Is Your Android Infected? How to Check and Clean It Properly

A red banner just told you your phone has 13 viruses and you need to tap now. Take a breath before you go looking for how to remove a virus from your Android phone. That banner is almost certainly an ad, and tapping it is the only thing in this scenario that can actually infect you.

The quick answer: The overwhelming majority of “your Android is infected!” warnings are scam ads on a web page, not real detections: no legitimate scanner announces itself in a browser pop-up. Real Android malware is uncommon and usually arrives one of three ways: an app sideloaded from outside the Play Store, an app that was granted Accessibility or Device Admin permissions it had no reason to want, or a browser notification you accidentally allowed. To check properly, run a scan with Google Play Protect (it’s already on your phone, inside the Play Store), boot into safe mode to see if the symptoms stop, then audit which apps hold Accessibility, Device Admin, and “display over other apps” permissions. Skip the third-party “cleaner” and “antivirus” apps entirely: on Android they’re mostly theatre, and some are the problem.

Here’s how to tell whether anything is actually wrong, and how to clean it up if it is.

First: is that warning even real?

If the message appeared while you were browsing, inside a web page, with a countdown timer, a battery-damage claim, a fake system dialog, or a prompt to install an app. It’s an ad. Full stop. Web pages cannot scan your phone. They can read your browser’s user agent, guess your phone model and Android version, and print it back at you to look convincing. That’s the whole trick.

What to do: close the tab. Don’t tap anything inside the page, including the X, which is often part of the ad. Use the back gesture or your browser’s tab overview to close it. If the page won’t let you leave, close the browser from the recents screen entirely, then reopen it and clear the tab.

Real signals look different. Google Play Protect warnings appear as system notifications from the Play Store, not as web pages. If your phone genuinely blocks something, it says so quietly and it doesn’t ask for money.

The symptoms that actually suggest a problem

Ignore vibes and look for specifics. A phone that’s slow because it’s five years old and 97% full is not infected. These are the patterns worth investigating:

• Full-screen ads that appear outside any app: on your home screen or lock screen, with no app open. This is the clearest single sign of adware.
• An app you don’t remember installing, especially one with a generic name and a generic icon.
• An app that has no icon in the launcher but shows up in the app list in Settings.
• Battery draining hard and the phone running warm while idle, with an unfamiliar app at the top of battery usage.
• Data usage spiking with no explanation, particularly on an app that shouldn’t use the network.
• Your browser homepage or default search changed without you doing it.
• SMS or messages sent from your number that you didn’t write.
• You can’t uninstall an app. The uninstall button is greyed out. That’s usually Device Admin, and it’s a deliberate malware tactic.

If none of those apply and your only symptom is “it feels slow,” you’re looking at a performance issue, not an infection.

Step 1: Run Google Play Protect properly

Play Protect is built into every phone with the Play Store and it scans apps automatically, but you can run it on demand. Open the Play Store, tap your profile icon, and choose Play Protect. Tap Scan. It’ll check the apps on your device and report anything harmful.

While you’re there, check that the setting to scan apps is turned on, and consider enabling the option to improve harmful app detection, which sends unknown apps to Google for analysis. If Play Protect has been disabled, that itself is a warning sign. some malicious apps ask you to turn it off during installation, and people do it without thinking.

Be realistic about its limits. Play Protect is good at known threats and at the sideloading vectors that matter most. It’s not going to catch a brand-new targeted attack. But it’s free, already installed, has real system access, and doesn’t have an incentive to invent findings to sell you a subscription. That last part is exactly what most third-party scanners can’t say.

Step 2: Boot into safe mode and watch

Safe mode starts Android with all third-party apps disabled. It’s the fastest way to prove whether an installed app is the cause.

On most phones: press and hold the power button, then press and hold the “Power off” option on screen until a “Reboot to safe mode” prompt appears, and confirm. You’ll see a “Safe mode” label in the corner when it boots. (The exact method varies a bit by brand, so if that doesn’t work, look up the sequence for your model.)

Now use the phone for a few minutes. Do the pop-up ads stop? Does the battery drain settle? If yes, a third-party app is your culprit and you can go find it. If the symptoms are identical in safe mode, the cause is something else. A system-level issue, a browser notification, or simply not malware at all.

To leave safe mode, just restart normally.

Step 3: Audit the three permissions that matter

This is the part almost nobody does, and it’s where the real answers are. Android malware doesn’t break in. It asks, and gets told yes. Three permissions do nearly all the damage.

Accessibility

Accessibility services can read what’s on your screen and tap on your behalf. That’s essential for genuine accessibility tools and screen readers, and it’s also the single most abused permission on Android. It’s how malware reads your banking app and dismisses its own uninstall dialogs.

Go to Settings → Accessibility and look at the list of installed services. Anything enabled here should be something you deliberately turned on and can explain. A flashlight app, a wallpaper app, or a “battery saver” with Accessibility access has no legitimate reason for it. Turn off anything you don’t recognise.

Device admin apps

Device admin gives an app the power to lock or wipe the phone, and, importantly, it blocks normal uninstallation. If you’ve ever hit a greyed-out uninstall button, this is why.

Find it under Settings → Security (look for “Device admin apps” or “Device administrators”; the search bar will find it). Legitimate entries are things like Find My Device or your employer’s work profile management. Anything else, deactivate it: then the uninstall button works again.

Display over other apps

This is what lets an app draw on top of everything else, which is how those out-of-nowhere full-screen ads happen. Look under Settings → Apps → Special app access → Display over other apps. Revoke it from anything that isn’t a messaging bubble, a screen recorder, or something you specifically want overlaying.

While you’re in Special app access, it’s also worth glancing at “Install unknown apps”. That’s the list of apps allowed to install other apps. If your browser or a file manager has it and you don’t need it, switch it off.

Step 4: Clean up browser notifications

A huge share of “my phone keeps showing spam” cases are not malware at all. They’re web push notifications from a site you tapped “Allow” on months ago. They look like system alerts, they arrive when the browser is closed, and they’re often the exact fake virus warnings people panic about.

In Chrome: tap the three dots → Settings → Site settings → Notifications, and revoke everything you don’t want. Do the same in any other browser you use. On some skins you can also long-press the notification itself and turn off that channel directly.

This one fix resolves more “infection” reports than everything else on this page combined.

Step 5: Remove the offending app

Once you’ve identified it, uninstalling is normal: long-press the icon and uninstall, or go to Settings → Apps → the app → Uninstall. If the button is greyed out, revoke its Device Admin access first (step 3), then try again.

If it still won’t uninstall, do it from safe mode. With third-party apps disabled, the malware can’t run its interference, and the uninstall goes through cleanly.

After removal, change the passwords for anything sensitive you used on that phone: email first, then banking. If the app had Accessibility access, assume it could see what you typed.

Why we’re not telling you to install an antivirus app

Android’s security model is different from a desktop PC’s. Apps are sandboxed and can’t freely inspect other apps’ files. That means a third-party “antivirus” on Android can’t do deep scanning the way a desktop product can. It mostly checks package names against a list, which is the same job Play Protect already does with far deeper system access and no upsell.

What those apps do instead is bundle “boosters,” “cleaners,” and “battery optimizers” that either do nothing or actively hurt: force-closing apps that then relaunch costs more battery than leaving them alone. Some of the most aggressive adware on Android has shipped inside apps marketed as cleaners. Installing one to solve an adware problem is a genuine risk, not just wasted space.

The honest exception: if you’re managing a device for someone who repeatedly sideloads apps, a reputable name-brand security suite adds a second opinion. For everyone else, Play Protect plus not sideloading is the entire realistic defence.

If nothing works: the reset

If you’ve done all of the above and the symptoms persist, a factory reset clears the user partition, which is where essentially all Android malware lives. Back up your photos and files, sort out your two-factor codes before you wipe, and restore carefully afterwards, and don’t blindly restore an app backup that might reinstall the culprit. Reinstall apps manually so you can see what’s going back on.

If the problem survives a factory reset, the malware is baked into the system image. That happens on some very cheap unbranded devices sold through marketplaces. There’s no user-level fix, and the device isn’t trustworthy.

How to not need this article again

• Install from the Play Store (or your phone’s own official store). Sideloading is the main entry route for real malware.
• Read what an app asks for. If a wallpaper app wants Accessibility, that’s the whole answer.
• Say no to notification prompts from sites you don’t trust.
• Keep the phone updated. Security patches close the holes that don’t need your permission.
• Don’t tap ads that shout at you. Urgency is the product.

A lot of what gets blamed on viruses is really a phone that’s out of storage and out of headroom. If your actual complaint is slowness rather than pop-ups, our guides on freeing up storage without deleting anything and hidden settings that speed up your phone will do more for you than any scanner.

Frequently asked questions

Can an Android phone get a virus from just visiting a website?

Not in the classic sense. A web page can’t install software on its own. It has to convince you to download and install something, or to allow notifications. Browser-based drive-by exploits do exist in rare, sophisticated cases, which is exactly why keeping your phone patched matters. But a normal scary pop-up cannot infect you unless you act on it.

How do I check if a specific app is safe before installing it?

Check the developer name and whether they have other credible apps. Read the recent one-star reviews, not the overall rating. Look at the permission list on the store page and ask whether each one makes sense for what the app does. Be suspicious of an app with millions of downloads and a handful of vague reviews, and of anything that’s a clone of a popular app with a slightly different name.

Does clearing my browser cache remove malware?

It removes tracking data and can stop a stubborn redirect page from reloading, so it’s a reasonable step. It does not remove an installed malicious app, because that app doesn’t live in the browser. Clear the cache, but also revoke notification permissions and check your installed apps.

My phone is showing ads on the lock screen. Is that malware?

Possibly, but check the boring explanation first. Some budget phones ship with ad-supported lock screens or “recommendation” features from the manufacturer, and there’s usually a toggle to turn them off in the lock screen or wallpaper settings. If there’s no such setting and the ads are full-screen and unbranded, look at the “Display over other apps” permission list. That’s where the culprit will be.

Related: How to Block Ads on Android Without Installing Anything