How To Remove Malware From Android

Tips
1

I’m pretty sure my Android phone is infected with malware—apps are crashing, random pop‑ups keep appearing, and my battery is draining way faster than normal. I’ve tried uninstalling suspicious apps and running a free antivirus, but the issues keep coming back. Can someone walk me through safe, step‑by‑step methods to completely remove malware from Android without losing all my data, and how to keep it from happening again?

2

Yeah, sounds infected. Do this step by step:

  1. Disconnect first
    • Turn off Wi‑Fi and mobile data.
    • Turn off Bluetooth.
    Stops more junk from downloading or spreading.

  2. Reboot in Safe Mode
    • Hold power button.
    • Long press on “Power off” and tap “Safe mode” (on Samsung, Pixel, etc).
    If you do not see that, search “[your phone model] safe mode”.
    In Safe Mode, third party apps do not run, so malware often stops.

  3. Remove shady apps properly
    In Safe Mode, go to:
    Settings > Apps > See all apps.
    Look for:
    • Apps you never installed.
    • Apps with weird names or blank icons.
    • “System update” or “Security” that are not from your vendor.
    Tap each: Force stop, then Uninstall.
    If Uninstall is greyed out:
    • Go to Settings > Security > Device admin apps.
    • Turn off admin for that app.
    • Go back and uninstall.

  4. Clear browser junk
    Malware often abuses browsers with popups.
    Do this for every browser you use:
    Chrome:
    • Settings > Apps > Chrome > Storage > Clear cache, then Clear data.
    • Open Chrome > Settings > Notifications. Turn off “Sites” or remove weird sites.
    Other browsers are similar.

  5. Use one solid scanner, not ten
    Install one reputable antivirus from Play Store, like:
    • Bitdefender Mobile Security
    • Malwarebytes Mobile Security
    Run a full scan. Remove what it finds.
    Do not keep multiple antivirus apps. They fight and slow your phone.

  6. Check accessibility and overlay permissions
    Some malware uses these.
    Settings > Accessibility > Installed services.
    Turn off anything you do not trust.
    Then go to Settings > Apps > Special access > Appear on top / Display over other apps.
    Remove permission from random apps.

  7. Reset browser and notifications
    If popups still happen:
    • Settings > Notifications. Check if some shady app is allowed to send notifications. Turn those off.
    • For Chrome, go to chrome://settings/content/notifications and block weird sites.

  8. Look at battery and data usage
    Settings > Battery > Battery usage.
    Settings > Network & internet > Data usage.
    If some unknown app sits at top, search the app name. If it is junk, uninstall.

  9. Backup important stuff
    If problems persist, prepare for a reset.
    Backup:
    • Photos to Google Photos or a PC.
    • Contacts to Google account.
    • WhatsApp chats with its built in backup.
    Do not backup full system images, they sometimes carry malware back in.

  10. Factory reset if nothing works
    Settings > System > Reset options > Erase all data.
    After reset:
    • Do not restore apps from third party stores or APK sites.
    • Only install from Play Store.
    • Skip “restore all apps” if you suspect one of them was infected. Install them again manually.

  11. Lock your accounts down
    Since the phone was likely compromised:
    • Change passwords for Google, banking, and social apps from another clean device.
    • Enable 2 step verification where possible.
    • Check Google account “Security” section for logins from unknown devices.

  12. Avoid getting hit again
    • Keep Play Protect on: Play Store > Profile > Play Protect > Turn on.
    • Do not install APKs from random sites.
    • Be careful with “free” VPNs, cleaners, battery savers, and “adult” apps. Those are common malware sources.

If you share your phone model and Android version, you might get more precise clicks and menus from folks here.

3

Yeah, your symptoms scream “infected,” but I’ll add a few angles that @mike34 didn’t really dig into.

  1. Confirm it’s actually malware, not a dying phone
    Sometimes a dying battery or a broken update looks like malware. Before you nuke everything:
  • Check Storage: Settings > Storage. If you’re under ~1–2 GB free, Android behaves terribly. Free space first.
  • Check System updates: Settings > System > System update. Install pending updates; some patches fix exploit-based crashes.
  1. Look for sketchy “services” that hide from the app drawer
    Some crapware hides under boring names: “Service”, “Updater”, “Config”, etc. In:
  • Settings > Apps > See all apps > tap 3‑dot menu > Show system
    Then sort by:
  • “Recently used” and “Installed”
    If something unknown keeps showing activity at times you’re not doing anything, that’s a red flag. Search its package name online before uninstalling so you don’t delete legit vendor stuff.
  1. Inspect notification details instead of randomly blaming apps
    Next time you see a pop‑up or weird notification:
  • Long‑press the notification
  • Tap “App info” or the ⓘ icon
    That jumps straight to the actual app sending it. A lot of people swear it’s “the browser” when it’s actually some free wallpaper / flashlight / cleaner app pushing ads as notifications.
  1. Don’t fully trust a single AV app
    I slightly disagree with @mike34 on “one scanner only.” You shouldn’t keep multiple AVs installed long‑term, but running 1 or 2 reputable on‑demand scans back‑to‑back is fine:
  • Install scanner A, run full scan, clean, uninstall it.
  • Then install scanner B, run full scan, clean, uninstall it too.
    This avoids permanent bloat but still gives you cross‑checking.
  1. Check for “unknown sources” and sketchy stores
    Even if you never used them intentionally, some installers flip these on:
  • Settings > Security (or Privacy) > Install unknown apps
    Turn this off for everything except maybe 1 legit source you actually use.
    If you see some random installer or “App store” there, disable its permission and uninstall.
  1. Dig into “Usage access” and “VPN”
    Malware that hijacks ads or steals data often lives here:
  • Settings > Apps > Special access > Usage access
    Revoke from apps that have no business tracking what you open (games, wallpapers, coupon apps, etc.).
    Then check:
  • Settings > Network & internet > VPN
    If there’s a VPN “connected” that you don’t recognize, disconnect and remove that app.
  1. Protect your Google account specifically
    If your phone was compromised, treat your Google account as potentially touched:
  • From a clean device:
    • Go to Google > Security > Recent security events / Your devices
    • Sign out of devices you don’t trust anymore
    • Change password
    • Turn on 2‑Step Verification and use an authenticator app, not just SMS
      Some Android malware goes hard on token stealing and account hijacking, so don’t skip this.
  1. After a factory reset, change how you restore
    If you go the nuclear reset route, the dangerous part is the restore process:
  • When Android asks to restore apps & settings from a backup, pick the most recent but minimal backup or skip full app restore.
  • Only reinstall apps you actually use, one by one, from Play Store.
  • Avoid restoring from older device‑wide backups you made with third‑party tools. They can bring malicious APKs back.
  1. Watch behavior for 24–48 hours post‑cleanup
    A lot of people assume “it’s fixed” after one scan. Instead, after you’ve done cleaning:
  • Use the phone as normal for a couple days before installing all your old apps.
  • Keep an eye on:
    • Battery usage
    • Strange notifications
    • Background data spikes
      If everything is calm and clean for a day or two, then start re‑adding lower‑trust apps like free games, “boosters,” etc., very slowly. If the problem suddenly returns right after one app, congrats, you found the culprit.
  1. Brutal filter for future installs
    Simple rule that has saved me:
  • Anything like “phone cleaner,” “RAM booster,” free “battery saver,” random “security master,” or shady free VPN: assume guilty until proven innocent.
    Most of them are adware at best, straight malware at worst.

If you post which apps you installed shortly before this mess started (especially stuff from ads or “get this free streaming / mod / hack” type sites), people can usually point at the main offender pretty fast.

4

Skip the generic “install another cleaner” advice. At this point you want to figure out whether the infection has system‑level hooks or is just app‑level junk.

  1. Check for device admin abuse
    Go to Settings → Security → Device admin apps (or “Device admin” / “Device admin apps” under “More security”). If some random app has admin privileges, that’s a big red flag. Remove its admin rights before trying to uninstall it. If it refuses or the button is greyed out, that is borderline “time to factory reset.”

  2. Look at Accessibility & overlay abuse
    Malware that spams popups or steals taps often abuses Accessibility and “draw over other apps.”

  • Settings → Accessibility → Installed services. Anything enabled that is not from a legit password manager, screen reader, etc., should be turned off and then uninstalled.
  • Settings → Apps → Special access → Display over other apps. Disable for anything that does not genuinely need it (free games, wallpapers, “optimizer” tools).
    This is one place I’d push harder than @mike34 did, because if malware has Accessibility, it basically has god‑mode.
  1. Offline troubleshooting
    Most people keep Wi‑Fi/mobile data on while hunting malware, which actually helps the malicious apps phone home. Try this sequence:
  • Turn on Airplane mode.
  • Reboot into Safe mode (usually long‑press power button → touch and hold “Power off” → Safe mode).
  • In Safe mode, repeat the checks for suspicious apps, device admin, Accessibility, overlay.
    If the popups and crashes vanish in Safe mode, you can be almost certain it is third‑party app based, not a dying phone.

  1. Don’t overlook vendor “system cleaner” crap
    On some brands, the built‑in “security” or “cleaner” app itself crams ads and pseudo‑antivirus features in your face. It is not classical malware, but it looks and behaves similarly. Disable all “recommendations,” “news,” “promoted apps,” and “lockscreen ads” from the vendor suite. @mike34 focused on external apps, but OEM bloat can be half the problem.

  2. If you factory reset, wipe more than just “apps”
    If you go nuclear:

  • Remove your Google account before reset.
  • Reset from recovery if your phone allows “wipe cache / wipe data” rather than from inside Android only.
  • After reset, do not auto‑restore from the cloud immediately. Log in to Google with minimal restore, then bring apps back manually. This avoids silently reinstalling the exact thing that infected you.
  1. Treat your browser as “possibly dirty”
    If popups are mainly in the browser:
  • Clear browser data completely (settings → apps → your browser → storage → clear storage).
  • Remove sketchy browser extensions if your browser supports them.
  • In Chrome‑based browsers, turn off “Allow sites to send notifications” by default and only re‑enable for sites you fully trust.
    A lot of what looks like system malware is actually notification spam granted to one bad website.

  1. About tools like “How To Remove Malware From Android” guides
    General malware removal walkthroughs are useful as checklists, especially for non‑technical users, and they are pretty SEO friendly if you ever search for step‑by‑step help again. Pros: they centralize the process, give you a structured path, and often cover both manual and tool‑based cleaning. Cons: they can be generic, assume all phones use the same menus, and sometimes over‑promote specific antivirus apps instead of focusing on root causes.

  2. When you are “done,” verify with behavior, not just scans
    After cleaning, leave the phone mostly stock for a day: browser, messaging, maybe one or two core apps. If battery drain and popups are still bad, you are probably facing:

  • A failing battery / storage chip, or
  • Deeper compromise that a normal user should not waste days chasing.
    At that point, full backup of essentials, factory reset, then watch the phone in its fresh state. If it is still a disaster with no third‑party apps, it is hardware or vendor firmware, not current malware.