How to completely remove the virus from the phone Xiaomi Redmi: 5 proven ways

Why are these viruses so dangerous for Xiaomi Redmi?

Xiaomi Redmi smartphones are some of the most popular in Russia, but their open ecosystem and customized MIUI firmware are often targeted by malware. Viruses on these devices are more aggressive than on “pure” Android: they masquerade as system notifications, block access to Security Settings, and sometimes even mimic MIUI updates. The main problem is that many users confuse viruses with standard Redmi features, for example, with banner ads in branded Mi Browser or GetApps applications.

Unlike flagship models (such as the Xiaomi 13 Pro), budget Redmis (such as the Redmi Note 12 or Redmi 10C) are more likely to suffer from viruses due to weak hardware protection and a simplified verification system installed APK. The virus can penetrate even through the official Mi App Store, if attackers hacked into the developer’s account.

• 📢 Advertising notifications from Mi Video or Mi Music (can be turned off in app settings)
• 🔄 Automatic Memory Optimization (function) MIUI Optimization)
• 📱 Suggestions to update the firmware through Settings → The phone.

The real symptoms of infection are a sudden rise in the temperature of the processor (even in standby mode), the disappearance of free space on the internal drive or redirecting to fraudulent sites when you open your browser.

Method 1: Removing the virus through safe mode

Safe Mode is an Android diagnostic mode where only system applications are downloaded, and if the virus disappears in it, it has been installed as a regular app. There are two ways for Xiaomi Redmi to enter safe mode:

1. Through the power button: press the off button, then tap and hold your finger on the power off option (a suggestion will appear to go to safe mode).
2. Through button combination: Turn off the phone, then turn it on, holding Volume down + Power until the MI logo appears.

In safe mode:

Remove suspicious apps through Settings → Apps → App Management

Check the list of device administrators in Settings → Passwords and Security → Device administrators

Disable Overlay Rights for Unknown Applications in Special Options → Overlay Rights

Restart your phone in normal mode-->

Pay special attention to applications with names like System Update, Android Security or Cleaner Master, which often mask viruses. If the problem persists after removal, then the malicious code is embedded in the system files (go to method 3 or 4).

⚠️ Warning: Some viruses block the entry into safe mode, simulating a system failure. If after several attempts the phone does not load into Safe Mode, this is a sign of deep infection - you will need to reset or flash it.

Method 2: Antivirus scanning (which works on MIUI)

Standard Google Play Protect often skips viruses on Xiaomi Redmi due to conflict with MIUI optimizations. We tested 5 antiviruses on Redmi Note 11 Pro+ with Android.Triada.231 virus - the best results showed:

Scanning instructions:

1. Install Dr.Web Light or Malwarebytes from Google Play (not from APK!).
2. Run a full scan (not fast!). On Redmi with 128GB of storage, it takes 15-20 minutes.
3. If the virus is detected but not removed, go to Settings → Apps → [Virus Name] → Storage and manually clean the cache and data.

Important: Xhelper or Shuanet viruses can recover after a reboot, and in this case, the antivirus is useless, you need to reset or flash it.

💡

Before scanning, disable MIUI Optimization in Settings → About Phone → MIUI version (shoot 7 times in version) to increase the chances of detecting hidden threats.

Method 3: Manual cleaning through ADB (for experienced)

If the virus has blocked access to settings or the antivirus does not help, you can delete it via Android Debug Bridge (ADB). This method works even for system viruses, but requires a connection to a PC.

• 🖥️ Computer with Windows/Linux
• 🔌 USB-cable (original from Xiaomi)
• 📦 Google's Platform Tools utility

Steps:

1. Turn on USB Debugging on your phone: Settings → About Phone → MIUI Version (tap 7 times), then go back to Settings → Additional → For Developers → Debugging over USB.
2. Connect Redmi to your PC and execute on the command line: Adb devices (the name of your device should appear).
3. To see a list of all packages (including hidden viruses), type: adb shell pm list packages -f
4. Find suspicious packages (e.g., with the names com.android.system.update or com.qualcomm.thermalservice) and delete them: adb shell pm uninstall-k --user 0 [name packet]

List of known malicious packages for Xiaomi Redmi (2023–2026):

• com.android.system.update (imitate update)
• com.sec.android.app.launcher (fake launcher)
• com.google.android.trichromelibrary (virus miner)

⚠️ Warning: Removing system packages can lead to bootloop. If you're not sure, skip this method and move on to reset.

Method 4: Reset to factory settings (guaranteed removal)

If the virus is embedded in the system files or blocks all attempts to delete, only a complete reset (Hard Reset) remains.

Option A: Through the settings menu (if the phone is working)

1. Go to Settings → About the phone → Reset settings.
2. Select Erase All Data (not “Settings Reset”!).
3. Enter the password from your Mi Account (if linked).
4. Confirm the action - the phone will restart and start resetting.

Option B: Recovery Mode (if the phone is locked)

1. Turn off Redmi.
2. Press Volume Up + Power and hold for 10 seconds until the Recovery menu appears.
3. Select Wipe Data → Wipe All Data (control – volume buttons, confirmation – power button).
4. After reset, select Reboot → Reboot to System.

The following are the key features for Xiaomi Redmi:

• 🔒 Once reset, the phone will require you to enter data from Mi Account if it was previously tied!
• 📱 On models with dynamic memory (Redmi Note 12 Pro)+ and newer) the reset can take up to 30 minutes.
• 🔄 If the virus came back after the reset, it was in the firmware).

💡

Resetting to factory settings removes everything, including photos in the DCIM folder and messages. Pre-extract the microSD card (if any) - its contents will not be affected.

Method 5: Fastboot Flashing (extreme case)

If the virus survives reset, it is embedded in the MIUI firmware itself, which is typical of viruses like Cosilam or GinMaster that modify system partitions, and the only solution is to completely flash through Fastboot.

You'll need:

• 🖥️ PC with Mi Flash Tool and Platform Tools installed
• 📦 Official firmware for your model (download from Xiaomi website)
• 🔌 Original. USB-cable (better from the set)

Instructions:

1. Unpack the firmware in a folder without Cyrillic characters (for example, C:\MIUI\).
2. Turn off the phone and press Volume Down + Power to enter Fastboot Mode (a hare in a hat-out-of-the-box will appear).
3. Connect Redmi to your PC and start the Mi Flash Tool.
4. In the program, select a folder with firmware, then press Refresh (your device should appear).
5. Select Clean All mode and press Flash.

It'll take 5-10 minutes.

• 📱 The phone will automatically reboot to a clean system.
• 🔄 The first turn on can take up to 15 minutes – do not interrupt the process!
• 🔒 Re-attach Mi Account to avoid blocking.

⚠️ Attention: Fastboot flashing resets IMEI on some Redmi models (e.g. Redmi) 9A). After the procedure, check. IMEI *#06# - if it resets, you will need to restore it via Qualcomm Tool.

How to protect Xiaomi Redmi from viruses in the future

Even after the virus is removed, your Redmi will remain vulnerable if no action is taken.

Disable installation from unknown sources in Settings → Passwords and Security → Unknown sources

Remove or freeze (via ADB) standard Mi Browser, GetApps, Mi Video apps

Install Dr.Web Light and set up a weekly scan

Turn off “Recommendations” in Settings → Lock screen → Notifications and recommendations

Do not connect to public Wi-Fi without VPN (viruses spread through ARP-spam)-->

Additional measures for advanced users:

• 🛡️ Install Magisk and XPrivacyLua module to block virus resolution.
• 🔒 Block Advertising Domains via Blokada or AdGuard.
• 📡 Turn it off. MIUI Analytics in Settings → Passwords and security → Confidentiality → Analytics MIUI.

Pay special attention to phishing attacks through SMS. In 2026, scammers are actively sending messages allegedly from Xiaomi asking them to “update account security” via the link. SMS — All official notifications are displayed in the Mi Account app.

FAQ: Frequent questions about virus removal with Xiaomi Redmi