How to Remove a Virus From an Android Phone

If your phone is suddenly full of ads, opening strange websites or draining its battery for no reason, you may need to remove a virus from your Android phone. The good news is that what people call an Android virus is almost always a harmful app or a website that has been allowed to send notifications. Both can be removed for free in about 15 minutes, and you rarely need to erase the phone.

This is an independent guide. Menu names below are from Google Pixel and Samsung Galaxy phones running a current version of Android; other makers use similar wording. If a step looks different on your phone, use the search box at the top of the Settings app.

Signs your Android phone may have malware

Look for one or more of these:

• Full-screen ads that appear on the home screen or over other apps, not just inside one app.
• Apps you do not remember installing, sometimes with no name or a blank icon.
• The browser keeps opening pages you did not ask for, or the search engine has changed.
• The battery drains much faster than usual, or the phone runs hot while you are not using it.
• Mobile data use or your phone bill has jumped, or you see charges for premium text messages.
• Friends say they received odd messages from you.

A slow phone on its own is not proof of malware. Storage that is nearly full or an old battery cause the same symptoms, so also read how to speed up a slow phone and how to free up space on Android.

Step 1: Run a Google Play Protect scan

Play Protect is Google’s built-in malware scanner on phones that have the Play Store.

1. Open the Play Store app.
2. Tap your profile picture at the top right.
3. Tap Play Protect, then tap Scan.
4. If it lists a harmful app, tap Uninstall.

While you are there, open the settings gear on the Play Protect screen and make sure Scan apps with Play Protect is switched on.

Step 2: Restart the phone in safe mode

Safe mode starts Android with only the apps that came with the phone. If the ads stop in safe mode, a downloaded app is to blame.

• Pixel and most Android phones: press and hold the power button (on some Pixels, power and volume up together), then touch and hold Power off or Restart until Reboot to safe mode appears. Tap OK.
• Samsung Galaxy: open the power menu, then touch and hold Power off until the Safe mode icon appears, and tap it.

You will see Safe mode at the bottom of the screen. To leave it, simply restart the phone normally.

Step 3: Uninstall the harmful apps

While in safe mode:

1. Open Settings > Apps > See all apps (on Samsung, Settings > Apps).
2. Scroll the list slowly. Look for anything you do not recognise, apps with generic names such as “System Update”, “Cleaner”, “Battery Booster” or “Flashlight”, and apps installed around the day the trouble began.
3. Tap the app and choose Uninstall.

If you are not sure what an app is, search its exact name on another device before removing it. Do not remove apps whose name includes Google, Android System, or your phone maker unless a scan flagged them.

When the Uninstall button is greyed out

Some malware gives itself device admin rights so it cannot be removed. Take those rights away first:

• Pixel: Settings > Security & privacy > More security & privacy > Device admin apps.
• Samsung: Settings > Security and privacy > Other security settings > Device admin apps.

Switch off the suspicious app, confirm, then go back and uninstall it. Find My Device and work email apps legitimately appear here too; leave those on.

Step 4: Stop fake virus pop-ups from websites

Many “Your phone is infected” warnings come from a website you once allowed to send notifications. They look like system alerts but are just adverts, often pushing a fake cleaner app or a phone number to call.

1. Open Chrome and tap the three dots > Settings > Notifications.
2. Turn off every site you do not recognise or trust.
3. Then go to Settings > Privacy and security > Delete browsing data, choose All time, tick cookies and cached images, and delete.

Our guide to stopping website notifications covers other browsers, and removing fake antivirus scareware explains why you should never install what these pop-ups advertise.

Step 5: Update Android and check app permissions

Install updates in Settings > System > Software updates (Samsung: Settings > Software update). Then open Settings > Security & privacy > Privacy > Permission manager and review which apps can use SMS, accessibility, contacts and location. An unknown app with accessibility access is a red flag: switch that access off and remove the app.

Step 6: Secure your accounts

If you think malware had access to the phone, change the passwords for your Google account, email, banking apps and social media, ideally from a different device you trust. Turn on two-factor authentication and use a password manager so every password is unique. If an account has already been taken over, follow how to recover and secure a hacked account, and check your bank and phone bill for charges you did not make.

Step 7: Factory reset as a last resort

If ads or redirects come back after all the steps above, a factory reset will remove them.

1. Back up photos, contacts and files to your Google account or a computer. Our back up and wipe a phone guide shows how.
2. Pixel: Settings > System > Reset options > Erase all data (factory reset). Samsung: Settings > General management > Reset > Factory data reset.
3. After the reset, sign in and reinstall apps one at a time from the Play Store. Skip anything you did not need.

How to avoid Android malware in future

• Install apps only from the Google Play Store or your phone maker’s store, and leave Install unknown apps switched off for every app.
• Read reviews and the developer name before installing, and be wary of apps that ask for accessibility or SMS access without a clear reason.
• Never install an app because a pop-up, text message or caller told you to.
• Keep Android and your apps updated, and keep Play Protect switched on.

If a stranger offers to fix your phone remotely or asks you to install a screen-sharing app, stop: that is a common scam pattern. For hardware faults or a phone that will not start, use your phone maker’s own support site or a local repair shop.