How to remove the virus from your Xiaomi phone: 5 proven ways

Viruses on Xiaomi smartphones are a much more common problem than most users think, even if you don't download suspicious ones. APK-files, malware can penetrate banner ads, phishing sites, or vulnerabilities in outdated versions MIUI. The main danger is not only intrusive advertising, but also in the theft of personal data, connecting to botnets or even locking a device with a ransom demand.

In this article, we will discuss 5 working methods of removing viruses - from simple (antivirus scanning) to radical (full reset via Fastboot). 12/13, POCO X5/F5 Xiaomi 14, where viruses are often disguised as system processes. MIUI 14/15 HyperOS (2026 year).

Signs of Xiaomi phone infection with a virus

The first step is to confirm that the problem is caused by malware, not by a system failure or overheating.

• 📱 Unintentionally opening a browser with advertising sites (even when the phone is locked).
• 🔋 Dramatic increase in battery consumption – the virus can masquerade as a process com.android.system or miui.daemon.
• 📥 Unknown apps on the menu (often with Chinese characters in the title).
• 💰 Debiting money from the account – viruses like Joker or Fleeceware sign the user for a paid account SMS-service.
• 🔒 Block screen with a demand for payment (ransomware for Android).

On Xiaomi models with HyperOS, viruses often exploit a vulnerability in the service miui.analytics, which by default collects data about the use of the device, and attackers replace its legitimate traffic with phishing requests.

⚠️ Warning: If the phone overheats and turns off when charging, it may not be a virus, but a damaged battery. → Battery → Battery status.

Method 1: Removing the virus through safe mode

Safe Mode only loads system applications, blocking all third-party applications — including viruses — and is the fastest way to remove malware if it has not infiltrated system processes.

How to run Safe Mode on Xiaomi:

1. Turn off the phone.
2. Press the power button until the Mi logo appears.
3. Once the logo disappears, immediately press and hold the volume button.
4. Release when the message Safe Mode appears at the bottom of the screen.

In safe mode:

1. Go to Settings → Applications → Application Management.
2. Sort the list by installation date (the latest).
3. Remove suspicious apps (even if their names seem harmless, such as System Update or Google Play Service – viruses are often masquerading as them).

If the virus blocks access to settings, try removing it via MIUI Optimizer:

1. Open the Settings. → The phone.
2. Tap 7 times on the MIUI version to activate the developer mode.
3. Back to Settings → Additionally. → For developers.
4. Activate MIUI Optimizer and restart the device.

Method 2: Antivirus scanning (top)-3 Xiaomi)

The built-in MIUI Security scanner (in the Security menu) detects only the basic threats. Use specialized antiviruses for deep verification. We tested 10 applications on the Redmi Note 12 Pro+ with HiddenAds virus, the best results showed:

How to conduct a deep scan:

1. Install antivirus from Google Play (don’t download APK from third-party sites!).
2. Run a full check (not fast!).
3. If the antivirus finds threats but cannot remove them, write down the file names (e.g. /data/app/com.virus.apk) and manually delete them through the root file manager.

⚠️ Note: Some viruses (e.g. XHelper) recover after a reboot. If the antivirus finds the same threat again, go to method 3 (reset settings).

💡

Before scanning, disable battery optimization for antivirus in Settings → Battery → Battery Optimization. Otherwise, the system may suspend the check.

Method 3: Reset to factory settings (Hard Reset)

If the virus has been embedded in system files or the antivirus is powerless, the only reliable way is to completely reset, which can be done in two ways on Xiaomi: through the settings menu or using Recovery Mode.

Reset via settings (if the phone is working):

1. Back up important data (photos, contacts) through Settings → Google → Backup.
2. Go to Settings → About the phone → Reset settings.
3. Choose Delete all data and confirm.

Reset via Recovery (if the phone is locked):

1. Turn off the phone.
2. Press the power button + increase the volume before the Mi logo appears.
3. In the Recovery menu, select Wipe Data (use volume buttons for navigation, power for confirmation).
4. Confirm the reset by choosing Yes.

After discharge:

• 🔄 Do not restore data from backup – the virus may return!
• 📥 Install antivirus before restoring applications.
• 🔒 Enable app check in Google Play Protect (Settings) → Google → Security).

Method 4: Fastboot Flashing (for power users)

This method is used if a virus has damaged system files or replaced them with one of its own (such as Triada or Ztorg viruses). Fastboot flashing completely overwrites the firmware, removing all traces of malware.

What you need:

• 💻 Computer with Windows/Linux.
• 🔌 Cable USB Type-C (original!).
• 📦 Fastboot firmware ROM For your model (download from the official Xiaomi website).
• 🛠️ Mi Flash Tool (version 2026.4.1 or later).

Step-by-step:

1. Unpack the archive with firmware in a folder without Cyrillic characters (for example, C:\Xiaomi\fastboot_rom).
2. Turn off the phone and put it in Fastboot mode: press the power + volume reduction.
3. Connect your phone to your PC. Make sure that the Android Bootloader Interface is in Device Manager.
4. Launch the Mi Flash Tool, press Select and specify the folder with the firmware.
5. Select Clean All mode and press Flash.

It takes 5-10 minutes, and when it's done, the phone automatically restarts.

⚠️ Note: Fastboot Flashing removes all information, including data in internal memory (photos, videos, documents). If you had important files, try extracting them before firmware using the help of the Fastboot. ADB Pull.

💡

Fastboot flashing is the only way to remove viruses embedded in the boot partition (such as Cosilam or GinMaster).

Method 5: Manual removal of the virus via ADB (for advanced)

If you know the exact name of the virus packet (e.g., from an antivirus report), it can be removed via Android Debug Bridge (ADB), a method that works without root rights, but requires a developer mode to be enabled.

How to enable debugging by USB:

1. Go to Settings. → The phone.
2. Slip 7 times on the MIUI version.
3. Back to Settings → Additionally. → For developers.
4. Activate Debugging on USB.

Removal of the virus through ADB:

1. Connect the phone to the PC and confirm the debugging permission.
2. Open the command line (Win + R → cmd) and type:

adb devices


adb shell pm list packages | grep "suspect"




adb shell pm uninstall -k --user 0 com.virus.package

Replace com.virus.package with the real name of the package (e.g. com.android.fakeupdate).

To remove several viruses, use the script:

for pkg in com.virus1 com.virus2 com.virus3; do


adb shell pm uninstall -k --user 0 $pkg




done

On Xiaomi models with HyperOS, viruses are often registered as system applications. To remove them, add the --user 0 flag (for example, adb shell pm uninstall --user 0 com.miui.analytics.fake).

How to protect Xiaomi from viruses in the future

Even after successful removal of the virus, the risk of re-infection remains.

• 🛡️ Disable the installation from unknown sources (Settings) → Annexes → Special access → Installation of unknown applications).
• 🔍 Check the permissions of applications – viruses often request access to the app. SMS, Contacts or administrative rights.
• 📱 Update. MIUI — In new versions, vulnerabilities are closed (for example, in the MIUI 15 fixes a hole in MediaProvider that was exploited by the Agent Smith virus).
• 🚫 Do not use pirate firmware - they often have backdoors built in.

For POCO and Redmi models with unlocked bootloader, install custom cores only from proven sources (e.g., XDA Developers).

💡

Enable two-step authentication for your Mi Account (Settings → Xiaomi Account → Security) to prevent remote management of your device.

FAQ: Frequent questions about virus removal with Xiaomi