Uninstallable xHelper virus appeared on Android


Back in March, security experts began reporting the discovery of the dangerous xHelper virus. At first, its threat was not of large scale, because the malware spreads only through certain APK files downloaded by users from unverified sources.

The danger of this virus is underestimated. Five months after detection, the number of devices infected by it reached 32,000, and now this number has exceeded 45,000. According to Symantec, 131 new smartphones are infected every day, or about 2,400 a month. Moreover, the vast majority of victims from the United States, India, and Russia.

On an ecosystem-wide scale, these are not so significant figures, if not for one “but,” the virus is undeletable. After penetrating the smartphone, xHelper is separated from the source into a standalone application. If you delete the infected APK file and the installed program, this will not help.

xHelper settles in the system and starts showing banner ads that send to various applications on Google Play. And this is only the lesser of evils. Attackers can use the virus to remotely install more dangerous viruses on your smartphone that target your bank cards.

If you believe Symantec and Malwarebytes, then xHelper can automatically reinstall even after a complete reset! Some victims of the virus said that even the option to prohibit installing applications from unknown sources does not help.

Now experts are trying to figure out the origin of the xHelper Trojan. There is a version that on some smartphones it is already “out of the box”, this would explain its constant revival. Users are advised so far not to download applications from unfamiliar sites, constantly update all system services and not neglect antiviruses.

How to remove an xHelper virus from Android

However, it’s still worth a try. Some users claim that they were able to remove xHelper using paid antivirus programs. Another thing is that we have no evidence that we remove not only the trojan but also its installation file, which provokes reinstallation even after a rollback to the factory settings.

Therefore, we would not dare to recommend any specific antivirus, especially the one you have to pay for, leaving the final decision on the choice solely at your discretion.


For our part, we can recommend using the free Internet App Blocker (download), which is available for download on Google Play. It allows you to block the connection of any program with the Internet, which means that with its help you can actually prohibit xHelper, which will no longer be able to show ads.

Given that the trojan does not steal your data, and this is a proven fact, using the Internet App Blocker may turn out to be the most effective solution, at least so far, when there is no more effective means of fighting the trojan.