabilities. And, most importantly, it does not engage in sabotage on its own, but infects other files in the system. In the case of Android, such malware would have to penetrate after a banal click on an advertisement or visit a website, and then “rewrite” Gmail, VKontakte and other applications for itself in such a way that after the removal of the original virus, the infected applications would continue to do their dirty deed.
Worm- does a bad job and harshly, mercilessly, with all possibilities, distributes himself through all communication channels. On computers, worms sent themselves via e-mail, instant messengers, local network, flash drives - that is, they cloned themselves in the most shameless way.
Trojan never knocks on the system from the outside - you install and launch the malicious program yourself. This happens because Trojans replace ordinary, familiar and well-known applications, and sometimes they are simply “sewn” onto completely functional programs. That is, you buy and download useful program- and get malicious software as a gift!
"Scary stories" (scareware)- applications that cause panic: “Oh God, your entire smartphone is full of viruses and applications for wiretapping by intelligence agencies around the world! Download our antivirus and find out the whole truth!” You download, run, conduct a so-called scan, after which the program says: “There are a terrifying number of viruses in the system! Your phone will die if you don’t remove the viruses, but to do this you must enter your bank card details here and here.” This beauty is often ignored by all antiviruses, because it does not hack or steal anything from the system - it simply deceives the buyer and asks for money.

Today, Android OS is positioned as one of the most popular operating systems - more than 70% of devices around the world run on it.

The reason is its availability: the manufacturer uses open source for “sharpening” for numerous gadgets and makes it possible to independently change appearance shells, flash a smartphone, receive and so on.

These desires for personalization were eventually exploited by attackers, resulting in a huge number of malware injected into open source code, transferring the reins of the device into the wrong hands.

How to get a virus?

Android is considered quite secure operating system. Not in vain smart people Google Play came up with - most of all software is filtered for viruses, which protects the user from unauthorized implementation. Removing the ban on installation from unknown sources, you can open access to the device system to dubious applications with your own hands.

Basically, most malware enters the system by downloading software from third-party file hosting services, for example, when the owner of a smartphone tries to purchase it for free. paid application or a program that is not on Google Play. You can also “catch” a virus when entering a phone number on various sites: this way you will end up in the attackers’ database, after which messages with strange links will begin to arrive on the phone, after clicking on which the malware will automatically be downloaded to the device and harm its owner.

What viruses are there?

Classic Trojans. Old as the world, but still functioning successfully. Their main purpose is to steal user personal data: contacts, personal correspondence, logins/passwords for websites and bank card numbers. You can earn such a misfortune both through a dubious application, and by following a short link from familiar SMS messages like “You have received a photo, look here.”

Recently, such viruses are increasingly configured to hack applications like “ Mobile banking”, since this gives the attackers the opportunity to transfer all the victim’s money to their account.

Viruses that make it possible to obtain root rights. The moment a smartphone is infected with this virus, attackers gain administrative rights. From now on, they have access to any remote actions with the device: sending SMS on behalf of the user, making calls, managing the operation of the device, installing software, all access codes, passwords, and so on.

Sending paid SMS messages. At one time they were very popular on file-sharing sites containing free apps. As soon as the owner of the device downloads the program, messages from his number automatically begin to be sent to paid short numbers. Or, as an option, subscriptions are automatically issued for some non-existent content, for the imaginary use of which the owner of the device pays from 20 to 60 rubles. daily.

As a rule, until the reason for the rapid loss of funds is established, the user will have time to lose a decent amount.

"Eavesdropping Viruses". This kind of software is designed to record everything telephone conversations user, some subspecies are configured to selectively catch from these conversations important information: phone numbers, bank accounts And credit cards, logins, passwords and other confidential information.

Advertising application modules. Probably everyone has noticed an intrusive advertising banner, suddenly popping up in the middle of the screen. In some cases, when you click on it, the creator receives a certain amount from the user's account. For the most part, such an action is one-time and does not entail regular loss of funds, although sometimes the owner of a smartphone receives a package of parallel viruses.

How not to catch a virus?

To protect against a variety of malware for owners of smartphones on Android based You should refrain from installing software from unverified sources, use antivirus programs regularly and simply be prudent.