To remove malware from Android, boot into Safe Mode to disable rogue apps, then uninstall anything suspicious from Settings. Run Google Play Protect to confirm the device is clean. If symptoms persist, a factory reset wipes every threat with no exceptions.

Android malware rarely announces itself. Your battery drains in three hours, the phone runs hot while sitting idle, ads pop up on your home screen, or your data bill spikes for no reason. Any one of those signs is worth acting on today.

The good news: you don’t need a paid security app. Android ships with the tools to find and kill most threats. This guide covers every removal method from the quick fix to the nuclear option, so you walk away with a clean phone regardless of how deep the infection goes.

Real malware tends to show up in clusters. Ads appear where there should be none, apps you never installed show up in your drawer, your phone requests permissions at odd moments, or mobile data usage jumps without explanation. One symptom alone could be a buggy app. Three at once is a red flag.

Go to Settings > Battery and tap the usage graph. Look for any app consuming a large percentage in the background while you haven’t opened it. If something with an unfamiliar name is eating 20 percent or more of your battery, that app is the problem.

Google Play Protect scans every app on your device against Google’s known-threat database. A manual scan takes about 30 seconds and gives you a clear answer fast.

1. Open the Play Store app.
2. Tap your profile photo in the top-right corner.
3. Select Play Protect.
4. Tap Scan.

If Play Protect finds a threat, it flags it with a removal button right on screen. Tap Remove and the app is gone. If the scan comes back clean but your phone still misbehaves, the infection likely came from outside the Play Store. Move to Step 2.

Safe Mode starts Android with only pre-installed system apps running. Every third-party app, including malware, is disabled. If symptoms stop in Safe Mode, a third-party app is confirmed as the cause.

On most Android phones: press and hold the power button until the power menu appears, then press and hold Power Off for two seconds. A prompt asks if you want to reboot into Safe Mode. Tap OK. The words “Safe mode” appear in the bottom-left corner of the screen when it is active.

On Samsung devices, the sequence is identical but the confirmation prompt looks slightly different. If your phone doesn’t respond to the long-press method, check your manufacturer’s support page for the exact key combination for your model.

Once in Safe Mode, go to Settings > Apps and scroll through every installed app. Look for generic names like “System Service,” “Phone Booster,” “Cleaner,” or “Optimizer.” Look for apps with no icon, a blank name, or an install date that lines up with when your problems started. Tap each suspicious app and hit Uninstall.

Some malware grants itself Device Administrator status, which locks the standard uninstall button. If you tap an app and the button is greyed out, revoke that privilege first.

1. Go to Settings > Security > Device Admin Apps. (Search “Device Admin” in Settings if you can’t find it.)
2. Find the suspicious app in the list.
3. Tap it, then tap Deactivate or Remove.
4. Return to Settings > Apps and uninstall the app normally.

After uninstalling, restart normally and run Play Protect one more time to confirm nothing else is hiding.

A specific category of Android malware hijacks your browser rather than installing a standalone app. If ads appear only while you’re browsing, the problem lives in Chrome’s stored data and notification permissions rather than a separate app.

1. Open Settings > Apps and find Chrome.
2. Tap Storage, then tap Clear Cache and Clear Data.
3. Reopen Chrome and go to Settings > Site Settings > Notifications.
4. Remove every site you don’t recognize from the notification-allowed list.

Rogue notification permissions are one of the most common vectors for fake ads on Android. A website you visited once tricked you into granting push access, and it has been spamming you since. Revoking that permission stops it immediately.

If the phone still misbehaves after all the steps above, a factory reset is the only guaranteed clean slate. Back up photos, contacts, and important files to Google Drive or a PC before you proceed.

1. Go to Settings > General Management (Samsung) or Settings > System > Reset Options (Pixel and stock Android).
2. Tap Factory Data Reset.
3. Read the warning screen, then tap Reset.
4. Enter your PIN or password to confirm.

When setting the phone back up, restore apps one by one from the Play Store. Restoring a full app backup can bring the malware straight back with it.

Most Android malware enters through two routes: APK files sideloaded from outside the Play Store, and apps from publishers with no track record. Keeping Install Unknown Apps disabled in Settings blocks the first route. Checking an app’s reviews, rating history, and publisher name before installing covers the second.

Google’s 2023 Android Security report found Play Protect blocked 2.28 billion potentially harmful app installs that year. Keeping it active costs nothing and runs quietly in the background.

Build one more habit: review app permissions every few months under Settings > Privacy > Permission Manager. Check which apps have access to your location, microphone, contacts, and camera, then revoke anything that shouldn’t be there. The guide on stopping background apps on Android shows how to keep battery and data safer at the same time. For a deeper look at limiting location tracking, see how to turn off location on Android. If you ever need to hard-shutdown a frozen device, how to force turn off a frozen Android phone covers every brand-specific button combination.

Android doesn’t get traditional self-replicating viruses, but it does get malware: spyware that reads messages, adware that hijacks the browser, and trojans that silently send premium SMS texts. The category matters less than the fix, which works the same way regardless.

No. Google Play Protect, Safe Mode, and manual uninstallation handle the vast majority of infections without a third-party app. Many antivirus apps on the Play Store are adware themselves, so the built-in tools are the safer choice.

No. Safe Mode disables third-party apps but doesn’t delete them. You still need to go to Settings, find the malicious app, and uninstall it manually while in Safe Mode.

Run a Play Protect scan, restart normally, and monitor for 24 hours. If battery drain returns to normal, no unexpected ads appear, and data usage is back to baseline, the device is clean. If symptoms return, go back into Safe Mode and look for a second app you missed.