How to remove a virus from Android

Key takeaways

• True self-replicating viruses are rare on Android. What most people call a “phone virus” is usually adware, spyware, a Trojan, or another type of malware.
• To remove it: disconnect from suspicious networks, restart in safe mode, uninstall suspicious apps, and scan your phone with Google Play Protect and Malwarebytes malware scanner. Install an Android antivirus to protect your phone from future infectios.
• Change your passwords from a clean device after removing the malware, not before.
• A factory reset removes most malware, but it erases your data, so use it as a last resort.

Mobile protection, anywhere, anytime.

Try it now

How to clean your phone of viruses

If your Android phone is acting strangely and you suspect a virus, you’ve come to the right place. This guide from Malwarebytes walks you through virus removal for Android step by step.

The short answer: to clean your phone of viruses, restart it in safe mode, uninstall any apps you don’t recognize, and run a malware scan. Then change your passwords from a clean device and turn on 2-Step Verification.

Technically, the chances that your Android device has an actual old-fashioned self-replicating virus are low. Viruses are legacy threats that typically target PCs and self-replicate by infecting legitimate files and corrupting data. It’s challenging for a self-replicating virus to corrupt an Android device because of the operating system’s security features and data management techniques.

However, Android devices are susceptible to other emerging threats:

• Adware: Throws up ads on your screen and can slow down or crash your device.
• Trojan horses: Use deception to infect a phone, often disguised as a legitimate app, and may steal passwords, banking information, and more.
• Spyware: May use your device’s hardware to spy on your messages, browsing history, location, and media while staying hidden.
• Stalkerware: Helps abusers secretly monitor victims and is typically marketed as parental-control or monitoring software.
• Keyloggers: Record what you type, including passwords, messages, and card numbers.
• Rootkits: Give a threat actor secret control of an Android device for malicious activity.
• Ransomware: Can lock a device and demand money in exchange for a decryption key.

Many of these threats arrive the same way: a text, email, or chat message with a link that installs an app from outside the Google Play Store. If you didn’t go looking for an app, don’t install it from a link someone sent you.

So, when you ask, “how to clean phone of viruses,” you probably mean “how to clean phone of malware.” The term virus has incorrectly become an umbrella term for all types of malware because viruses were one of the earliest types of malicious software and the first to gain widespread notoriety.

You can read more about malware if you’re interested in the differences between the terms.

Android’s malware infection signs

The easiest way to know if a phone has a virus infection is to scan it for malware with Malwarebytes for Android. Please also watch out for the following signs of a malware infection on Android:

Appearance of new apps

Don’t take the appearance of unexplained apps on your device lightly. These apps may be malicious software that came bundled with another app, privacy-invading tools installed secretly by someone you know, or the result of a phishing attack. Screen and remove such suspicious apps immediately.

Also watch for apps that ask for Accessibility or device admin access without a clear reason. Malware uses these permissions to control your phone and avoid removal.

Pop-ups

Potentially unwanted programs like adware throw up pop-up ads on your Android screen to make advertising money. Some malware that clashes with your Android operating system may also inadvertently cause strange pop-ups to appear.

Apps constantly crashing

Mobile operating systems are generally stable and usually play well with apps from the Google Play Store. But sometimes they may crash due to conflicts or because of a malware infection. When your apps are constantly crashing, you should check for malicious programs.

Battery draining

While all mobile device batteries drain faster with age, faster drops in battery levels may be due to a program sneakily consuming resources. For example, some malware drains your battery while using your device’s hardware for malicious activity.

Overheating

A phone that runs hot when you aren’t using it may have malware working in the background, such as spyware sending your data out or a hidden app mining cryptocurrency.

Slow load times

Malicious apps can slow down your phone as they consume its processing power and memory. Conflicts due to malicious programs may also force other apps to take more time to load.

Higher data usage

Certain types of malware can use your data without your knowledge or consent. For example, a spyware program may be using your data to communicate with its author, or an adware app may use extra bandwidth to display ads.

Increased phone bill

When malware forces your data usage to go beyond monthly limits, you’ll see higher phone bills. Before you call up your cellular provider, check your Android device’s Mobile data usage page. Unfamiliar apps that use extra data could be the source of the problem.

Contacts receiving suspicious messages

Malware like some Trojans can scan your list of contacts and send them phishing emails and texts. Some social media malware can also bombard your friends and family with strange messages. If your contacts report receiving suspicious messages from you, please scan your Android device for malware immediately.

How to clean your infected Android

Follow these steps in order to remove malware from your Android device. Menu names vary slightly between phone makers like Samsung and Google Pixel, but the settings are the same.

1: Disconnect from suspicious networks

A threat actor can use a vulnerable or spoofed network to attack your device. Visit your WiFi settings and check your connection. Disconnect immediately if you’re connected to an unsecured public WiFi network or if the WiFi network appears suspicious. For example, if there are two identical-looking Starbucks hotspots in the area, you may be connected to a spoofed one designed to help a hacker attack your data or drop malware like a Trojan or spyware.

If you think something on your phone is actively sending out data, turn on Airplane mode until you’ve finished the steps below.

2: Reboot in safe mode

Rebooting your Android device in safe mode stops third-party apps from running, so you can remove malicious apps that won’t uninstall normally. Safe mode is also helpful if your device is restarting itself, crashing, freezing, or running slow.

Here is how to restart your Android device in safe mode:

1. Press and hold the power button. On some newer phones, press the power and volume up buttons together to open the power menu.
2. Touch and hold Power off on the screen until the Safe mode prompt appears.
3. Tap OK (or Safe mode) to restart in safe mode.

To exit safe mode, simply restart your phone.

3: Identify and uninstall any suspicious apps

Remove any suspicious software from your Android device. Such apps may be malicious, allowing threat actors to spy on you, read your confidential information, or steal your credit card numbers.

1. Open Settings.
2. Go to Apps, then tap See all apps.
3. Tap any suspicious app and select Uninstall.

Look through the list of installed apps for anything suspicious. Remove any unfamiliar apps or apps that you use rarely. Please also remove any software that unnecessarily asks for permissions. For example, uninstall your nephew’s nursery rhymes app if it has access to your camera, microphone, and GPS. Such apps are sometimes stalkerware in disguise or Trojan password-stealers.

If an app’s Uninstall button is grayed out, it may have device admin access. Go to Settings > Security (sometimes under Security & privacy > More security settings) > Device admin apps, turn off access for the app, then uninstall it.

4: Scan your phone with Google Play Protect

Google Play Protect is built into Android and is on by default, but it’s worth checking it hasn’t been turned off.

1. Open the Play Store app and tap your profile icon in the top-right corner.
2. Tap Play Protect, then tap the gear icon.
3. Make sure Scan apps with Play Protect is turned on.
4. Go back and tap Scan.

Here are some advantages of enabling Play Protect:

1. Safety check on Google Play Store apps before you download them.
2. Scans Android devices for viruses and malware.
3. Warnings for potentially dangerous apps or apps that mislead you.
4. Malicious app deactivation or removal.

5: Scan with an Android antivirus

Play Protect is a good baseline, but a dedicated app like Malwarebytes for Android can find and remove malware that slips past it, and protect you from viruses, spyware, ransomware, and phishing going forward. Here is how to clean your phone from virus threats with Malwarebytes:

1. Open the Play Store, search for Malwarebytes, and tap Malwarebytes Mobile Security.
2. Tap Install, then Open, then Get started.
3. Follow the prompts to give Malwarebytes the security permissions it needs to scan and protect your device.
4. On the Premium screen, tap Start free trial, or Already have a subscription if you have a license.
5. Run a scan from the Scanner and follow the prompts to remove any threats.

The scan may take a few seconds or minutes. If Malwarebytes finds no malware, your device is clean for now.

6: Clear your cache and downloads

Cache holds temporary files, and your Downloads folder can hold the file that caused the infection in the first place. Clearing both removes leftovers after a cleanup.

1. Open Settings > Apps > Chrome (or your browser).
2. Tap Storage & cache, then Clear cache.
3. Open your Files app, go to Downloads, and delete any APK files or downloads you don’t recognize.

7: Change your Google password

Once the malware is gone, change your Google password. If you can, do it from a different device you know is clean.

1. Go to your Google Account and select Security.
2. Under How you sign in to Google, tap Password. You may have to sign in again.
3. Enter your new password.

While you’re there, check Your devices and sign out of any phone or computer you don’t recognize.

8: Change your other passwords

In addition to changing your Google password, please also change all passwords to your sensitive accounts if you suspect a security breach. A hacker can use a stolen password to an email, bank account, or cryptocurrency page to commit serious cybercrimes.

Here are some tips for setting a strong password:

• Make it long: at least 12 to 15 characters. A passphrase of several random words is easier to remember and harder to crack.
• Avoid common words, names, dates, and patterns.
• Use a different password for every account. A password manager makes this easy.
• Where available, switch to passkeys, which can’t be phished or reused.

9: Activate 2-Step Verification

Activating multi-factor authentication (MFA) is an excellent cybersecurity solution. Even if a hacker has stolen your login credentials from your Android device, they’ll still need to authenticate their identity another way when trying to access your Android account.

Here is how to turn on 2-Step Verification on Android:

1. Open your Google Account and select Security.
2. Under How you sign in to Google, select 2-Step Verification.
3. Select Get started and follow the steps on the screen.

Protect your Android from future infections

To protect your phone from future infection, follow these steps:

• Use a proactive cybersecurity solution like Malwarebytes for Android to secure your device from different attack vectors. Get iPhone malware protection if you’re an iOS user. Yes, iPhone viruses do exist!
• Only connect to secured networks and avoid sensitive transactions on public WiFi. A VPN helps secure your connection and protect your privacy. Read what is a VPN to learn more.
• Steer clear of unsafe emails, links, text messages, and websites, as they may infect your device with malware. If you’re not sure about a link, check it first with the Malwarebytes Scam Link Checker.
• Avoid downloading apps that ask for unnecessary permissions.
• Always download apps from the Google Play Store, and never install apps from links in texts or messages.
• Keep Google Play Protect turned on, and keep Android and your apps updated.