How to Remove a Virus From Android (Malware Guide)

First, the honest framing: Android phones almost never get a classic virus, the kind that copies itself and spreads from file to file. Android isolates each app in its own sandbox, which blocks that behavior. What people actually mean by “a virus” is malware: a malicious or deceptive app, adware that floods you with ads, or a potentially unwanted app (PUA) that sneaked in with something else. The good news is that because the problem is almost always a specific app, removing it is usually straightforward. Here is how.

How malware gets onto an Android phone

Because the fix depends on how the bad app arrived, it helps to know the usual routes. Most Android malware comes from sideloaded apps downloaded outside the official store, “modded” or cracked versions of paid apps, fake update prompts on sketchy websites, and links in spam texts or emails. A smaller share slips through the official store itself before being caught and removed. The common thread is that you, or someone with your phone, tapped something to install it. That is good news: it means the problem is a specific app you can find and remove, not an invisible infection.

Signs you might have malware (not certainty)

None of these prove an infection on their own, but several together are worth acting on: a sudden flood of pop-up ads, a new app or icon you do not recognize, fast battery drain and heat, a spike in mobile data, redirects to strange websites, or settings that change by themselves. If you notice these right after installing something, that app is your prime suspect.

Step 1: Boot into Safe Mode

Safe Mode starts Android with only the apps that came with the phone, temporarily disabling everything you installed. This does two things: it stops a misbehaving app from interfering while you work, and it tells you whether an installed app is the cause at all.

1. Press and hold the power button until the power menu appears.
2. Press and hold the “Power off” option until a “Reboot to safe mode” prompt appears, then confirm.
3. If that does not work, restart the phone and hold the volume-down button as the manufacturer logo appears. Steps vary by model, so check your manufacturer’s instructions.

You will see “Safe mode” in a corner of the screen. If the pop-ups, drain or odd behavior disappear here, an installed app is responsible.

Step 2: Find and uninstall the suspect app

Open Settings, then Apps, and review the full list while still in Safe Mode. Look for apps you do not remember installing, generic names (a random “cleaner,” “flashlight” or “PDF” tool), or anything installed right before the trouble started.

1. Tap the suspicious app, then choose Uninstall.
2. Remove one app at a time, then restart and check whether the problem is gone before removing the next.

Step 3: If Uninstall is greyed out, revoke admin rights

Malicious apps often grant themselves device administrator access so they cannot be removed normally. If the Uninstall button is disabled, clear that permission first.

1. Open Settings and go to Security (or Security & privacy).
2. Find “Device admin apps” (the exact name varies by manufacturer).
3. Turn off admin access for any app you do not recognize.
4. Return to the app list and uninstall the app normally.

Also check Settings, then Accessibility: some adware abuses accessibility services to draw ads or re-enable itself. Turn off any service tied to an app you are removing.

Step 4: Run Google Play Protect

Once the obvious suspects are gone, let Android scan itself.

1. Open the Play Store and tap your profile icon.
2. Choose “Play Protect,” then tap “Scan.”
3. If it flags an app, follow the prompt to remove it.

Play Protect checks your installed apps against Google’s threat database and can remove known-bad apps. It is not perfect, so it works best alongside the manual checks above. For a realistic picture of its strengths and limits, read what Google Play Protect catches.

Step 5: Clean up browser pop-ups separately

If your “virus” is really constant ads or redirects while browsing, that is often a website notification or adware setting, not an installed threat. Clear your browser’s cache and site data, and review site notification permissions. This is a different fix from removing an app, so handle it on its own.

Removal methods compared

Step 6: Factory reset as a last resort

If you cannot identify the app, or the problem survives every uninstall, a factory reset returns the phone to a clean state by wiping all installed software. It is the most reliable option, but it erases your data, so back up photos, messages and files first. Follow our step-by-step guide on how to factory reset Android, and when you restore, add apps back from the official store only, so you do not reinstall the culprit.

After removal: a quick health check

Once the suspect app is gone, confirm the phone is actually back to normal before you relax. Restart it and use it for a day, watching the same signals that tipped you off: battery life, data usage, and whether any pop-ups return. Open Settings and review your data usage by app to make sure nothing is still sending data in the background. Check your installed-app list once more for anything you missed, and look again at device-admin apps and accessibility services to be sure nothing re-enabled itself. If you entered any passwords while the bad app was present, change them, starting with your most important accounts.

Myths worth dropping

A few beliefs cause more harm than the malware itself. “Cleaner” and “booster” apps do not remove infections and often add ads of their own. A single antivirus app is not a magic shield; your habits matter far more. And a phone is not “infected” just because it is slow, since age, storage pressure and heavy apps explain most slowdowns. Focus on the specific app causing trouble, keep your software updated, and you have handled the real risk.

Stop it coming back

Most Android malware arrives the same way: apps installed from outside the official store, links in spam messages, or “you have won” pop-ups. Reduce your risk by installing apps only from trusted sources, keeping Android and your apps updated, reviewing permissions before you accept them, and leaving Play Protect switched on. Because malware often targets the account tied to your phone, it is also worth taking a moment to secure your Google account and turning on a second verification step so a stolen password alone cannot be used. Before installing anything, pause on the permissions it requests: a wallpaper app that wants to read your messages, or a game that asks for accessibility access, is a warning sign well worth heeding. For more walkthroughs like this one, see our mobile security guides.