How to Remove a Virus From an Android Phone (2026 Guide)

Is your Android phone showing strange pop-ups, opening websites by itself, overheating unexpectedly, or running unfamiliar apps? You might be wondering whether your phone has a virus.

The good news is that many of these problems can be fixed without replacing your phone or immediately performing a factory reset. The important thing is to identify the cause before deleting apps or changing settings randomly.

Android malware can take different forms, including malicious apps, spyware, adware, banking trojans, and information-stealing software. Some threats display unwanted advertisements, while others may attempt to steal passwords, access sensitive information, or trick you into approving dangerous permissions.

In this guide, you’ll learn how to check your Android phone for malware, remove suspicious apps, stop unwanted pop-ups, secure your accounts, and determine when a factory reset may be necessary.

What Are the Signs of Malware on an Android Phone?

No single symptom proves that your phone is infected. Battery problems, overheating, and slow performance can also result from ordinary apps, an aging battery, or software bugs.

However, investigate further if you notice several of these signs together:

• Unwanted advertisements: Pop-ups appear even when you aren’t browsing a website.
• Unexpected browser redirects: Your browser repeatedly opens unfamiliar pages.
• Unknown apps: Applications appear that you don’t remember installing.
• Suspicious permissions: An unfamiliar app has access to SMS, Accessibility, notifications, or other sensitive functions.
• Unusual data usage: An app consumes significantly more mobile data than expected.
• Unexpected account activity: You receive login alerts, password-reset messages, or transaction notifications you didn’t initiate.
• Persistent performance problems: Your phone becomes unusually slow or crashes repeatedly without an obvious explanation.

Battery drain or overheating alone is not enough to conclude that malware is present. Look for specific evidence, such as an unfamiliar app, a suspicious permission, or unauthorized account activity.

Step 1: Disconnect From the Internet if You Suspect Active Malware

If you believe a malicious app is actively stealing information or communicating with a suspicious server, temporarily disconnect your phone from the internet.

1. Turn on Airplane mode.
2. Check whether Wi-Fi is also disabled, and turn it off if necessary.
3. Avoid logging into sensitive accounts or entering passwords on the suspected device.
4. If you suspect financial fraud, contact your bank using another trusted device.

Disconnecting may interrupt some malicious activity, but it does not remove the malware itself.

If the phone is behaving normally and you only see ordinary browser advertisements, you may not need to disconnect it. Start by identifying where those advertisements originate.

Step 2: Run Google Play Protect

Google Play Protect is Android’s built-in app security service. It checks apps for potentially harmful behavior and can warn you about certain threats.

How to scan your Android phone

1. Open the Google Play Store.
2. Tap your profile picture.
3. Select Play Protect.
4. Tap Scan.
5. Review any warnings and follow the recommended action.

Menu labels may vary slightly depending on your Android version.

Keep Play Protect enabled. It can help detect known threats, but a clean scan does not guarantee that your phone is malware-free.

If you installed an APK from an unfamiliar website, paid for a fake security app, or granted an unknown app powerful permissions, continue with the following steps even if the scan finds nothing.

Step 3: Uninstall Suspicious Apps

One of the most common places to investigate is the list of installed applications.

Look for apps you don’t recognize, particularly ones installed shortly before the problem started. Check the developer, installation source, permissions, and whether the app has a legitimate purpose.

How to uninstall an app

1. Open Settings.
2. Select Apps or Applications.
3. Open the list of installed apps.
4. Select the suspicious application.
5. Tap Uninstall, if available.

On some phones, you can also press and hold an app icon and choose Uninstall.

Be careful not to remove essential system components simply because their names look unfamiliar. Search for the app’s exact name and verify what it does before removing it.

If the app refuses to uninstall, proceed to the next step.

Step 4: Check Device Administrator and Accessibility Permissions

Some malicious apps try to make removal more difficult by requesting powerful permissions.

Two important areas to inspect are Device Administrator access and Accessibility access.

Check Device Administrator access

Search Settings for Device admin apps, Device administrators, or a similarly named option.

Review the applications listed there. If an unfamiliar app has administrator privileges, investigate it carefully.

If it is clearly unwanted, revoke its administrator access before attempting to uninstall it. The exact menu varies between Android manufacturers.

Don’t disable a legitimate work-management, device-security, or system application without understanding its purpose.

Check Accessibility access

Accessibility services can help people interact with their devices, but they can also be abused by malicious apps.

1. Open Settings.
2. Search for Accessibility.
3. Open the installed or downloaded apps and services section.
4. Review which applications have permission to use Accessibility.
5. Disable access for an app you have verified is suspicious.

Also review other sensitive permissions, especially notification access, SMS, contacts, microphone, camera, and the ability to install unknown apps.

Important: An app having a sensitive permission does not automatically make it malicious. The concern is an unnecessary permission granted to an app you don’t trust.

Step 5: Use Safe Mode if You Cannot Remove the App

Safe Mode starts Android with most third-party apps disabled. It can help you determine whether an installed application is causing a problem.

The steps to enter Safe Mode vary by manufacturer and model. On many Android phones, you can open the power menu, press and hold the Power off option, and select Safe Mode. Other devices use a different button sequence.

Once in Safe Mode:

1. Open Settings.
2. Go to Apps.
3. Find the suspicious third-party application.
4. Try uninstalling it.
5. Restart normally when finished.

If the symptoms disappear in Safe Mode, a third-party app may be responsible, although this is not definitive proof.

If the suspicious app had Device Administrator access, revoke that access first if necessary. Safe Mode does not automatically remove malware, and not every malicious app can be removed this way.

Step 6: Stop Fake Virus Alerts and Browser Pop-Ups

Sometimes the problem isn’t an infected phone at all. It may be a website that has been allowed to send notifications or display deceptive warnings.

Messages such as these are common scare tactics:

• “Your phone has 13 viruses!”
• “Your Android security is at risk!”
• “Install this cleaner immediately!”
• “Your personal files will be deleted!”

A website cannot reliably diagnose your entire phone just by showing a pop-up in your browser.

If the alerts appear in Chrome

1. Open Chrome.
2. Tap the three-dot menu and select Settings.
3. Open Site settings.
4. Select Notifications.
5. Remove or block unfamiliar websites that are sending unwanted alerts.

You can also open Site settings → Pop-ups and redirects and make sure unwanted pop-ups are blocked.

Menu names may differ across Chrome versions.

If the problem continues, review your browser’s recent downloads and remove suspicious files you knowingly downloaded. Clear browsing data if appropriate, but understand that clearing browser data does not remove an infected app.

Never install an application just because a pop-up claims your device is infected.

Step 7: Update Android and Your Apps

Security updates fix vulnerabilities that attackers may exploit.

Check for updates to:

• Android system software.
• Google Play system updates, where available.
• Google Play services and other system components through their supported update mechanisms.
• Applications installed from trusted sources.

To check for Android updates, open Settings and search for Software update or System update.

Install available security updates and restart your phone if required.

If your device no longer receives security updates, consider whether it is time to move to a supported device, particularly if you use it for banking, work, or sensitive accounts.

Step 8: Secure Your Passwords and Online Accounts

Removing a suspicious app is only one part of the response. If malware accessed your accounts before you discovered it, those accounts may still be at risk.

Use another trusted device if you believe the Android phone is actively compromised.

Start with your primary email account, because it may be used to reset passwords for other services.

1. Change exposed or reused passwords.
2. Enable two-factor authentication or passkeys where supported.
3. Review recent sign-in activity.
4. Sign out unfamiliar sessions and remove unknown devices.
5. Check account recovery details and connected applications.
6. Review financial transactions and payment activity.

If you entered banking credentials, UPI PINs, card information, or verification codes into a suspicious app or website, contact your bank promptly through an official channel.

Never share an OTP, UPI PIN, or banking password with someone who contacts you claiming to be technical support.

Step 9: Check for Signs of Financial or Identity Theft

Some Android malware is designed to steal financial information or intercept sensitive communications.

If you suspect this type of activity, don’t limit your response to deleting the app.

Check for:

• Unauthorized bank transactions.
• Unfamiliar UPI activity or payment requests.
• Unexpected password-reset messages.
• New devices connected to your accounts.
• Unauthorized SIM or account changes.
• Suspicious messages sent from your phone number or social accounts.

Preserve relevant evidence, such as suspicious app names, screenshots, transaction references, and security alerts.

In India, if you suspect cyber financial fraud, contact your bank immediately and report it through the official National Cyber Crime Reporting Portal at https://cybercrime.gov.in/ or call 1930 for financial cyber fraud assistance. Report promptly, as time can matter when attempting to limit financial loss.

Step 10: When Should You Factory Reset Your Android Phone?

A factory reset removes personal data and installed applications from the device, returning it to its initial setup state. It can be useful when a serious malware problem persists and other removal steps have failed.

However, it should not be the first response to every pop-up or battery problem.

Consider a reset if:

• A confirmed malicious app cannot be removed.
• Suspicious behavior persists after removing the responsible apps.
• You have strong evidence of a serious compromise.
• A trusted security professional recommends it after assessing the device.

Before resetting your phone

1. Back up important photos, documents, and contacts.
2. Avoid backing up suspicious APKs or unknown applications.
3. Make sure you know the Google Account credentials needed to set up the phone again.
4. Secure your important online accounts from a trusted device.
5. Record any evidence you may need for a fraud or security report.

Then use your phone’s Settings to find Factory data reset. The exact location depends on the manufacturer and Android version.

After the reset, install system updates and reinstall applications from trusted sources. Avoid restoring every application automatically if you suspect one of them caused the infection.

A normal factory reset may not resolve every possible compromise, especially if the operating system itself has been tampered with or the device has been rooted. If strong evidence of a persistent compromise remains, seek help from the manufacturer or a qualified security professional.

What You Should NOT Do

When people suspect malware, they sometimes make the situation worse by following unreliable advice.

Avoid these mistakes:

Don’t install random antivirus APKs. A website claiming to clean your phone may itself distribute unwanted software.

Don’t pay someone who promises to remove a virus remotely without evidence. Fake technical-support services can exploit your fear.

Don’t grant Accessibility or administrator access to an unknown cleaner. These permissions can give an app substantial control over the device.

Don’t assume overheating means hacking. Gaming, background synchronization, poor signal, and battery degradation can all cause heat.

Don’t ignore account alerts. If a suspicious app was present, review your accounts even after uninstalling it.

Don’t root your phone to remove malware unless you understand the consequences. Rooting can weaken security and make troubleshooting more complicated.

How to Prevent Android Malware in the Future

You don’t need to be a cybersecurity expert to reduce your risk.

• Install apps from Google Play or another source you can independently verify.
• Keep Google Play Protect enabled.
• Review permissions when installing apps and periodically afterward.
• Avoid cracked applications, modified APKs, and suspicious game cheats.
• Keep Android and applications updated.
• Use a screen lock and secure your Google Account.
• Avoid opening unexpected links or installing apps recommended by strangers.
• Use unique passwords and multi-factor authentication.
• Review account activity after a suspected compromise.
• Back up important files regularly.

If you experiment with security tools or APKs, use a dedicated test device or an appropriate isolated environment rather than your primary phone containing banking apps, personal messages, and sensitive accounts.

Frequently Asked Questions

Can an Android phone get a virus?

Yes. Although people often use the word “virus” for any malicious software, Android threats include trojans, spyware, adware, and other potentially unwanted applications. The method of infection and the appropriate response depend on the specific threat.

Can I remove malware without a factory reset?

Often, yes. Removing a malicious app, revoking its sensitive permissions, updating Android, and securing your accounts may be enough. A factory reset becomes more relevant when a serious problem persists or the device is confirmed to be compromised.

Does Google Play Protect remove every virus?

No. Play Protect can detect and warn about many harmful applications, but no single security tool detects every threat. A clean scan should be combined with checking installed apps, permissions, account activity, and other evidence.

Why does my phone show virus warnings when I open a website?

The warning may be a deceptive website advertisement or browser notification rather than a genuine system alert. Close the page, revoke notification permissions for the suspicious website, and avoid downloading anything it recommends.

Can malware steal my passwords?

Some malicious apps can attempt to steal credentials through phishing screens, abusive Accessibility permissions, keylogging techniques, or other methods. The actual risk depends on the app’s capabilities and the permissions or access it obtained.

Should I install multiple antivirus apps?

Usually, there is no need to install multiple security apps. Start with Google Play Protect, keep the system updated, and use a reputable additional security product only if it meets your needs and comes from a trusted source.

Final Thoughts

A suspicious Android phone does not automatically mean you’ve been hacked. The right approach is to investigate the symptoms, identify suspicious applications or permissions, and take action based on evidence.

Start with Google Play Protect, inspect installed apps, review Accessibility and administrator permissions, and check whether the problem is simply caused by browser notifications.

If you find credible signs of compromise, secure your important accounts and take additional steps based on what may have been exposed. A factory reset can help in serious cases, but it should be a considered step rather than an automatic reaction.

Think Like a Hacker. Defend Like a Pro. Learn to recognize the warning signs, verify the evidence, and fix the underlying problem instead of trusting frightening pop-ups.