What to do if your Android phone has a virus
If your Android phone is running slowly, showing ads you didn't tap, or draining battery fast, a virus or malware may be the cause. You can remove most of them yourself without paying for a service or taking the phone to a repair shop. The process involves restarting in safe mode, uninstalling suspicious apps, clearing your browser, and running a built-in scan — all steps you can do right now on your phone.
Android phones come with built-in protection, but it does not catch everything. Malware often hides inside apps that look legitimate or comes from websites you visit. The manual removal steps below work for most common infections and take 15 to 30 minutes total.
Key Takeaways
- Restart your phone in safe mode first — this disables third-party apps and lets you see which ones are causing the problem.
- Uninstall any apps you do not recognize or that you installed just before the problems started, using Settings > Apps.
- Clear your browser cache and cookies in Chrome or your default browser to remove malware that tracks your activity.
- Run Google Play Protect from the Play Store app to scan for known malicious apps already on your phone.
- If problems continue after these steps, a factory reset will remove everything, but back up your photos and contacts first.
Restart your phone in safe mode
Safe mode disables all third-party apps — only system apps and pre-installed software run. This lets you see whether the problem is caused by an app you installed or by something built into Android itself. If your phone works normally in safe mode, a third-party app is the culprit.
To enter safe mode, press and hold the power button until the power menu appears. On most Android phones, press and hold "Power off" until a "Safe mode" option appears. Tap it. Your phone will restart and show "Safe mode" in the bottom left corner of the lock screen.
Use your phone normally for a few minutes. If the slowness, ads, or battery drain stop, go back to the home screen and open Settings > Apps. Look for any app you do not recognize or remember installing. Write down the names — you will uninstall them next. To exit safe mode, restart your phone normally.
Uninstall suspicious apps
Apps are the most common source of Android malware. Malicious apps often request permissions they should not need — like access to your contacts, location, or camera — and use those permissions to steal data or show ads.
Open Settings and go to Apps (or Application Manager on older phones). Scroll through the list and look for apps you do not recognize, apps with generic names like "System Update" or "Google Services," or apps you installed around the time the problems started. Tap each suspicious app and select "Uninstall." If the button is grayed out, the app is built into Android and cannot be removed — skip it.
Pay special attention to apps from unknown publishers, apps with very few reviews, or apps that ask for unusual permissions. You can check an app's permissions by opening Settings > Apps > [App name] > Permissions. If a flashlight app asks for access to your contacts or location, that is a red flag.
Clear your browser cache and cookies
Malware often lives in your browser's stored data. Clearing your cache and cookies removes tracking cookies, stored passwords that may have been compromised, and files that malware uses to persist on your phone.
Open Chrome (or your default browser). Tap the three-dot menu in the top right and select "Settings." Go to "Privacy and security" and tap "Clear browsing data." Make sure "Cookies and site data" and "Cached images and files" are both checked. Set the time range to "All time" and tap "Clear data."
If you use a different browser like Firefox or Samsung Internet, the steps are similar — look for Settings, then Privacy or Clear Data. Repeat this for any browser you use regularly.
Run Google Play Protect to scan for malware
Google Play Protect is a built-in scanner that checks apps for known malware. It runs automatically in the background, but you can also run a manual scan right now.
Open the Google Play Store app and tap your profile icon in the top right. Select "Manage apps & device," then go to the "Manage" tab. Tap the three-dot menu and select "Run security scan." The scan takes a few minutes. If it finds anything, it will show the app name and offer to uninstall it. Tap "Remove" to delete the malicious app.
After the scan finishes, check that "Play Protect" is turned on. In the Play Store, go to your profile > "Manage apps & device" > "Manage" tab, then tap the three-dot menu and select "Play Protect settings." Make sure the toggle next to "Scan apps with Play Protect" is on.
Check your Google Account for unauthorized access
If malware was on your phone, it may have stolen your Google Account password or added a recovery email or phone number. Check your account security to make sure only you can access it.
Go to myaccount.google.com on your computer or phone's browser. Sign in and select "Security" from the left menu. Scroll to "Your devices" and look for any phones or computers you do not recognize. Tap any unfamiliar device and select "Remove." Then go to "How you sign in to Google" and check that your recovery email and phone number are correct. If they have changed, update them immediately.
Also check "Third-party apps with account access" and remove any apps you do not recognize. Malware sometimes adds itself as a trusted app to maintain access even after you uninstall it.
Factory reset if problems continue
If you have completed all the steps above and your phone still has problems, a factory reset will remove everything — including any malware that is hiding deep in the system. A factory reset erases all your data, so back up your photos, contacts, and important files first.
To back up, open Settings > Google > Manage your Google Account > "Backup" tab and make sure "Backup to Google Drive" is on. This saves your contacts, calendar, and app data to your Google Account. For photos, open Google Photos and tap your profile icon > "Photos settings" > "Backup and sync" and turn it on.
Once you have backed up, go to Settings > System > Reset options > "Erase all data (factory reset)." Tap "Erase all data" and confirm. Your phone will restart and return to factory settings. After it boots up, sign back into your Google Account and your contacts and photos will restore automatically.
Frequently Asked Questions
How do I know if my Android phone actually has a virus?
Common signs include unexpected slowness, apps crashing, battery draining much faster than normal, data usage spiking, or ads appearing even when you are not using your phone. If you see unfamiliar apps in your app drawer or your phone gets hot during normal use, malware may be present. Safe mode will help you confirm whether a third-party app is the cause.
Can I get a virus just from visiting a website?
Yes, but it is less common than getting malware from an app. Malicious websites can trick your browser into downloading files or can exploit security holes in older Android versions. Avoid clicking links in text messages or emails from unknown senders, and do not download files from websites you do not trust. Keep your Android version updated to patch security holes.
Do I need to pay for antivirus software to remove malware?
No. Google Play Protect is free and built into every Android phone. It catches most known malware. Paid antivirus apps may offer extra features, but they are not necessary for basic malware removal. If Play Protect and the manual steps above do not work, a factory reset is your next option and costs nothing.
Will uninstalling an app remove all the malware it installed?
Usually yes, but not always. Some malware creates system-level changes or installs additional files that survive app uninstallation. If you uninstall a suspicious app and problems continue, run Google Play Protect again. If that does not work, a factory reset is the most reliable way to remove all traces.
What should I do after I remove the malware?
Change your passwords for important accounts like email, banking, and social media from a computer you trust. Enable two-factor authentication on your Google Account and any other accounts that support it. Review your bank and credit card statements for unauthorized charges. Going forward, only install apps from the Google Play Store, avoid sideloading apps from unknown sources, and keep your Android version updated.