A sudden flood of pop-ups, a battery that drains unusually fast, or apps you do not remember installing can make an Android phone feel untrustworthy. Knowing how to remove malware from Android helps you address the problem methodically without deleting important data or installing more questionable software in the process.
Most Android security issues are tied to deceptive apps, risky downloads, or permissions that give an app more access than it needs. The good news is that many cases can be fixed with Android’s built-in controls. Start with the least disruptive steps, then move to a factory reset only when the behavior continues.
First, confirm the problem is likely malware
Not every slow phone or unwanted notification means malware is present. Low storage, an aging battery, a buggy app update, or aggressive advertising from a legitimate free app can produce similar symptoms. Look for a pattern rather than one isolated issue.
Common signs include pop-ups that appear outside your browser, a new home screen or search engine you did not choose, unfamiliar apps, unexplained data use, repeated redirects, or security warnings that demand immediate payment. A phone that becomes hot or drains quickly can also be a clue, especially if its battery use shows an app you rarely use near the top of the list.
Do not tap warnings that appear in a web page or pop-up. Many are designed to look like Android alerts. Close the browser tab, or force-close the browser from Settings if it will not close normally.
How to remove malware from Android step by step
Disconnect and avoid entering sensitive information
If you suspect active malware, temporarily turn on Airplane Mode. This can stop an app from sending data or loading additional ads while you investigate. Avoid signing in to banking, email, or social media accounts until the phone is behaving normally.
Airplane Mode is a precaution, not a cure. You will need an internet connection later to update Android and security tools, but taking a short pause prevents rushed decisions.
Restart in Safe Mode
Safe Mode starts Android with downloaded third-party apps disabled. It is one of the quickest ways to tell whether a recently installed app is behind the issue. The exact method differs by manufacturer, but on many phones you can press and hold the power button, then touch and hold the on-screen Power off option until Safe Mode appears.
After the phone restarts, look for the Safe Mode label near the bottom of the screen. Use the device for a few minutes. If the pop-ups, redirects, or unusual behavior disappear, a downloaded app is the likely cause. If the issue remains, it could be related to the browser, a system setting, or a less common device-level problem.
Remove suspicious apps
Open Settings, then go to Apps or Apps & notifications. Sort apps by recently installed when that option is available, and review anything added shortly before the problem started. Be particularly cautious with apps that imitate familiar brands, promise unrealistic performance boosts, claim to clean your phone instantly, or have a generic name and icon.
Tap an unfamiliar app and select Uninstall. If you are unsure, search its name in the Play Store first. A missing Play Store listing, poor information, or reviews describing intrusive ads are useful warning signs.
Some unwanted apps resist removal by requesting elevated permissions. Before uninstalling, check Settings for Device admin apps, Accessibility, or Special app access. Disable suspicious administrator or accessibility access first, then try uninstalling again. Legitimate accessibility tools exist, so remove access only when you recognize the app and understand why it has that permission.
Check your browser and notification permissions
Browser-based scams can persist because a website has permission to send notifications. In Chrome, open Settings, then Site settings and Notifications. Remove or block unfamiliar sites. You can also clear browsing data, including cached images and files, to remove stored page content that may be contributing to repeated redirects.
Next, review app notification permissions in Android Settings. If an unfamiliar app is generating alerts, disable its notifications while you decide whether to remove it. This is also a useful way to separate normal app advertising from behavior that deserves closer attention.
Run Google Play Protect and update your phone
Open the Google Play Store, tap your profile icon, choose Play Protect, and run a scan. Play Protect checks apps obtained through Google Play and can identify known harmful apps. It is a sensible first-line check, though it may not catch every unwanted or newly created threat.
Then install pending Android security updates. Go to Settings and look for System update, Software update, or Security & privacy, depending on your device. Updates close known security weaknesses and may improve protection against unsafe apps.
If you want a second opinion, use a well-known mobile security app from the official Play Store. Install only one, run its scan, and remove it afterward if you do not need ongoing protection. Installing several cleaners or antivirus apps at once can create duplicate alerts, consume battery life, and make diagnosis harder.
When a factory reset is the right choice
A factory reset erases apps, accounts, settings, and files stored on the phone. It is the most reliable option when suspicious behavior continues after you remove questionable apps, when an app cannot be uninstalled, or when you believe account credentials may have been exposed.
Before resetting, back up photos, contacts, and documents you trust. Do not automatically restore every app or complete device backup afterward. Restoring an infected app can bring the problem back. Instead, set up the phone as new where practical, reinstall only necessary apps from the Play Store, and take a moment to review each permission request.
To reset most Android devices, open Settings and search for Reset options or Factory data reset. Keep the phone connected to power during the process. Once it restarts, install system updates before adding apps.
A reset cannot undo information that has already been shared. If you entered a password, card number, or other sensitive data after noticing suspicious activity, change the affected passwords from a different, trusted device. Start with your email account because it is often used to reset access to other services. Enable two-factor authentication where available, and contact your bank or card issuer if financial details may have been entered into a fraudulent page.
Prevent malware from returning
The safest Android habit is simple: install apps from Google Play or another source you fully trust, and avoid APK files shared through pop-ups, chat messages, or unfamiliar websites. Sideloading is sometimes necessary for advanced users, but it increases the need to verify the publisher, file source, and requested permissions.
Keep Android, your browser, and regularly used apps updated. Review permissions occasionally, especially for apps that request accessibility controls, notification access, the ability to install unknown apps, or device administrator rights. A flashlight app does not need access to your contacts, and a casual game rarely needs to manage your device.
Be skeptical of urgent messages saying your phone is infected, your storage is full, or a prize is waiting. Legitimate security services do not usually demand that you call a number, install an app from a pop-up, or pay immediately to fix a device.
Android security is not about never making a mistake. It is about noticing unusual behavior early, removing access from untrusted apps, and returning to a clean setup when the evidence calls for it. A few careful checks now can keep your phone useful, private, and far less stressful to manage.
