{"id":185867,"date":"2022-03-15T20:10:26","date_gmt":"2022-03-15T19:10:26","guid":{"rendered":"http:\/\/sftarticles.wpenginepowered.com\/en\/?p=185867"},"modified":"2025-07-01T20:53:16","modified_gmt":"2025-07-02T03:53:16","slug":"how-to-get-rid-of-viruses-android-after-factory-reset","status":"publish","type":"post","link":"https:\/\/cms-articles.softonic.io\/en\/how-to-get-rid-of-viruses-android-after-factory-reset\/","title":{"rendered":"How to get rid of viruses on Android that return after a factory reset"},"content":{"rendered":"\n

A little over two years ago, a brand new type of malware burst onto the Android scene. The story of this particular piece of malware first appeared in the news cycle over at Android Police. In an article released in April 2020, AP explained that the malware, named xHelper, was able to survive even the most thorough Android factory resettin<\/strong>g regimen.<\/p>\n\n\n\n

Unfortunately, such malware still roams the internet, hidden within unmonitored APKs and as overlays of already suspicious websites. It lies there, patiently, waiting for a user to click on the wrong webpage or download the wrong APK, and then it strikes. Luckily, we\u2019re about to break down what researchers found out about malware like xHelper <\/strong>and how to deal with it so that it cannot return. This is your crash course in one of the most ruthless examples of Android-focused malicious software<\/strong> the world has ever seen.\u00a0<\/p>\n\n\n\n

What is xHelper?<\/strong><\/h2>\n\n\n\n

xHelper is malware that came about in early 2020 and infected a vast majority of Android 6-7 devices. A Kaspersky researcher discovered that the malware operates by downloading a rootkit<\/strong>. A rootkit is basically an application, in this case malware, that can grant itself root privileges on your Android device. Once this software has root privileges, it can install additional malware onto your device. The worst is that it doesn\u2019t install any additional malware to easily accessible directories that you can clear from your OS; anything it installs attaches directly to your system partition. <\/p>\n\n\n\n

Once malware gets into the system partition it immediately becomes an even bigger task to remove, and it won\u2019t just disappear with a factory reset<\/strong>. Worse still is that the system partition isn\u2019t even a part of your phone you can access under normal circumstances; it\u2019s a read-only file that you cannot mess with. <\/p>\n\n\n\n

Here you\u2019re probably thinking that some Android users are more resourceful than others. In fact, some users have root access<\/strong>, which means they can manipulate root files. Surely these Android elites can remove rootkits? Unfortunately not. This malware is so pernicious because it roots itself so deep into your device, it’s in the same place all your other components are, where no amount of Android root know-how can pose any threat.<\/p>\n\n\n\n

As hopeless as the rootkit situation must seem, there is indeed light at the end of this Android malware tunnel; We\u2019re about to show you how to remove rootkits<\/strong>, no matter how deep they\u2019re buried.<\/p>\n\n\n\n

How to remove rootkits on Android<\/strong><\/h2>\n\n\n\n

Here\u2019s the kicker; you\u2019re going to need a third-party app. Yes, our system guides usually focus on how to do things without downloading external software, but this time you can\u2019t go it alone. We suggest enlisting the help of Avast for this one. Not only is Avast<\/a> one of the top names in antivirus protection for all your devices; unlike some rivals, Avast offers a free rootkit scanner and remover. You read that right; Avast and Free in the same sentence.<\/p>\n\n\n

  1. Find Avast\u2019s free rootkit scanner and remover<\/h2>\"How

    You can get the app directly from Avast by typing <\/span>\u2018Avast free rootkit scanner and remover\u2019<\/b> into your browser. On the Avast website, you\u2019ll see a blue <\/span>Install free anti-root kit<\/b> button. Give in to temptation and click it. <\/span><\/p>\n<\/div><\/li>

  2. Download the root-kit<\/h2>\"How

    Next, you\u2019ll be redirected to the download. Click <\/span>install<\/b> and wait for the app to finish downloading. Once downloaded, click <\/span>open<\/b>.\u00a0<\/span><\/p>\n

    Hit the green <\/span>Get started<\/b> button as soon as Avast opens, and take a quick look at your notifications, You should see a banner from Avast reading <\/span>Your device is secured<\/b>.<\/span><\/p>\n

    Avast is a company, and like most companies, they want you to end up purchasing their wares. Feel free to hit <\/span>Continue with free<\/b> on the next page you see.<\/span><\/p>\n<\/div><\/li>

  3. Your very first scan<\/h2>\"How

    Avast immediately teleports you to the scan interface<\/strong>. This is to make quick work of getting your device secure, and to give you a general lay of the Avast land so that you know what\u2019s going on. You can skip this for now, but we recommend doing the first scan. <\/span><\/p>\n

    When the scan is complete, you\u2019ll see a short summary of what Avast did<\/strong>. On our test device for example, it scanned 291 apps and 22 files, checked 11 security settings, and resolved one vulnerable setting. <\/span><\/p>\n<\/div><\/li>

  4. Deep scan<\/h2>\"How

    The first scan is a good way to check up on your device\u2019s security status, but one scan does not a secure Android make, as the adage goes. Next, hit the green scan button once more, and then you\u2019ll be prompted to choose between a regular scan and a deep scan. <\/span><\/p>\n

    Choose <\/span>use deep scan<\/b>. This will take longer than a regular scan, as it scans your entire device from root to tip for vulnerabilities. You\u2019ll notice that with the deep scan, the number of scanned files jumped from 22 to 2349; this is how you know how deep the deep scan goes. It scans system apps you didn\u2019t know you had, files you can\u2019t get to, and system directories not even shown on your phone.<\/span><\/p>\n<\/div><\/li><\/ol><\/div>