Is your phone suddenly showing ads on the home screen, opening strange websites by itself, or getting hot when you are not using it? These are common signs that a bad app — often installed by accident from outside the Play Store — has got into your phone. The good news is that most Android malware is just a badly behaved app, and you can remove it yourself in about fifteen minutes. Follow the steps in order, and do not pay for any 'virus removal' service or app along the way.

1. Signs your phone may have malware

Watch for these warning signs:

  • Pop-up ads appearing on your home screen or over other apps
  • Apps in your app list that you do not remember installing
  • Battery draining much faster than before, or the phone feeling warm when idle
  • Mobile data finishing quickly without heavy use
  • Your browser opening unknown pages, or your home page changing by itself
  • Friends receiving strange messages from your accounts

One sign alone can have an innocent cause, but two or three together usually mean a bad app is present.

2. Run a Google Play Protect scan

Your phone already has a free built-in scanner, so start there. Open the Play Store, tap your profile picture, and tap Play Protect. Tap Scan and wait for it to finish checking your apps. If it reports a harmful app, follow its advice to uninstall it right away. While you are there, tap the settings gear on the Play Protect page and make sure both scanning options are switched on, so your phone keeps checking apps in the future, including ones installed from outside the Play Store.

3. Delete the suspicious app yourself

Think about when the problems started, then open Settings → Apps → See all apps. Look for anything you do not recognise, especially apps with a blank icon, a generic name, or an app that pretends to be a cleaner, booster, free VPN or video downloader. Tap the app and choose Uninstall. Also remove any app you recently installed from a website or an APK file sent to you, even if its name looks harmless. Restart the phone afterwards and use it normally for a while to see whether the pop-ups and strange behaviour have stopped.

4. If the app will not uninstall: use Safe Mode

Some bad apps fight back by closing the settings screen or greying out the Uninstall button. Safe Mode stops all downloaded apps from running, which gives you a clear path to remove them. Press and hold the power button, then press and hold the Power off option on screen and tap OK when Safe Mode is offered (on some phones you hold the volume-down button while the logo appears instead). You will see 'Safe mode' written in a corner of the screen. Now go to Settings → Apps, uninstall the suspicious app, then restart the phone normally to leave Safe Mode.

5. Remove apps that grabbed device admin access

A sneaky trick is asking for 'device admin' permission, which blocks uninstalling. To remove it, open Settings → Security → Device admin apps (on some phones it is under Settings → Biometrics and security → Other security settings). You should normally only see things like Find My Device listed there. If an unknown app has admin access, switch it off for that app first, then go back to Settings → Apps and uninstall it. Never grant admin access to an app that asks for it during installation unless you fully trust it.

6. Stop browser notification spam

Sometimes the 'virus' is actually website notifications you allowed by mistake, which send adverts that look like system warnings. In Chrome, tap the three dots, then Settings → Notifications, and switch off notifications for sites you do not know. You can also open Settings → Site settings → Notifications and block all sites, then allow only the few you truly want. These fake warnings often claim your phone is infected and urge you to install an app or pay money — that message itself is the scam, so never tap its buttons.

7. Last resort: factory reset, with a backup warning

If pop-ups, redirects and strange behaviour continue after all the steps above, a factory reset is justified. It erases everything and returns the phone to a clean state. Warning: this deletes your photos, chats and files that are not backed up. First save your photos and documents to Google Drive or a computer, and make sure your WhatsApp backup in WhatsApp → Settings → Chats → Chat backup is up to date. Then go to Settings → System → Reset options → Erase all data (factory reset). After the reset, reinstall apps only from the Play Store, one by one, so the bad app does not come straight back.

Finally, a word of caution: the Play Store is full of 'antivirus' and 'phone cleaner' apps that show scary fake scan results to sell subscriptions, and some are adware themselves. Play Protect plus careful installing is enough for most people. Only install apps from the Play Store, check reviews and permissions, and your phone will stay clean far more easily than it can be cleaned.

Frequently asked questions

Do I need to buy an antivirus app to remove malware?

No. Google Play Protect is already built into your phone and is enough for most cases. Many paid 'antivirus' and 'cleaner' apps show fake warnings to push subscriptions, and some contain adverts themselves.

Will a factory reset definitely remove the virus?

A factory reset removes almost all malware because it erases every installed app and returns the phone to its original state. Back up your photos, files and WhatsApp chats first, because everything on the phone is deleted and cannot be recovered.

How did the virus get into my phone?

Most Android malware arrives inside apps installed from websites, APK files shared on WhatsApp, or fake 'update' pop-ups, rather than from the Play Store. Avoid installing apps from links and files, even if they promise free features.