First, separate real symptoms from myths: a slow phone, fast battery drain or heat on their own are not signs of a virus, they are signs of an ageing device or full storage. What really points to a malicious app is ads showing up outside any app, an icon you never installed, unexplained data usage and apps opening by themselves. Start with the Play Protect scan (Solution 1), which is free and already on the phone. If it finds nothing but the symptoms continue, restart in safe mode (Solution 3): if the ads stop, an app you installed is the cause, and Solution 4 shows how to find the culprit. If the Uninstall button is greyed out, the app registered itself as a device administrator and you have to remove that permission first (Solution 5). And be wary of cleaner or antivirus apps downloaded outside the official store: they are frequently the problem itself.
What causes this problem
- An app installed outside the official store, from an installer file downloaded on a website, a message group or a promotional link.
- An app that looked normal on the official store and, after an update, started showing aggressive ads outside itself.
- An accessibility or overlay permission granted without much thought, giving the app the power to draw over other screens and read what appears on them.
- A cleaner, booster or antivirus app of dubious origin, which shows fake alerts to push you into installing more things.
- A device on an old Android version with no security updates for a long time, more exposed to already known flaws.
- A work profile or an app installed by someone else with physical access to the phone.
- List the real symptoms you can observe: full-screen ads when no app is open, an unknown icon, data usage out of the ordinary, apps opening on their own. Slowness and weak battery alone do not belong on that list.
- Remember whether the problem started right after you installed something. If so, that is the main suspect, however harmless it looks.
- Make sure your important data is saved: photos synced to the cloud and contacts tied to your Google account. Some later solutions involve removing apps or, at worst, resetting the device.
- Do not install any new cleaner or antivirus app right now. Run the checks with what is already on the phone first.
- Have your Google account password and your screen lock code to hand. You will need them at some steps.
Solutions, in the order to try them
1Run the Play Protect scan that is already on the phone
Android has its own free scanner that examines installed apps and flags the ones known to be dangerous. It does not catch everything, but it catches most of what circulates in installer files from outside the store, and it is the quickest, risk-free way to start.
- Open the Google app store and tap your profile picture in the top right corner.
- Choose Play Protect and tap Scan.
- If it flags an app, use the uninstall option it offers right there.
- While on that screen, check in its settings that app scanning is switched on. If it is off, turn it on.
2Review the app list and remove anything you do not recognise
The full app list shows things the icon drawer hides. Plenty of unwanted apps use a generic name, something like 'System', 'Service' or 'Update', counting on you not looking closely. Sorting by install date puts recent arrivals at the top.
- Open Settings and go to the apps section, where the full list of installed apps lives.
- If there is a sort or filter option, choose to show the most recent first.
- For every name you do not recognise, tap it and check the developer and the install date.
- Uninstall the ones you neither recognise nor use. If a system-sounding name leaves you unsure, leave it alone - the next step will help identify it.
3Restart in safe mode to confirm an app is to blame
Safe mode starts Android with only the apps that shipped with the phone and nothing else. If the ads and freezes disappear in that mode, it is proven that an app you installed is the cause rather than a fault in the device. Nothing is deleted, and a normal restart brings everything back.
- Hold the power button until the menu with the power off option appears.
- Tap and hold Power off until the phone asks whether you want to reboot to safe mode, and confirm.
- Notice the safe mode label that appears in one of the corners of the screen.
- Use the phone for a few minutes and watch whether the symptom continues.
- To leave, restart normally. If the symptom stopped in safe mode, move on to Solution 4.
4Find the guilty app through the permissions it asked for
Ads that appear over other apps and apps that act on their own rely on two specific permissions: display over other apps, and accessibility. Ordinary apps rarely need both. Looking at who holds those permissions usually points straight at the culprit.
- In Settings, find the apps section and open the special app access area.
- Go into display over other apps and switch the permission off for any name you do not recognise.
- Go back and open the accessibility list, in the phone's accessibility settings. Turn off every service that is not an accessibility feature you deliberately use.
- Also check notification access and usage access, in the same special access area.
- After switching them off, watch for a few hours. The app whose removal stopped the symptom is the one to uninstall.
5Remove the device administrator permission before uninstalling
If the Uninstall button looks greyed out or the app comes back on its own, it registered itself as a device administrator app. That permission exists for legitimate company and find-my-device tools, but unwanted apps abuse it so they cannot be removed. Take the permission away and uninstalling works normally again.
- In Settings, use the search to find device administrator apps (the path usually sits in the security area).
- Look at the list and switch off anything that is not a feature you recognise, such as Google's find-my-device or your employer's tool.
- Confirm when the phone asks you to.
- Go back to the app list, open the problem app and tap Uninstall. The button should work now.
- If it still refuses, remove it from safe mode, where the app is not running to defend itself.
6Check data usage app by app
A malicious app usually sends information out, and that shows up as data usage on an app you barely touch. This screen also helps with the opposite case: a high mobile bill and no visible ad symptoms at all.
- Open Settings and go to the network and internet section, then data usage.
- Choose to view data usage by app over the monthly period.
- Look for unfamiliar names or apps you never use occupying the top positions.
- For a suspicious app you are not ready to remove yet, turn off its background data access and watch whether the symptom changes.
7Clean the browser and remove website notifications
Plenty of people think they have a virus when in fact they allowed notifications from a dubious website at some point. They show up in the notification bar looking like system messages, even with the browser closed. It is not a virus and removing it is straightforward.
- Open the browser and go into its settings, through the three-dot menu.
- Look for the site settings area and then notifications.
- Remove permission for every site you do not recognise or no longer want alerts from.
- In the same site settings area, also clear the stored site data.
- If the alerts came from a page that opens by itself, check as well that there is no extra browser app installed that you do not recognise.
8Update Android and, as a last resort, factory reset
Security updates close the flaws that malicious apps use to hide. And when nothing works and the symptom persists even in safe mode, a factory reset is the definitive clean-up. Warning: it erases everything on the phone. Back up first, and when restoring your apps, reinstall them one at a time instead of accepting the automatic restore, so you do not bring the problem back.
- In Settings, look for system update and install whatever is available, including the Google Play security update.
- Check that your photos are synced to the cloud and your contacts are on the Google account before any reset.
- To reset, go to Settings and look for reset options, then choose to erase all data.
- When setting up again, decline the option to restore all apps automatically and reinstall only the ones you use, from the official store.
- Change your Google account password and those of your important accounts afterwards, preferably from another device.
Applies to
| System | Status |
|---|---|
| Android 12 to 15 (Google Pixel, Motorola, Xiaomi, Samsung Galaxy) | Confirmed |
| Android 9 to 11 | Confirmed |
| Android 8 or older | The device no longer receives security updates; the solutions work, but the risk stays high |
Menu names can change slightly between versions. If a step above does not match what you see on screen, the official support page from the manufacturer has the most current wording for your version.
Frequently asked questions
Last checked: Jul 20, 2026 · We review this guide whenever the manufacturer changes the process.