What counts as a virus on Android, and how to spot it

Android phones rarely get true viruses — the kind that replicate themselves and spread to other devices. What you're more likely to encounter is malware: apps or files designed to steal data, show unwanted ads, or drain your battery. The difference matters because the removal steps are different.

Signs your phone has malware include apps you don't remember installing, constant pop-up ads even when you're not using the browser, sudden battery drain, overheating, or a spike in your mobile data usage. Your phone might also run noticeably slower, or you might see unfamiliar charges on your phone bill. Some malware hides itself so well you won't notice anything — which is why checking your installed apps regularly is worth doing even if nothing seems wrong.

Key Takeaways

  • Most Android malware comes from apps you installed yourself, often from sources other than the Google Play Store, so checking your app list is the first step.
  • Uninstalling suspicious apps and clearing your browser cache and cookies removes most malware without needing antivirus software.
  • Restarting your phone in Safe Mode lets you see which apps are running and uninstall them without interference from malware.
  • If malware persists after removing apps, a factory reset will remove it completely, but you'll lose all data unless you back up first.
  • Changing your passwords from a different device after removing malware prevents attackers from locking you out of your accounts.

Check your installed apps and remove anything unfamiliar

Open Settings, then tap Apps or process Manager (the exact name varies by phone brand). Scroll through the full list and look for apps you don't remember installing. Pay special attention to apps with generic names like "System Update," "Security," or "Cleaner" — these are common malware disguises. Also check for duplicate apps: if you see two versions of the same app, one is likely malware.

Tap each suspicious app and select Uninstall. If the button is grayed out, the app has been given admin access — go back to Settings, find Security or Biometrics and Security, tap Device Admin Apps, and remove the app from that list first. Then return to Apps and uninstall it. Don't worry about removing something legitimate by mistake; you can always reinstall apps from the Google Play Store later.

Clear your browser cache, cookies, and browsing data

Malware often hides tracking code in your browser. Open your default browser (Chrome, Firefox, Samsung Internet, or whatever you use), tap the menu button (three dots), and look for Settings or History. Select Clear Browsing Data or similar. Make sure Cookies and Site Data and Cached Images and Files are both checked, then tap Clear.

Do this for every browser installed on your phone, not just the one you use most. If you have multiple browsers, malware may be hiding in the one you rarely open. After clearing, check your browser's homepage and search engine settings — malware sometimes changes these to redirect you to ad-filled pages. Set them back to your preferred options.

Restart your phone in Safe Mode to disable third-party apps

Safe Mode runs only the apps that came with your phone, disabling everything you installed. This lets you see whether malware is still active and uninstall it without the malware interfering. Press and hold the power button until the power menu appears, then press and hold "Power Off" until Safe Mode appears. Tap it.

Your phone will restart with "Safe Mode" displayed at the bottom of the screen. Go back to Settings, Apps, and look through the list again. Anything you don't recognize is almost certainly malware. Uninstall it. After you've removed suspicious apps, restart normally and check whether your phone runs better. If problems persist, malware may be deeper in your system, and a factory reset becomes necessary.

Perform a factory reset if malware remains

A factory reset erases everything on your phone and reinstalls the original operating system, removing any malware that's embedded in the system itself. Before you do this, back up your photos, contacts, and important files. Open Settings, tap Accounts, and make sure your Google account is synced — this saves your contacts and some app data to Google's servers. For photos and videos, use Google Photos, OneDrive, or another cloud service to back up files you want to keep.

Once you've backed up, go to Settings, find System or About Phone, and look for Reset or Factory Reset. Tap it, confirm that you want to erase everything, and let your phone restart. This process takes 10 to 30 minutes. When it finishes, your phone will be clean, and you can sign back into your Google account to restore your contacts and reinstall apps from the Play Store only — not from third-party sources where you may have picked up malware in the first place.

Change your passwords from a different device

If malware was on your phone, assume attackers may have captured your passwords. Change them when ready, but do it from a computer or tablet, not from the infected phone. Start with your Google account password, since that controls access to your email and Play Store. Then change passwords for your bank, email, social media, and any other accounts with sensitive information.

Use a password manager like Bitwarden or 1Password to create strong, unique passwords for each account. If you don't have a password manager, make passwords at least 12 characters long and mix uppercase, lowercase, numbers, and symbols. After you've changed your passwords, sign back into your phone with the new credentials. This prevents attackers from using old passwords to access your accounts even if they still have malware code somewhere.

Prevent malware by installing apps only from the Google Play Store

The Google Play Store scans apps before they're published and removes malware regularly. Third-party app stores and direct downloads from websites have far less oversight. If you need an app, search for it in the Play Store first. If it's not there, the app either doesn't exist or has been removed for safety reasons — that's a sign to skip it.

Also turn on Google Play Protect, which scans your phone automatically. Go to Settings, tap Google (or Google Account), then Manage Your Google Account, then Security. Scroll down to Find My Mobile Device and make sure it's on. This won't stop malware from installing, but it will alert you if Google detects something dangerous and give you the option to remove it when ready.

Frequently Asked Questions

Do I need antivirus software on Android?

Not usually. The Google Play Store's built-in scanning and Google Play Protect catch most threats. Antivirus apps from the Play Store can add a layer of monitoring, but they also use battery and storage. If you stick to the Play Store and avoid suspicious links, you're protected well enough without a separate antivirus app.

What if I can't uninstall an app because it says it's a system app?

System apps that came with your phone can't be uninstalled, only disabled. If a suspicious app claims to be a system app, it's lying — real system apps have a "Disable" button, not "Uninstall." Go to Device Admin Apps in Security settings and remove it from there, then uninstall it normally.

Will a factory reset delete my photos and contacts?

Yes, unless you back them up first. Google Photos backs up photos automatically if you turn it on before the reset. Your Google contacts sync to your account, so they'll come back when you sign in again. But files stored only on your phone's internal storage will be gone, so use cloud storage or a computer to back those up before resetting.

Can malware come back after I remove it?

Only if you reinstall the app that had it or read malware again. Once you've uninstalled the infected app and cleared your browser data, the malware is gone. To keep it gone, install apps only from the Google Play Store and avoid clicking links in text messages or emails from unknown senders.

How do I know if a link or read is safe?

Don't click links in text messages or emails unless you recognize the sender and were expecting the message. If your bank texts you a link, ignore it and call the number on your bank card instead — scammers impersonate banks this way. For downloads, use only the Google Play Store or official websites you know are real. When in doubt, search for the app name plus "safe" or "malware" to see what others have reported.