You can remove a virus from your Android phone by taking three immediate steps: boot into Safe Mode, uninstall the suspicious apps, and run a full malware scan with a trusted security app. If the infection persists, you’ll get the clearest resolution by backing up your data and performing a factory reset. This guide shows exactly which checks to run and when to escalate so your phone is clean without guesswork.
![Norton 360 Deluxe 2027 Antivirus, 5 Devices, Auto-Renews [Download]](https://m.media-amazon.com/images/I/41IYV5zGyCL._SL500_.jpg)
As an Amazon Associate I earn from qualifying purchases.
Remove a virus from your Android phone by booting into Safe Mode, uninstalling any suspicious apps, then running a trusted security scan (like Play Protect) and updating Android/Play services. If you still get pop-ups, see battery drain, or the phone won’t behave normally—especially after removing apps—you may need a factory reset.
This guide is for when your Android shows common signs like repeated pop-ups, unknown app installations, strange charges/battery drain, or settings changing by themselves. It’s also useful when you don’t know which app caused the problem and need a safe, step-by-step way to narrow it down.
Do this right away to limit damage
If your Android phone is actively compromised, the fastest way to reduce harm is to cut off internet access first and start protecting accounts immediately. This prevents malware from downloading extra payloads, contacting command-and-control servers, or re-installing itself while you work.
Disconnecting your Android from Wi‑Fi/mobile data helps stop suspicious downloads and reduces the ability of malicious apps to communicate externally.
If you suspect account compromise, changing passwords from a trusted device reduces the risk of ongoing unauthorized access.
Tracking the timing and app names of pop-ups makes it easier to identify which app is triggering them during later uninstall steps.
- Disconnect from Wi‑Fi/mobile data to stop suspicious downloads and pop-ups.
- If you can, change your important passwords (email, banking, social) from a trusted device.
- Note down anything unusual (app names, the timing of pop-ups) so you can target the right app later.
A practical way to “triage” an Android malware situation is to think in two tracks: containment (stop the malicious behavior right now) and attribution (figure out what app permission path is being abused). I also recommend writing down the exact moment the issue appears (for example, “pop-up every time I open Chrome at 7:10 PM”). That detail is often the only clue you’ll have when multiple suspicious apps look similar.
Also, if your Android phone is showing “strange charges,” don’t assume it’s a virus—billing issues can also come from adware, fraudulent apps, or compromised accounts. Your immediate containment steps still apply because they prevent further app behavior while you verify what changed.
Boot into Safe Mode and uninstall suspicious apps
Booting into Safe Mode is the quickest way to confirm whether a malicious app is running, because it disables most third-party apps. If symptoms stop in Safe Mode, you can focus your effort on uninstalling the app(s) most likely to be responsible.
Safe Mode on Android prevents most third-party apps from running, which can help determine whether the issue is caused by an installed app.
Uninstalling recently installed or unfamiliar apps is a direct way to remove app-based malware and adware.
Restarting back to Normal Mode after uninstall helps confirm whether the symptoms were resolved by removing that app.
- Restart your phone into Safe Mode (this prevents most third-party apps from running).
- Go to Settings > Apps and look for recently installed or unfamiliar apps—then uninstall them.
- After uninstalling, restart normally and check whether the symptoms disappear.
What “Safe Mode” confirms (and what it doesn’t)
Safe Mode is highly useful for Android malware cleanup because it narrows the suspect list: if the pop-ups, redirects, or battery drain stop, your problem is almost certainly tied to a third-party app. If symptoms continue in Safe Mode, it may mean one of these situations:
- The behavior is coming from a system-level component you can’t remove normally.
- The cause is tied to an account change (for example, a compromised email or password).
- The issue is coming from something you can’t easily isolate using Safe Mode (for example, server-driven push spam).
From my experience troubleshooting Android devices for security-adjacent issues, the most common “false start” is uninstalling the *wrong* app—usually based on the pop-up branding rather than what you installed recently. That’s why pairing Safe Mode with recent installs/unfamiliar apps works best for Android phones: it reduces guessing.
If you can, compare:
- Apps installed the day the pop-ups started
- Apps you didn’t install (or where “install sources” were unusual)
- Apps that have unusual notification behavior
Use an evidence-based uninstall order
When you open Settings > Apps on your Android phone, start with the apps that match your notes:
- Unfamiliar apps added right before symptoms began
- Apps whose names resemble system tools but aren’t (for example, “Security,” “Cleaner,” or “Update” variants)
- Apps associated with notifications/ads rather than core functionality
Do this carefully: uninstall one suspect at a time if symptoms are frequent. That makes it easier to identify which uninstall actually fixed the problem.
Remove persistent access (device admin, accessibility, installs)
If malware has “staying power,” it often does so by enabling high-impact permissions like Device admin or Accessibility. Removing those permissions from the offending app is essential because simply uninstalling without revoking access can leave persistence or re-install paths behind.
Device administrator access can allow an app to override normal behavior, so removing unknown device admin apps is a key persistence countermeasure.
Accessibility services can be abused to display overlays, hijack interactions, or trigger unwanted actions, so disabling unrecognized accessibility permissions helps neutralize persistent threats.
Turning off “install unknown apps” blocks apps from installing additional packages from untrusted sources.
- Check Device admin apps (often under security settings). If an unknown app has admin access, remove it.
- Review Accessibility services and Notifications/access permissions for anything you don’t recognize, and disable it.
- Turn off “install unknown apps” if it’s enabled for any untrusted source (so the phone can’t keep installing threats).
Why device admin and accessibility are red flags on Android phones
On Android phones, persistence is often achieved through permissions that let an app keep controlling the device. Two of the most common are:
- Device admin: Used by legitimate tools like enterprise management—but also by malware to resist removal and enforce policies.
- Accessibility: Intended to help users with vision/mobility needs, but malicious apps can misuse it for overlays, click automation, or intercepting interaction patterns.
To fix this, check each location where persistence can hide:
1. Device admin apps: Remove admin access from anything you don’t explicitly recognize.
2. Accessibility services: Disable services you didn’t knowingly enable.
3. App installation permissions: Find which apps are allowed to install “unknown apps,” then revoke those permissions.
Pros/cons: focusing on permissions vs. doing a full reset
The best cleanup path depends on whether you’re fighting persistence or just a normal malicious install. Here’s a quick comparison for Android phones:
This is also where Android malware cleanup becomes more than “removal.” You’re preventing re-activation by eliminating the permissions that allow control to persist.
Update Android and run a reputable security scan
Updates and security scans close the loop after you remove suspicious apps, because they fix known vulnerabilities and detect remaining threats. On Android phones, this is especially important after you revoke persistence permissions—otherwise a threat can reappear through outdated components.
Updating Android and Google Play system components helps address known vulnerabilities that malware may exploit.
Play Protect scans apps and can remove or warn about harmful behavior before and after installation.
If an antivirus app is used, it should be installed from the Google Play Store and removal steps should follow the app’s guidance to avoid leaving behind a persistent permission.
- Update your Android system and Google Play services/security components (updates fix known vulnerabilities).
- Run Play Protect from the Play Store (or your phone’s built-in security option) and remove anything it flags.
- If you use an antivirus app, use one from the Google Play Store and follow its removal steps carefully.
What to update (and why it matters on Android phones)
After you’ve reduced active harm with Safe Mode and permission cleanup, updates help with the remaining “gray area”:
- Your Android security components may be outdated.
- Play services and app verification components may not have the latest protections.
- Even if the app is removed, the underlying exploit path (or cached behavior) may still be relevant until the system is current.
Google-aligned remediation actions (quick reference)
The table below summarizes common, documentation-aligned actions for Android phone malware cleanup.
Seven Common Steps for Android Phone Cleanup (Recommended Coverage)
| # | Action | Where on Android | Primary Goal | Expected Impact |
|---|---|---|---|---|
| 1 | Boot into Safe Mode | Power options | Stop most third‑party apps | ★★★★☆ |
| 2 | Uninstall suspicious apps | Settings > Apps | Remove offending packages | ★★★★☆ |
| 3 | Revoke Device admin access | Security/Device admin menu | Break persistence control | ★★★★☆ |
| 4 | Disable Accessibility services | Accessibility settings | Stop interaction hijacking | ★★★☆☆ |
| 5 | Turn off “install unknown apps” | Apps > Special access | Prevent re-install chains | ★★★☆☆ |
| 6 | Run Play Protect scan | Play Store > Play Protect | Detect/remediate known threats | ★★★★☆ |
| 7 | Change passwords after suspected compromise | From a trusted device | Stop account takeover | ★☆☆☆☆ |
Note: “Expected Impact” above reflects how directly each step removes or neutralizes app-based control on Android phones—not how important it is for account safety. Password changes are crucial if your email/banking may be compromised, but they don’t automatically remove the malicious app.
If it won’t clear: back up and factory reset
If Safe Mode, uninstalling, permission cleanup, and scans don’t stop the behavior, a factory reset is the most reliable way to wipe local malware persistence. It’s also the step that should be considered when symptoms return immediately after you remove likely culprits.
A factory reset (Erase all data) removes user data and installed apps from the Android device, returning it to a clean baseline.
If symptoms reappear after a reset, the problem may be tied to restoring the wrong app/data, or to account-side compromise.
Google’s troubleshooting guidance emphasizes updating and scanning after reset to ensure the device uses the latest security protections.
- Back up photos/contacts/files first (and avoid copying suspicious files or unusual app data).
- Do a factory reset: Settings > System > Reset options > Erase all data (factory reset).
- After the reset, reinstall only what you trust, and keep an eye on whether symptoms return (a reappearance often points to a specific app/account restore).
How to reduce the risk of “reset re-infection” on Android phones
A factory reset wipes the device, but it doesn’t magically fix everything connected to your life online. If your Android phone is compromised through accounts, your security work must continue after the reset:
- Be selective with what you restore from cloud backups.
- Don’t blindly re-install apps you don’t recognize, even if they “came back” from a backup.
- If you use a password manager, ensure it’s functioning normally from before the compromise window.
If your Android phone includes any managed profiles (work/school profiles), be cautious: those can reapply settings. Also, if “install unknown apps” or accessibility permissions are automatically restored, you may need to review settings immediately after reset.
What the reset does—and doesn’t—solve
A factory reset is effective against app-based malware installed on your Android phone, but it may not resolve:
- Compromised email/banking accounts that enable new logins
- SIM/number-side issues or carrier-level fraud (if charges are tied to messaging services)
- Hardware instability that mimics “malware-like” behavior
If your phone still misbehaves right after a factory reset, don’t assume you still have a virus. At that point, broader troubleshooting (accounts, SIM/carrier verification, hardware checks) becomes more important.
What can go wrong (and when to stop)
Sometimes the cleanup path fails because Android permission persistence is overlooked, or because the “cause” isn’t actually an app. If your Android phone shows signs of serious compromise—especially if you can’t log into banking/email—stop chasing app removal and prioritize account recovery.
If a malicious app enables Device admin or Accessibility, uninstalling alone may not fully stop its persistence—revoking those permissions first is often required.
Granting unusual permissions (Accessibility, device admin, “manage device”) to an untrusted app increases the chance of ongoing control on Android phones.
If the device still misbehaves after a factory reset, the issue may involve accounts, SIM/number-side behavior, or non-app factors, so professional assessment becomes appropriate.
- Uninstalling an app may not work if the app set itself as a device administrator or enabled accessibility—check those settings first.
- If you’re asked for unusual permissions (Accessibility, admin, “manage device”), don’t grant them “to test”—remove the app instead.
- If the phone still misbehaves right after a factory reset, the issue could be related to accounts, a SIM/number-side problem, or hardware quirks—stop and consider professional help.
- If you’re dealing with potential account compromise (banking/email), prioritize password changes and enabling 2FA over repeated reinstall attempts.
A realistic “stop rule”
On Android phones, repeated attempts to uninstall can create confusion if symptoms persist. I suggest setting a stop rule like:
- If you’ve removed suspicious apps in Safe Mode and revoked admin/accessibility and ran Play Protect, and you still see the same symptoms, move to the factory reset decision.
- If you suspect account compromise (locked out, “new sign-in from a new device,” unexpected password reset emails), shift priority to account recovery steps first.
That prevents you from losing time while the attacker still has access.
Best next steps checklist + FAQ + sources
Follow this order to maximize your chance of clearing Android malware without unnecessary data loss. Use the checklist first, then the FAQ if you hit a common edge case.
A practical Android cleanup sequence is containment first (disconnect internet), then isolation (Safe Mode), then removal (uninstall and revoke permissions), then verification (Play Protect), then reset if needed.
If symptoms return after a reset on Android phones, account restoration choices and re-installed apps are the most likely cause of recurrence.
Play Protect and Android security component updates help close gaps left by incomplete uninstall or outdated system security on Android devices.
Quick scan checklist (save this)
| Step | What to do | What you’re looking for |
|---|---|---|
| 1 | Disconnect internet | Pop-ups stop / fewer downloads |
| 2 | Safe Mode | Suspicious behavior stops |
| 3 | Uninstall unknown apps | Remove recent/unfamiliar apps |
| 4 | Remove admin/accessibility | No unknown “Device admin” or Accessibility enabled |
| 5 | Update + Play Protect scan | Threats found/removed |
| 6 | Factory reset (if needed) | Clean start without recurring symptoms |
Verdict / tip
Start with Safe Mode + uninstall, then fix device admin/accessibility persistence, and only then move to updates + Play Protect. A factory reset is the most effective “last step,” but it wipes data—so back up first and be sure you’re not just chasing a harmless app/notification.
Skip this self-removal approach (and get help) if you suspect serious compromise (banking/email locked out, ransomware-like behavior, repeated re-infections immediately after a reset).
Frequently Asked Questions
How do I remove a virus from my Android phone?
Start by turning off the device’s internet connection (Wi‑Fi and mobile data) to stop the malware from communicating. Then boot into Safe Mode to identify and uninstall suspicious apps, and run a full scan with a reputable antivirus app from the Google Play Store. After that, update Android and apps to patch security vulnerabilities, and check for unusual admin permissions or accessibility services. If the issue persists, the safest option is to back up your data and perform a factory reset.
What is the best way to check if my Android has a virus?
Look for common signs like frequent pop-ups, unexpected battery drain, overheating, sudden ads in the notification bar, or apps you didn’t install. Check your installed apps list for anything unfamiliar, and review permissions for notifications, device admin, accessibility, and “Install unknown apps.” You can also run an on-demand scan using trusted Android antivirus software to confirm whether a threat is detected.
How can I remove malware if I can’t uninstall the suspicious app?
Many malware packages hide by using Device Administrator or Accessibility permissions, so you must revoke those first. Go to Settings → Security/Privacy (or Security) → Device admin apps and disable the app, then remove it from Settings → Apps. If you still can’t uninstall, boot into Safe Mode, which prevents most third-party apps from running, and try uninstalling again. As a last resort, back up important files and use a factory reset to fully remove the infection.
Why do I keep getting pop-ups or redirects even after installing an antivirus?
Some Android viruses and adware are browser-related or persist through a malicious app that keeps rerouting traffic. Recheck your default browser, search engine, and installed browser extensions, and remove any apps with suspicious permissions. Clear your browser’s cache and site data, and review notifications and “draw over other apps” permissions for any unfamiliar apps. If the redirects continue, a factory reset may be necessary, especially if antivirus scans can’t resolve the behavior.
Which Android settings should I change to prevent future virus infections?
Keep your Android OS and apps updated, since updates often include security patches for known vulnerabilities. Only install apps from the Google Play Store, disable “Install unknown apps,” and regularly review app permissions for notifications, accessibility, and device admin access. Turn off risky features like SMS-based permissions for unknown apps and avoid clicking suspicious links from pop-ups or ads. Finally, use Google Play Protect and a reputable mobile security app to monitor installs and run periodic scans.
📅 Last Updated: October 15, 2026 | Topic: how do i remove virus from android phone | Content verified for accuracy and freshness.
References
- Improve your app's security | Security | Android Developers
- Android (operating system)
- Malware
- https://www.ncsc.gov.uk/guidance/malware
- Safe mode
- https://scholar.google.com/scholar?q=how+to+remove+malware+from+android+phone Google Scholar
- https://scholar.google.com/scholar?q=android+malware+removal+factory+reset+safe+mode Google Scholar
- https://scholar.google.com/scholar?q=google+play+protect+harmful+apps+scan+remove Google Scholar