How to Remove a Virus From Your Android Phone in 2026
Remove Android malware yourself with this 2026 guide, from Safe Mode uninstalls to Play Protect scans and a last-resort factory reset.
Your Android phone is suddenly hot in your pocket, the battery barely lasts until lunch, and strange pop-up ads appear even on the home screen. Maybe an app you never installed keeps asking for permissions, or your data usage has spiked for no reason. These are classic signs of Android malware, and the good news is that you can usually remove it yourself without paying for help. This guide walks you through every step, from quick checks to a full factory reset, using tools built into Android 16 and a few trusted free scanners.
To remove a virus from your Android phone, restart in Safe Mode, uninstall any apps you do not recognise, revoke suspicious device administrator rights, then run a Google Play Protect scan and a Malwarebytes free scan. If the malware persists after all that, back up your photos and files and perform a factory reset, which wipes everything including the infection.
How to tell your phone is really infected
Before tearing your phone apart, confirm the symptoms point to malware rather than a dying battery or a buggy update. The red flags include pop-up ads appearing outside of apps, unfamiliar apps appearing on their own, the battery draining much faster than usual, the phone overheating while idle, unexplained data usage spikes, and settings changing without your input.
Some of these overlap with other problems, so it is worth ruling out a hack of your accounts too. Our guide on how to tell if your phone is hacked covers the difference between a compromised device and compromised accounts, which need different fixes.
Before you start: three things to do first
- Stop signing in to sensitive accounts. If the malware includes a keylogger, every password you type could be captured. Use another device for banking and email until the phone is clean.
- Back up what matters. Sync photos and files to Google Drive or your computer now, because a factory reset may become necessary and it erases everything.
- Note the suspects. Scroll through your app list and write down anything you do not remember installing, especially apps with generic names like System Update, File Manager Pro or Battery Saver.
Remove the malware step by step
Work through these in order. Most infections are gone by step five; the later steps are for stubborn cases.
- Restart in Safe Mode. On Android 16, press and hold the power button, then long-press the Power off option and tap OK when Safe Mode is offered. In Safe Mode, third-party apps cannot run, which stops most malware from defending itself. Google’s Safe Mode instructions cover the exact steps for every Pixel and most other phones.
- Uninstall suspicious apps. Go to Settings, then Apps, then See all apps. Remove anything unfamiliar or anything you noted earlier. If the Uninstall button is greyed out, the app may have device administrator rights, which brings us to the next step.
- Revoke device administrator rights. Go to Settings, then Security and privacy, then Device admin apps (the exact path varies by manufacturer). Switch off admin rights for any app you do not trust, then go back and uninstall it.
- Clear your browser and check for rogue profiles. Clear Chrome’s browsing data and check Settings, then Passwords and autofill, for unknown entries. Also look under Settings, then Network, for any VPN or private DNS you did not set up, and remove it.
- Run a Google Play Protect scan. Open the Play Store, tap your profile icon, then Play Protect, then Scan. Play Protect is on by default and scans billions of apps daily across the Android ecosystem, according to Google, but a manual scan catches anything it missed on your device.
- Run a second opinion scan. Install Malwarebytes from the Play Store and run its free on-demand scan, or try Bitdefender Mobile Security, whose paid plans start at about $15 a year. Our roundup of the best antivirus software compares the options in detail. Remove whatever the scan finds, then uninstall the scanner afterwards if you prefer to keep things light.
- Check for persistent tricks. Some malware hides as a system app or reinstalls from a malicious APK left in your Downloads folder. Delete unknown APK files, and check Settings, then Apps, for apps installed from unknown sources.
- Factory reset as a last resort. If symptoms persist, back up your data and go to Settings, then System, then Reset options, then Erase all data. A factory reset wipes the malware along with everything else. Set the phone up fresh rather than restoring a full backup, in case the backup carries the infection.
Quick comparison: your removal options
| Method | What it removes | Data loss | When to use it |
|---|---|---|---|
| Safe Mode uninstall | Suspicious third-party apps | None | First step for any suspected infection |
| Play Protect scan | Known malicious apps | None | Quick automated check |
| Malwarebytes or Bitdefender scan | Broader malware families | None | When Play Protect finds nothing |
| Factory reset | Everything, including stubborn malware | All local data | Last resort for persistent infections |
How malware gets onto Android phones
Almost no Android malware arrives on its own. The most common route is sideloading: installing APK files from outside the Play Store, often disguised as free versions of paid apps or game mods. Google reported blocking 2.36 million policy-violating apps from the Play Store in 2024, but malicious apps still slip through briefly, which is why a second scanner is worth having.
Other routes include phishing links in text messages that install malicious configuration profiles, fake system update prompts on shady websites, and trojanised apps that look legitimate for weeks before downloading their malicious payload. If your PC is affected too, the cleanup process differs, so see our guide on how to remove malware from Windows 11.
Keep your phone clean going forward
- Install updates promptly. Android 16’s monthly security patches close the holes malware exploits. Turn on automatic updates if you have not already.
- Keep Play Protect on and avoid disabling it, even temporarily, for a sideloaded app.
- Install apps only from the Play Store and check reviews and developer names before installing anything obscure.
- Review permissions yearly. A torch app does not need your contacts. Revoke anything excessive under Settings, then Privacy, then Permission manager.
- Use Advanced Protection if you are a higher-risk user. Android 16 expanded Google’s Advanced Protection Mode with intrusion logging and stronger sideloading blocks.
Frequently Asked Questions
Can Android phones get viruses?
Strictly speaking, most Android viruses are trojans, adware or spyware rather than self-replicating viruses, but the effect is the same: stolen data, intrusive ads and drained batteries. Android’s sandboxing makes true viruses rare, which is why almost all infections come from apps the user installed themselves.
Does a factory reset remove all Android malware?
Almost always. A factory reset wipes the data partition where malware lives, and it defeats everything except extremely rare firmware-level infections. Set the phone up as a new device afterwards rather than restoring a full backup, and reinstall apps only from the Play Store.
Is Google Play Protect enough to keep my phone safe?
Play Protect is a solid baseline and it is always on by default, but independent tests show dedicated scanners like Malwarebytes and Bitdefender catch more. Think of Play Protect as a seatbelt: essential, but not a reason to skip everything else.
Should I install an antivirus app on my Android phone?
For most careful users, Play Protect plus good habits is enough. Install a reputable scanner like Malwarebytes or Bitdefender if you sideload apps, click lots of links, or want a second opinion during a cleanup. Avoid obscure free antivirus apps, since some are adware themselves.
How do I boot an Android 16 phone into Safe Mode?
Press and hold the power button until the power menu appears, then long-press the Power off option. Tap OK when asked to reboot into Safe Mode. You will see a Safe Mode badge in the corner of the screen. Restart normally to exit.
Conclusion
Android malware looks scary, but it is almost always removable with patience and the right order of operations: Safe Mode, uninstall the suspects, revoke their admin rights, then scan with Play Protect and a second opinion tool. Reserve the factory reset for infections that survive all of that. The deeper lesson is prevention, because nearly every infection starts with an app the user chose to install. Keep Play Protect on, update promptly, and treat sideloaded APKs with suspicion, and you will rarely need this guide again.
