Skip to Content
Security & Privacy

This terrifying malware app can’t be removed from your phone

Barely a week goes by without the news mentioning an Android malware epidemic. Not only is the problem deeply entrenched in Google’s ecosystem, but security researchers keep finding malicious software before Google has a chance to! Click or tap to see how millions of users managed to install malware from the Google Play store.

But unlike recently reported malware, the latest threat against Android isn’t letting users off easy. Once this software installs itself on your phone, it goes to great lengths to hide itself, changes your settings and makes itself almost impossible to delete.

If you’ve spent any time in sketchy parts of the web, or downloaded new software for your Android phone, here’s what you need to check to ensure you’re not infected.

Xhelper Trojan is a virus in the worst possible way

Much like a real life virus, there’s no known cure for Xhelper — a Trojan that has rapidly infected more than 45,000 phones in the past 6 months.

According to security researchers at Symantec, this Android-centric malware is primarily targeting users located in India, Russia and the United States with invasive pop-up ads that refuse to disappear. This will continue happening, even if the user erases and restores their phone to factory settings.

 

Related: Find out if your Android has a virus

 

Xhelper works by changing settings in your device so it’s harder to detect. It deletes its own app icon, embeds itself deep into settings menus and runs quietly in the background. Most users don’t even know they’re infected until they experience an increase in annoying advertisements at inopportune moments.

Currently, anti-malware programs for Android detect and remove Xhelper, but what makes this virus so scary is it hides code in your system that automatically re-downloads the malware if you mange to delete it. Regardless of whether you’re clearing out apps via settings or completely erasing the phone, Xhelper somehow manages to come back again and again.

As of now, there’s no known method to remove the code that re-downloads the virus. Once Xhelper’s on your phone, you’re stuck with it.

How can I fight back against this virus? Is it too late for my phone?

Unlike nearly every other Android malware we’ve discussed, Xhelper isn’t found in the Google Play store. Instead, it usually comes attached to third-party apps from non-Google sources. Shady game websites and unauthorized app repositories are known lurking grounds for Xhelper and a slew of other nasty phone viruses.

To keep your phone safe from Xhelper, avoid downloading apps from any source you’re not familiar with. Stick to the safer parts of the web when browsing, and avoid downloading any strange attachments from emails or text messages. By sticking with websites and apps you’re familiar with, you’ll be much safer.

 

Related: New malware crosses the ocean to infect American phones

 

If Xhelper is already on your phone, there isn’t much you can do for now. Users have managed to kill Xhelper by updating to a new version of Android, but not everyone is behind on their updates. This method may be successful, but only for those who haven’t updated to the latest operating system. Everyone else will have to wait until the next update.

Other than updating, running an antivirus like Kaspersky for Android or Malwarebytes can help you delete the malware when you boot up your phone. It will re-download itself, so be prepared to do this every single time you start up.

Of course, there’s also the nuclear option: buying a new phone altogether. For our guide to the best smartphones in 2019, click or tap here.

To compare models for yourself, click or tap here to visit our flagship smartphone comparison chart.

Komando.com App background

Check out the free Komando.com App!

Get the latest tech updates and breaking news on the go, straight to your phone, with the Komando.com App, available in the Apple Store and Google Play Store.

Download Now