How to remove a virus from Android

what is Android malware?

Malware, short for malicious software, is software designed to secretly control a device, steal private information or money from the device’s owner.

Malware has been used to steal passwords and account numbers from mobile phones, put false charges on user accounts and even track a user’s location and activity without their knowledge. Learn about some of the most notable malware Lookout has blocked in Resources Top Threats.

How Android virus Spread?

Historically carried over from the old PC world, a “virus” is a program that replicates itself by attaching to another program. Hackers often used this method to spread their nefarious work, and virus became a popular term to refer to all types of malicious software (malware) on computers.

 In the case of smartphones, to date we have not seen malwacally on Android this does not exist, so technically there are no Android viruses. However, there are many other types of Android malware. Most people think of any malicious software as a virus, even though it is technically inaccurate.re that replicate itself like a PC virus can, and specific.

Types of mobile viruses

As mobile phones have become so integral to our lives, they have unfortunately also become that much more of a lucrative target for cybercriminals. This makes sense considering most of us store important information such as banking details and sensitive account info on our phones. Android viruses come in many flavors, each with its own quirks and entry vectors designed around a certain vulnerability. The following are the most common…

·         Spyware — This type of malware is designed to stealthily pick up information from your phone, and transmit it back to the C&C (command and control server). Spyware comes disguised as legit applications, which is how the cybercriminal tries to fool the user into installing them. Once installed, they start recording information including SMS/text messages, URLs being browsed, application activity, keys being pressed, usernames, and passwords.

·         Ransomware — This malicious program encrypts and locks up your important files, then offers to release them only if you pay a ransom. Spoiler alert: They almost never release the files. But given that so many users have very important data on their smartphones, the impulse to give in and pay is strong. (But don’t do it!)

·         Worms — These are the deadliest type of Android phone viruses. Designed to endlessly reproduce themselves, worms don’t need any user interaction in order to execute. They generally arrive via SMS, MMS, or other digital media.

·         Trojans — These piggyback on legit applications and infect your phone once it has been installed. Unlike worms, trojans need a user to install them before they can carry out their actions. Once activated, trojans can deactivate certain applications or lock-up your phone for a certain period of time.

Symptom of Android virus

Surge in data usage

One of the first things to check is your monthly data usage. This is generally located on your statement from your cellphone service provider or when you view your mobile account details online. Compare the amount of data used to data usage from the prior months and if you notice sudden spikes in your data usage even though you haven't really changed your usage patterns, then chances are you are infected.

Adware infected phones usually perform unsolicited clicks in the background to generate profit for cybercriminals. All of these stealthy tactics use up bandwidth and the unauthorized data they consume should be fairly easy to spot.

Unexplained charges

One other sure sign that your Android gadget is infected is by incurring unusual charges on your cellphone bill under the "SMS" category. This happens when your gadget is infected with malware that sends text messages to premium-rate numbers and charges you.

Sudden pop-ups

If you're starting to get annoying pop-up ads and notifications, unwanted reminders and nagging "system" warnings that just won't go away, then your Android phone may have been compromised. Malware can also add bookmarks that you don't want, website shortcuts to your home screen that you didn't create and spammy messages that entice you to click through.

Apart from slowing down your phone and eating away at your data, these intrusive notifications can also install more malware on your phone.

Unwanted apps

Keep an eye out for apps that you don't remember installing. Trojan malware, especially the adware, are known for automatically downloading further malicious apps without your knowledge. Also, cybercriminals try to mimic and clone legitimate apps to trick users into installing them but switch them out with malware via automatic app updates.

Battery drain

As you can imagine, all this unauthorized background activity not only takes a toll on your data usage, it can impact your battery life, as well. These battery-sucking viruses may be disguised in third-party apps and unreliable downloads, and once you install the program onto your Android, you'll start to see the drain almost instantly.

If you start noticing drastic reductions in your battery life and your phone is heating up even when idle, it might be infected with a virus

How to Remove Virus from Android Phone

First of all, it's worth pointing out that it's unlikely that your Android phone or tablet has a virus. What you're more likely to be seeing is an ad that wants to convince you Android is infected and you need to download an app, or a dodgy pop-up, or perhaps your device is just misbehaving. But viruses for Android do exist.

Step 1:

All Android viruses are delivered via apps installed on your device, so if your phone or tablet doesn't already have a virus, the best way to avoid it getting one is to never install software outside of the Google Play app store.

This is also true of the Gunpoder virus, which recently hit the headlines after Palo Alto Networks discovered it could sneak on to your phone via Nintendo game emulators installed outside Google Play - and even has the cheek to make you pay for the priviledge. 


Fortunately, Gunpoder hasn't been seen to affect UK users as of yet, but it's still worth taking measures to protect yourself from the Gunpoder virus and other Android viruses that may be released in the future.

More recently the Mazar virus has hit headlines, arriving on your phone via a link in a text message that downloads the Tor browser. Right now it appears to have affected devices only in Denmark, although it could potentially spread further. 

Step 2: 

To ensure you don't inadvertently install malware through the installation of apps outside of Google Play, open your Settings menu, look for the Security option, then ensure the option for Unknown Sources (allow installation of apps from unknown sources) is disabled.

If you're determined to install an app from outside Google Play, do your research. Check its permissions (does a video player really need to see your contacts?), look online for reviews and have a good look at the developer's site to see what else it offers. In the case of Gunpoder, be particularly wary of Nintendo game emulator apps. 

You can also install an antivirus app, and plenty of free Android antivirus apps are available that are able to detect and remove malicious apps, for example 360 Mobile Security, Avast and Lookout. These all include an app scanner that will seek out anything dodgy, but note that these apps can also trigger false-positives - reporting an app you've been using for months as malware when you know it's fine.


In most cases you can simply ignore these alerts. Also, again with Gunpoder in mind, these apps may not pick up on malicious behaviour if the app is able to hide it from them - Gunpoder uses the Airpush adware library to conceal that behaviour.  

If you believe you already have a virus on your Android phone or tablet - perhaps one that is resisting your attempts to uninstall the associated app or even let you bypass the lock screen - a factory reset will remove it, returning your device to its out-of-the-box state. But doing so also means you'll lose everything on your phone that's not backed up. Instead, follow the below steps to remove a virus from Android.

Step 3:

Put your phone or tablet into Safe mode. This prevents any third-party apps running, including any malware. On many devices you can press the power button to access the power off options, then press and hold Power off to bring up an option to restart in Safe mode. If this doesn't work for your device then you should Google 'How to put [your model name] into Safe mode' and follow the instructions. When in Safe mode you'll see 'Safe mode' at the bottom left of the screen.

Step 4:

Open your Settings menu and choose Apps, then make sure you're viewing the Downloaded tab. If you don't know the name of the virus you think has infected your Android phone or tablet, go through the list and look for anything dodgy-looking or that you know you haven't installed or shouldn't be running on your device. 

Step 5:

Tap on the malicious app (clearly it won't be called 'Dodgy Android virus', this is just an illustration) to open the App info page, then click Uninstall. In most cases, this is all you need to do to remove the virus, but occasionally you might find the Uninstall button is greyed out. This is because the virus has given itself Device administrator status. 

Step 6:

Exit the Apps menu and tap on Settings, Security, Device Administrators. Here you'll find a list of any apps on your phone or tablet with administrator status. Simply untick the box for the app you want to remove, then tap Deactivate on the next screen. You should now be able to return to the apps menu and remove that app. 

With the virus now off your Android phone or tablet, all you need to is restart the device to take it out of Safe mode. Now that it's working correctly it's a good time to back up whatever important data you have stored on the device, and install an Android antivirus app to protect you from any future viruses that come your way.