My Android tablet is locked by a Cheshire Police virus scam ransomware.

How can I remove it? I am in safe mode as I write this.


From Naked Security by Sophos (it's detected as Andr/Koler-A),

Booting into "Safe mode"

Method 1

(Reported to work on Google devices and various Android Open Source Project, or AOSP, derivatives like CyanogenMod.)

  • Press and hold the power button as you would to power down or reboot.
  • A menu will pop up.
  • Tap and hold the “Power off” option.
  • If nothing happens try the same with “Reboot”.
  • A dialog should appear offering you to reboot in Safe Mode.

safe mode 1

Method 2

(Reported to work on Samsung Galaxy S4.)

  • Power down.
  • Turn on and repeatedly tap the soft-button for “Menu.”

Method 3

(Reported to work on Samsung Galaxy S3 and others)

  • Power down.
  • Turn on, then press and hold Volume Down (Galaxy S3 and others), Volume Up (HTC One and others), or Volume Down and Volume Up together (various Motorola devices) when the vendor’s logo appears.

If you have managed to select Safe Mode, you will see the text “Safe Mode” at the bottom left corner of the screen.

safe mode text

To get out of Safe Mode, try simply rebooting.

If that doesn’t work, try rebooting using one of the button-press options listed above, starting with the one you used to engage Safe Mode in the first place.

What to do when "Safe mode" is active

This variant of the malware installs itself under the name BaDoink (apparently the name of a well-known online porn service), like this:


After booting into Safe Mode, third-party apps will no longer show up on the Apps page, as you can see here:

no 3rd-party on safe mode

Go instead to the Settings menu and choose Apps:

settings - apps

This will bring up a list of downloaded (third-party) apps, including the Koler-infected BaDoink:

installed 3rd-party apps

Tap on BaDoink; this won’t run it, but will open up the program’s App Info screen:

app info

Tap on Uninstall, and you are almost home:

uninstall dialog

Choose [OK] to uninstall and you are done.

You may now reboot out of Safe Mode.

Hope this helps!

| improve this answer | |

Staying in safe mode, go to Settings > Application manager and remove suspicious applications from your device and reboot your device to normal mode.

Note: If you are unable to detect suspicious Apps try Factory/Hard Reset.(backup your data before performing reset otherwise data may lost).

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.