How to Remove Malware from Android (8 Steps, Factory Reset Last)

Quick answer: Most Android malware comes off without a factory reset. Reboot into Safe Mode so third-party apps stop running, find the app that arrived when the trouble started, strip the permissions that let it resist removal (device admin, Accessibility, display over other apps), uninstall it, clean your browser, then run Google Play Protect and a reputable scanner from the Play Store. Change the passwords you typed while it was running. Keep the factory reset for the end, and read the note on cheap phones whose malware ships in the firmware before you rely on it.

Android malware is rarely a dramatic “virus”. Most of it is adware, fake utility apps and aggressive ad SDKs that arrive through apps installed outside the Play Store, cracked APKs or a link in a text message. The nastier minority are banking trojans that ask for the Accessibility permission so they can read your screen and type for you. Both kinds are removed the same way, because Android gives you two tools a PC does not: a boot mode that disables every app you installed, and permission screens that show exactly what each app was allowed to do.

60-second triage: which case are you in?

Signs your Android may be infected

• Pop-up ads appear outside any app, on the home screen or lock screen, or full-screen ads open with no obvious source.
• The browser keeps redirecting to pages you didn’t ask for, or your homepage or search engine changed by itself.
• Battery drains and mobile data usage spike with no change in how you use the phone.
• Apps you don’t remember installing appear in the app drawer, sometimes with blank or generic icons.
• An app asked for Accessibility access or to become a device administrator right after you installed it.
• Your bank or Google sends login codes or “new sign-in” alerts you didn’t trigger, or text messages leave your phone that you never wrote.
• An app keeps reappearing after you delete it.

Any one of these can be innocent. Several together usually mean an adware or malicious app is running. If you mostly have the battery-and-heat symptoms, read Is my phone hacked? first, because those two are the least diagnostic of the lot.

Step 1 - Restart in Safe Mode

Safe Mode boots Android with only the apps that shipped with the phone. Everything you installed is temporarily disabled, so malware cannot block the Settings app, redraw the screen over it, or reinstall itself while you work.

1. Press and hold the power button (on recent Samsung and Pixel phones, press power + volume down together, because a short press of power alone opens the assistant).
2. Touch and hold “Power off” until a “Reboot to safe mode” prompt appears, then confirm.
3. The phone restarts with “Safe mode” shown in a corner of the screen.

If the pop-ups and slowdowns stop in Safe Mode, a downloaded app is almost certainly the cause. Safe Mode deletes nothing: when you are done, a normal restart brings every app back, which is why you uninstall the culprit before leaving it.

Step 2 - Find the app that did it

Guessing wastes time. Android keeps three lists that point at the culprit.

• Recently installed. Open Settings → Apps → See all apps. On most phones the overflow menu (⋮) offers to sort or filter by install time. Anything installed in the days before the trouble began goes to the top of your suspect list.
• Battery and data. Settings → Battery → Battery usage and Settings → Network & internet (Samsung: Connections) → Data usage rank apps by consumption. An app you never open sitting near the top is a strong signal.
• Who is allowed to install apps. Settings → Apps → Special app access → Install unknown apps lists every app you once allowed to install other apps. A file manager, a messaging app or a “downloader” with that switch turned on is how the malware got in, and it may install the next payload. Turn the switch off for everything that doesn’t strictly need it.

Fake “cleaner”, “battery saver”, “QR scanner”, “flashlight”, “system update” and “Chrome update” apps are the usual disguises. If you are unsure about a name, search it from another device before removing it.

Step 3 - Uninstall suspicious apps

Still in Safe Mode, open Settings → Apps, tap the suspect app, then Uninstall. Work through your suspect list one app at a time. If the Uninstall button is greyed out or the app reappears, go to Step 4; that is what Step 4 is for.

Step 4 - Can’t uninstall it? Strip the permissions it hides behind

Malware survives removal by holding one or more of four permissions. Take them away in this order, then go back to Settings → Apps and uninstall.

1. Device administrator. Open Settings, search for Device admin apps (often under Security → More security settings). Turn off the toggle next to the suspect app. This is the classic trick that greys out the Uninstall button.
2. Accessibility. Open Settings → Accessibility and look under Downloaded apps (Samsung: Installed apps). An app with an Accessibility service switched on can read everything on your screen, tap buttons and fill in fields, which is exactly how banking trojans such as Rokarolla defeat your bank app. Turn off every service you don’t recognise.
3. Display over other apps. Settings → Apps → Special app access → Display over other apps. This is what lets a fake login screen appear on top of the real one. Revoke it for anything you didn’t knowingly grant.
4. Notification access. Settings → Apps → Special app access → Notification access (or Device & app notifications). An app here can read your SMS verification codes as they arrive. Switch off unknown entries.

Since Android 13, apps installed from outside an app store are blocked from the Accessibility and notification-access screens by a feature called Restricted settings: the toggles are simply greyed out until you open the app’s info page and choose “Allow restricted settings” from its menu. Malware therefore walks you through doing exactly that with on-screen instructions. If you remember following such instructions, you have found your app.

Step 5 - Clean up your browser

Adware often lives in the browser rather than in a separate app, and a website you once tapped “Allow” on can spam notifications that look like system alerts. In Chrome (or whichever browser you use):

• Open Settings → Site settings → Notifications and block every site you don’t recognise. This single screen fixes most “virus warning” pop-ups on Android.
• Clear cache and cookies (Settings → Privacy and security → Clear browsing data).
• Reset your homepage and default search engine if they changed.
• Check Settings → Apps → Default apps → Browser app: adware sometimes installs its own browser and sets it as the default, so links open there.

Step 6 - Run Google Play Protect and a reputable scanner

Reboot normally, then let Android’s built-in scanner do a pass:

1. Open the Google Play Store, tap your profile icon, and choose Play Protect.
2. Tap Scan. Play Protect checks installed apps, including sideloaded ones, and offers to disable or remove what it flags. Turn on “Scan apps with Play Protect” and “Improve harmful app detection” so it also sends unknown sideloaded apps to Google for analysis. On Pixel phones running Android 15 and later, Play Protect’s live threat detection also watches how installed apps behave, not just what they contain.

For a second opinion, install a well-known anti-malware app from the Play Store only, such as Malwarebytes or Bitdefender, run a full scan, and remove whatever it flags. Stick to names you already know: a search for “antivirus” in any app store returns dozens of apps that are themselves adware.

Step 7 - Lock down the accounts the malware could reach

Removing the app does not undo what it saw. Do this from the cleaned phone or, better, from a computer:

• Change your Google account password and run the Google Security Checkup: sign out unknown devices, remove third-party apps you don’t recognise under “Third-party access”, and check that the recovery phone and email are yours.
• Change every password you typed on the phone while the malware was active, starting with banking, email and any account that receives SMS codes. Turn on two-step verification with an authenticator app rather than SMS where the service allows it.
• Check your bank. If a banking app behaved oddly or you received verification codes you didn’t request, call the bank, review recent transactions and ask whether a new device or payee was registered.
• Look at message forwarding. In your SMS app and in your email account, check that no forwarding rule or linked device was added. Forwarding survives any amount of phone cleaning, which is why it is where persistent attackers put it.

Step 8 - Last resort: back up, then factory reset

If pop-ups keep returning, an app reinstalls itself, or scans keep flagging the same threat, a factory reset wipes the phone back to a clean state.

• First back up photos, contacts and important files to your Google account or a computer. Do not restore a backup that includes the infected app.
• Then go to Settings → System → Reset options → Erase all data (factory reset) (Samsung: Settings → General management → Reset → Factory data reset).
• When setting the phone up again, reinstall apps one at a time from the Play Store. Skip the “restore all apps” option, which would bring the malware straight back.

One honest warning. A factory reset erases the data partition, not the system partition. On some cheap, no-name Android phones and TV boxes, malware has been found preinstalled in the firmware itself; Google’s own security team documented the Triada family doing exactly this in 2019. Such an infection returns after a reset because the reset never touched it. If a phone shows the same symptoms immediately after a clean reset with no apps installed, the fix is a firmware update from the manufacturer or, realistically, a different phone.

How to stop it coming back

FAQ

Does Android need an antivirus app? Not necessarily. Google Play Protect is built in and scans apps automatically. A reputable on-demand scanner from the Play Store is a useful second opinion if you side-load apps or already suspect an infection. See do I need antivirus? for the longer answer.

Does Safe Mode delete anything? No. Safe Mode only stops third-party apps from running for that session. Your apps and data are untouched, and a normal restart brings everything back, including the malware if you did not uninstall it.

How do I know which app is causing the pop-ups? Check what was installed just before the trouble started, which apps top the battery and data usage lists, and which apps hold Accessibility or display-over-other-apps rights. An app that appears on two of those lists and that you don’t remember installing is your culprit.

Will a factory reset remove all malware? A factory reset removes every app and all data you installed, which clears the vast majority of Android malware. The exceptions are malware preinstalled in the firmware of some cheap devices, and malware you bring back yourself by restoring a full app backup. Reinstall apps individually from the Play Store.

Can I get malware just from visiting a website? A website cannot silently install an app on an up-to-date Android phone, but it can show fake “your phone is infected” pop-ups, push notifications disguised as system alerts, or trick you into downloading an APK. Don’t install anything a web page pushes you to download, and block the site’s notifications in your browser.

Why is the Uninstall button greyed out? The app has been granted device administrator rights. Revoke them under Settings → Device admin apps, then uninstall normally. If the toggle itself resists, do it from Safe Mode.

Related reading: Rokarolla · Is My Phone Hacked? The Signs That Mean Something, and the Ones That Do Not · How to Remove a Virus from iPhone