Remove Malware From an Android Phone: Step-by-Step Fixes

To remove malware from an Android phone, restart it in Safe Mode, uninstall any app you do not recognize or that you installed just before the trouble began, run a scan with Google Play Protect, and change your passwords from a clean device. If the problem returns, a factory reset removes nearly everything. First, though, make sure the phone is really infected, because many problems that look like malware are not.

How to tell if it is really infected

Slow performance, a hot phone or a bad battery do not prove malware. Apps misbehaving, a full storage drive or an old battery cause the same symptoms. Look for several of these signs together:

• Pop-up ads appearing on the home screen or outside any app.
• Apps you never installed.
• Your browser homepage or search engine changing on its own.
• Unexpected charges, or text messages sent from your number that you did not write.
• A sudden spike in mobile data use.
• Security or account alerts you did not trigger.

If the only symptom is fast battery drain, start with the common causes of a draining battery before assuming the worst. For a wider checklist, see how to tell if your phone is hacked.

Step 1: Disconnect and restart in Safe Mode

Turn on airplane mode, or turn off Wi-Fi and mobile data, so a malicious app cannot send your data or receive commands. Then boot into Safe Mode, which disables apps you installed so only the built-in ones run.

1. Press and hold the power button until the power menu appears.
2. Touch and hold the Power off option until a prompt to reboot into Safe Mode appears, then confirm.
3. If that does not work, the exact button combination varies by maker. Check the support page for your phone model.

You will see “Safe mode” at the bottom of the screen. If the pop-ups and odd behavior stop here, a downloaded app is the likely cause.

Step 2: Find and remove the bad app

1. Open Settings and go to Apps (or Apps & notifications).
2. Review the list. Look for anything unfamiliar, anything installed around the time problems began, and apps you do not use.
3. Tap a suspicious app, then choose Uninstall.
4. If Uninstall is greyed out, the app may have device administrator rights. Go to Settings, search for Device admin apps, switch the permission off for that app, then go back and uninstall it.

Also check which apps have special access, such as accessibility services and the ability to display over other apps. Malware often abuses these. Remove access from anything that does not clearly need it.

Step 3: Scan and clean up

Restart the phone normally and reconnect. Open the Google Play Store, tap your profile icon, choose Play Protect and run a scan. Play Protect checks apps on your phone and can flag harmful ones. Whether you also need a separate security app is explained in our guide to antivirus on phones.

Next, clean your browser. Clear its cache and data, remove any unfamiliar extensions or notification permissions, and reset the homepage. Spammy browser notifications are a common trick and are removed in the site settings.

Step 4: Secure your accounts

Assume anything typed on the phone may have been seen. From a different, trusted device, change the passwords for your Google account, email, banking and social media. Turn on two-step verification and sign out of all other sessions. Check your bank and card statements, and contact your bank if you see charges you do not recognize.

Step 5: Factory reset if it keeps coming back

If the problem returns, or you cannot find the cause, back up your photos and contacts, then reset the phone. A reset erases apps and data. Be careful what you restore: restoring a full backup can bring the problem back, so reinstall apps by hand from the Play Store instead. Our guide on how to factory reset an Android phone covers Pixel, Samsung and recovery mode. If you suspect the phone itself was tampered with, or a bank account was affected, contact your carrier or bank for help.

How to avoid it next time

• Install apps only from the official Play Store, and read reviews and the developer name.
• Avoid installing apps from links in texts, emails or pop-ups.
• Keep Android and your apps updated.
• Leave Play Protect turned on.
• Grant only the permissions an app needs.

Quick answers

Can a website infect my Android phone?

It is rare for simply visiting a page to install malware. The usual route is tricking you into installing an app or tapping a fake alert. Close the tab and do not accept the download.

Will a factory reset remove all malware?

It removes almost all of it in normal cases. Restoring a backup without care can reintroduce the problem, so reinstall apps one at a time.

Is a Safe Mode scan the same as an antivirus scan?

No. Safe Mode only pauses apps you installed so you can remove them. Play Protect or a security app does the scanning.

What if I already entered a password on a fake page?

Change that password at once from a clean device and turn on two-step verification. Change it anywhere else you used it.