How to Remove Virus from Xiaomi Phone by Hand – Free 2026 Techniques

Why Standard Methods Don’t Work for Xiaomi

Viruses on smartphones Xiaomi, Redmi and POCO They are often disguised as system processes. MIUI, And that makes them invisible to most antiviruses, and unlike other brands, here the virus can hide in folders. /system/priv-app/, You can replace com.miui.daemon or even block access to Recovery. Standard tips like "install Dr.Web" won't work here, you need manual methods that are specific to firmware. MIUI.

The peculiarity of Xiaomi is that even after resetting to factory settings, some viruses are saved in the section. /persist Or backups of Mi Cloud, like Agent.SM, which is a Trojan that's distributed in the U.S. 2023–2026 In the years since, he has been creating hidden device administrators that are not removed from the settings menu. This article covers Xiaomi-unique techniques, including working with the user. ADB, Editing a build.prop file and cleaning up a Dalvik cache is something that isn’t in the general instructions.

Signs of infection: how to distinguish the virus from glucose MIUI

MIUI It's itself guilty of strange behaviors, like opening a Mi Browser ad spontaneously or hanging out because of memory optimization, but there are 100 percent signs of the virus that are not related to the firmware features:

• 📱 Unknown apps are on the installed list (even after a reset) often masquerading as "Google Play Services Update" or "MIUI System Optimizer".
• 💰 SMS to paid numbers (check Settings) → SIM-maps and mobile networks → Traffic usage: FakeBank sends messages to numbers like +79xxxxxx890.
• 🔋 Battery discharge in 2-3 hours standby. Check settings → Battery → Battery use – if there is a mediaserver or com.android.system process eating 30%+, It's a virus.
• 🌐 Redirect to sites when you open any links (including Google) Typical of HiddenAds virus.

If you're watching at least 2 If you look at these signs, don't try to treat your phone with an antivirus -- it'll only remove the symptoms and the core of the virus will remain. For example, Avast or Kaspersky can find a "threat" in the folder. /data/app/, but miss the main module in /system/xbin/.

⚠️ Note: Viruses on Xiaomi often block access to Settings → If you try to open the list of applications and see an error "Com.android.settings process stopped", it means that the virus has changed the system file. Settings.apk. In this case, immediately proceed to the method of ADB.

Preparation: What to do before manual cleaning

Before you start deleting, follow 3 mandatory steps, and ignoring them can lead to a device blink (completely inoperable) or data loss:

1. Create a backup through Settings → Additionally. → Backup and reset → Local backup. Viruses can block this process -- if you don't make a copy, use XiaomiTool. V2 PC-only.
2. Put the debugging on. USB: Go to Settings. → The phone. → Version. MIUI and tap 7 times on the line to activate the developer mode. → Additionally. → For developers and enable debugging by USB and Unlock. OEM.
3. Download the necessary tools: 🖥️ Android SDK Platform-Tools (for the purposes of ADB-team). 📂 List of engineering codes MIUI (You need to access the hidden menu). 🔍 MT Manager or Root Explorer (if root rights are available).

If the virus blocks access to settings, use the emergency debugging method:

1. Turn off the phone.


2. Press the power button + volume up until the Mi logo appears.




3. From the Recovery menu, select Advanced → Enable ADB.

Method 1: Remove through hidden settings MIUI (PCless)

This works if the virus has not yet acquired the superuser rights. MIUI Hidden menus that are not dokumented in the official certificate.

Step 1. Verification of device administrators

Many viruses (such as Android.Triada) are registered as administrators, which blocks their removal.

1. Open the phone app and enter the code: ##4636###.
2. Go to the Usage Statistics menu → Admin apps.
3. If you see unknown applications (such as Device Test or System Update Service), remember their names.

Step 2: Delete via the "Special Opportunities" menu

Some viruses are disguised as accessibility services to turn them off:

1. Go to Settings → Special features → Special features Services.
2. Disable all unknown services (such as TalkBack Helper or Accessibility Suite).
3. Back to Settings → Annexes → All applications and find the same names. Click Delete (if the button is inactive, go to the method with the ADB).

Step 3. Clearing Dalvik's cache

Viruses often leave their modules in the Dalvik cache, which leads to reinfection after rebooting.

1. Enter the code ##36446337## (test menu will open).
2. Choose a Single Test → Dalvik Cache Test.
3. Press Clear Cache and restart the phone.

Method 2: Removal of the virus through ADB (power-user)

If the virus has blocked access to settings or masquerades as system processes, you will need to ADB (Android Debug Bridge This method allows you to delete virus files directly from the PC command line.

Step 1: Connecting your phone to your PC

1. Connect your phone to your computer through USB-cable (original! Chinese cables may not transmit data).
2. On the phone in the notification panel, select File Transfer (MTP) mode.
3. Open the command line (Windows) or the terminal (Mac/Linux) in the folder with the platform-tools.
4. Enter the command to check the connection: Adb devices must appear serial number of your device.

Step 2: Search and remove virus packets

First, we get a list of all the packages installed and find suspicious ones:

adb shell pm list packages -f

Look for packages with names like:

• com.android.system.update (fake)
• com.qualcomm.telephony (unless you have a Qualcomm processor)
• com.miui.analytics (if you haven't installed it)

To remove the found package:

adb shell pm uninstall -k --user 0 name packet

Step 3: Delete virus files from system folders

If the virus is hidden in the system folders, you will need to mount the partition. /system recording:

adb shell


su




mount -o rw,remount /system

Then delete the virus files (example for Agent.SM Trojan):

rm -f /system/priv-app/SystemUpdate/SystemUpdate.apk


rm -f /system/xbin/su (if it's not your root access!)




rm -f /data/local/tmp/*

⚠️ Note: Removing files from /system without root rights can lead to a bootloop cycle. If the phone does not turn on after rebooting, you need to flash the device through Fastboot (instructions in the next section).

💡

If ADB Can't see the device, try reinstalling the Mi drivers USB Driver from the official Xiaomi website. for Windows can also help the utility Zadig to replace the driver with libusb.

Method 3: Fastboot Flashing (extreme case)

If a virus has damaged system files or blocked access to Recovery, the only reliable way is to completely flash through Fastboot, which erases all data on the phone, including viruses in partitions. /system and /persist.

Step 1. Download the firmware

1. Go to MIUI Downloads website.
2. Choose your model (for example, Redmi Note 11 Pro)+ 5G) and download Fastboot firmware (file with.tgz extension).
3. Unpack the archive in the platform-tools folder (where fastboot.exe is located).

Step 2. Firmware through Fastboot

1. Turn off the phone and press Power + Volume down to log into Fastboot Mode.
2. Connect your phone to your PC and check for detection: fastboot devices
3. Start the firmware (for Windows): fastboot flash all Mac/Linux:./flash_all.sh

Step 3: Unlock the bootloader (if required)

On new Xiaomi models (released after 2021), the bootloader is locked to unlock it:

1. Link your Mi Account to your device in Settings → Xiaomi account → Mi Cloud.
2. Go to the Mi Unlock website and download the Mi Unlock Tool.
3. Follow the instructions (you may need to wait 7-14 days for new accounts).

💡

Fastboot firmware is the only method that is guaranteed to remove viruses from partitions /system and /vendor. However, it requires unlocking the bootloader, which resets all data and can lead to a loss of warranty.

How to prevent re-infection

After removal of the virus, it is necessary to close the "plad" in safety MIUI, This is what we need to do:

• 🔒 Disable the installation from unknown sources: Go to Settings → Annexes → Special access → Install unknown applications. Disable permission for Mi Browser, Files and other applications.
• 🛡️ Set up the built-in scanner MIUI: Open Security. → Virus scanner. Turn on real-time scanner and download check. Add only trusted applications (e.g. Termux or F-Droid) to exceptions).

Blocking Advertising at System Level

1. Install Blokada or AdGuard from F-Droid (not from Google Play!).
2. In the settings, select Local VPN-Mode and add EasyList filter lists + Malware Domains.

It is also recommended to disable automatic updates. MIUI, Some viruses are spread through fake OTA-packet:

1. Go to Settings → About the phone → System update.
2. Slap the icon. ⚙️ in the upper right corner and disable Automatic Download via mobile network.
3. Turn on the Update Check manually.

Frequent Mistakes and How to Avoid Them

Many users make things worse by following advice from outdated instructions.-5 errors and their consequences:

If the virus remains after all the manipulations, check:

• 📱 SIM card: Some viruses (such as Simjacker) store their modules on the computer. SIM. Try inserting another card.
• 🔌 Charger: Viruses can be transmitted through infected USB-Ports (especially in public places).
• ☁️ Mi Cloud account: virus could sync to cloud reset password and turn off sync for 24 hours.

FAQ: Answers to Frequent Questions