To remove malware from Android, use the phone’s trusted security controls, identify the unwanted app and uninstall it if you can do so safely. Update the device, review any access the app had, and secure exposed accounts from a different trusted device. A factory reset is a later option for unresolved problems, not the first response to every pop-up.
These steps are for a phone you own or are authorised to manage. If you are still unsure whether the problem is malware, start with our guide to checking a phone for signs of infection. Battery drain and slowness alone are not a diagnosis.
Before You Remove an App
If someone close to you may be monitoring the phone, use a different trusted device to get specialist safety advice before making changes. Removing monitoring software or changing account access may alert that person, and a reset can destroy evidence you may need.
On an employer- or school-managed device, contact IT first. Legitimate management and security tools can have extensive permissions. Their presence, or an unavailable uninstall button, does not by itself prove malware.
If there are unauthorised payments, password-reset messages or unfamiliar logins, deal with those immediately from another trusted device. Contact the affected provider or bank. Avoid entering further sensitive information on the suspect phone while you investigate.
Remove Malware Using Android’s Security Controls
The sequence below follows Google’s Android malware-removal guidance, with additional precautions for app access and recovery. Menu names vary by manufacturer. If your phone has no Google Play services, use its manufacturer’s documented security tools.
- Open Google Play Store > your profile picture > Play Protect and run a scan. Follow any warning identifying a harmful app. Open the feature directly rather than installing a scanner advertised by a frightening webpage.
- Check Settings for system and security updates, and install available app updates from your trusted store. Look under System, Software update or Security & privacy, depending on your device. Restart when requested.
- Open Settings > Apps and identify the app linked to the warning or the start of the problem. Check its name, developer and purpose. Uninstall it through Android’s app controls if it is unwanted and you are authorised to remove it.
- If removal is blocked, check whether the phone or app is managed by an organisation. For an app you have confirmed is unwanted on your own device, review its device-administrator or accessibility access using the manufacturer’s guidance. Do not disable legitimate management or accessibility services merely to get past a restriction.
- Restart the phone, check whether the original behaviour returns, and run the trusted security check again. If a warning remains, or you cannot safely identify what is responsible, stop guessing and contact the manufacturer or your IT team.
A familiar-looking icon is not enough to establish that an app is legitimate, but an unfamiliar name is not enough to establish that it is malicious. Avoid deleting system components or installing several “cleaners” in succession. Record the exact warning and app name so support can investigate the same issue.
Check That Play Protect Is Still Enabled
In Google Play Store, open your profile > Play Protect > Settings and check that Scan apps with Play Protect is enabled. A previous clean scan is less useful if a suspicious installer persuaded you to switch the protection off afterwards. Keep the protection enabled while investigating.
For apps installed outside Google Play, review Improve harmful app detection. Google explains that enabling it allows unknown apps to be sent to Google for assessment, so understand that data-sharing choice. Do not reinstall a removed app or turn protection off merely because an unsolicited support message says the warning is a mistake. If you believe a trusted app was wrongly flagged, contact its verified developer.
Use Safe Mode if an App Prevents Normal Troubleshooting
Safe mode temporarily disables downloaded apps and can help you investigate behaviour that prevents ordinary removal. If the problem disappears there, a downloaded app may be involved; that result does not prove which app is responsible or that malware is present.
Use your manufacturer’s instructions because the button combination varies. For example, Google’s Pixel safe-mode instructions use Power and Volume Up to open the power menu on Pixel 6 and later, followed by touching and holding Power off or Restart and confirming safe mode. Other models use different controls.
Remove a confirmed unwanted app, then restart normally. If you are troubleshooting several recently installed apps, change one thing at a time and check the result. If the problem persists even without downloaded apps running, seek support instead of assuming a more aggressive cleaner is required.
If the Problem Is Browser Ads or Notifications
Repeated ads can originate from a website’s notification permission rather than a malicious installed app. Removing unrelated apps will not solve that permission problem.
In Chrome, review the offending site’s permissions and disable unwanted notifications. Google’s Chrome guidance covers unwanted software and site notifications. Other browsers have their own site-permission controls.
Close scam tabs without using their support numbers or download buttons. If you clear a site’s data as part of troubleshooting, expect that you may need to sign in again. Clearing browser data does not uninstall a malicious Android app or repair an account whose credentials were stolen.
Also review downloaded installation files if the incident began with a download. Removing an unwanted installer can help prevent accidental reuse, but deleting that file alone does not uninstall an app already installed from it. Do not reopen a suspicious package to “check” it.
When a Factory Reset Is Appropriate
Consider a reset when unwanted behaviour or security warnings persist after the supported cleanup steps, or when the manufacturer recommends it. It is a disruptive recovery measure that erases local data and apps. It is not an assurance against every possible form of compromise.
Before proceeding, use Google’s reset preparation guidance and your manufacturer’s exact instructions. Confirm that you know the Google Account credentials and screen-lock details needed afterwards, and that you can access your recovery methods. Google advises waiting 24 hours after changing the Google Account password before a reset.
Back up essential personal files and confirm what the backup includes. Make sure any authentication or recovery information you need will remain accessible. If evidence may be important, get advice before erasing the device.
After resetting, update the phone and reinstall only apps you recognise and need from verified sources. Avoid immediately restoring every app and configuration without reviewing them. If the same problem returns before you reinstall apps, contact the manufacturer; repeated resets are not a diagnosis.
Secure Accounts and Reduce the Chance of Recurrence
Device cleanup and account recovery are separate jobs. If credentials may have been exposed, use another trusted device to change affected passwords, review recovery details and remove unfamiliar account sessions. Enable additional sign-in protection where available. Deal with financial activity through the bank or payment provider.
Keep security updates enabled and investigate prompts to install software or grant sensitive access. A supported device with sensible app choices is a stronger foundation than an unsupported phone with several security subscriptions.
If you are considering ongoing additional protection, our guide to whether Android phones need antivirus explains when it may help. Do not treat buying a product, a clean scan or a quiet day as proof that all exposed information has been recovered.
Frequently Asked Questions
Will uninstalling a harmful app remove the malware?
It can resolve the problem when that app is the source, but it does not undo stolen data or account access. Follow any remaining security warnings and investigate persistent symptoms rather than assuming removal settles every consequence.
Why is the Uninstall button unavailable?
Some system apps and managed apps cannot be removed through the usual controls. Device-administrator access may also affect removal. Identify the app and who manages the phone before changing permissions; a disabled button alone is not evidence of malware.
Can I remove Android malware without a factory reset?
Often, the supported first steps are a trusted security check, updates and removal of the identified unwanted app. A reset is a later option for unresolved problems and requires preparation for data loss and account sign-in.
Related Articles
Share this article
Stuart Kerr Spindlow is Impulsec’s Publisher, Chief Editor and Lead Reviewer. He writes and maintains coverage of consumer cybersecurity and digital-safety software, with a focus on practical suitability, limitations and the evidence behind product claims. Read Stuart’s full profile.