Your phone is suddenly full of pop up ads, the battery drains by lunchtime, and an app you never installed just appeared on your home screen. Learning how to remove virus from Android starts with an honest fact most guides skip: true self replicating viruses are actually rare on modern phones, and what you are dealing with is almost always adware, a scam app, or spyware instead. This guide walks through the full removal process, then goes further than most by explaining the one hidden permission behind the most stubborn infections, the reason an app sometimes refuses to uninstall at all, and what to do about it.
If Uninstall is greyed out or nothing happens when you tap it, skip ahead to the Accessibility Service section below before trying anything else. That is very likely the real reason removal is failing.
What People Actually Mean by an Android Virus
Classic viruses that copy themselves from file to file are genuinely rare on Android, largely because of how the operating system sandboxes each app away from the others. What people call an Android virus is almost always one of a few real threats: adware flooding your screen with ads, a scam app pretending to be something useful, spyware quietly monitoring your activity, or a trojan hiding inside an app that looked legitimate at install time. The fix differs slightly depending on which one you are actually facing, but the core removal steps below cover all of them.
Signs Your Android Phone Has Malware
| Sign | What it usually means |
| Ads appear outside any browser or app | Adware is running in the background |
| Battery drains fast even when idle | Something is running constantly behind the scenes |
| An app you cannot remember installing | A malicious app installed itself or was bundled with something else |
| Data usage spikes with no clear cause | Malware sending information out in the background |
| Phone runs hot or lags constantly | Heavy background CPU use from a malicious process |
| Unexpected charges or premium texts | A trojan silently sending premium rate messages |
How to Remove a Virus from Android Step by Step
- Disconnect from WiFi and mobile data first, this stops malware from communicating out or downloading anything further while you work.
- Restart your phone in Safe Mode, which disables all third party apps temporarily. Press and hold the power button, then press and hold Power off until the Safe Mode prompt appears.
- In Safe Mode, open Settings, then Apps, and scroll through your full app list for anything you do not recognize or did not intentionally install.
- Tap the suspicious app and select Uninstall. If the button is greyed out or does nothing, do not force close it yet, go to the Accessibility Service section below first.
- Clear your browser’s cache and data separately from uninstalling anything, since adware often leaves redirects and unwanted data behind in Chrome or your default browser.
- Restart normally, then open the Play Store, tap your profile icon, and select Play Protect to run a full scan.
The Hidden Reason Removal Sometimes Fails: Accessibility Service Abuse
This is the single most important thing missing from most guides on how to remove virus from Android, and it explains the most common real complaint people have: an app that simply will not uninstall no matter what they try. Modern Android malware, especially banking trojans, frequently abuses a legitimate feature called Accessibility Service. This feature exists to help apps assist users with disabilities by reading and interacting with the screen on their behalf. Malware abuses that same power to grant itself extra permissions, click through confirmation prompts automatically, and actively block its own removal.
- Open Settings, then search for Accessibility.
- Look through the list of enabled services for anything unfamiliar, oddly named, or tied to the suspicious app you found earlier.
- Turn off any service you do not recognize or do not remember enabling yourself.
- Return to Settings, then Apps, and try uninstalling the suspicious app again, it will very often work immediately now that its accessibility privileges are gone.
If Uninstall still fails after this step, check Settings, then Security, then Device admin apps next, since some malware layers device admin privileges on top of accessibility abuse for extra protection against removal.
Checking Device Admin Apps the Right Way
Revoking device admin access blindly can cause real problems, since some legitimate tools genuinely need it, Find My Device, a corporate mobile device management profile, or certain password managers among them. Before revoking anything, check whether the app requesting admin access is one you recognize and intentionally set up. If it is an app tied to the suspicious behavior you are troubleshooting, or something you do not recognize at all, revoke its access immediately. If you are unsure whether an admin app is legitimate, a quick search of its exact name will usually clarify whether it is a known tool or something to remove.
Notification Access: Another Permission Worth Checking
Alongside accessibility and device admin, Notification access is a third permission worth reviewing, since malware can use it to read and interact with your notifications, including one time codes sent by banking apps. Go to Settings, then Apps, then Special app access, then Notification access, and revoke it from anything that has no real reason to need it.
Google Play Protect vs a Dedicated Antivirus App
This is worth answering honestly rather than steering you toward a purchase either way. Google Play Protect is built into every Android device with Google Play Services and automatically scans apps both before and after installation, catching a large share of known malware with zero setup. For most people who stick to the Play Store and follow the steps in this guide, Play Protect alone is genuinely enough.
A dedicated antivirus app adds real value in specific situations: if you frequently sideload apps from outside the Play Store, if you want real time scanning of links and downloads as they happen rather than periodic checks, or if you want an extra layer specifically because a device has already been infected once and you want closer ongoing monitoring. Treat it as a genuine option for those situations rather than an automatic requirement for everyone.
Enable and Run a Full Play Protect Scan
- Open the Google Play Store app.
- Tap your profile icon in the top right corner, then select Play Protect.
- Tap the gear icon and confirm both scanning toggles are switched on.
- Tap Scan to run an immediate check of every app on your device.
- Review any flagged apps and follow the removal prompt if something is found.
When a Factory Reset Is Actually Necessary
If malware persists after working through every step above, a factory reset is the reliable last resort. Back up your photos and important files first, ideally to a computer rather than a cloud backup, for a reason most guides skip entirely: if your cloud backup includes app data, restoring from it after a reset can reinstall the exact malicious app you just wiped, along with whatever gave it accessibility or device admin access in the first place. Set up your phone fresh after a reset, reinstalling only apps you choose deliberately from the Play Store, rather than restoring a complete backup blindly.
Common Problems and How to Fix Them
| Problem | Likely cause | Fix |
| Uninstall button is greyed out | The app has Accessibility Service or device admin access | Revoke both permissions first, then try uninstalling again |
| Phone will not boot into Safe Mode | Some malware interferes with the power menu | Hold Volume Down plus the power button during startup, or check your specific model’s Safe Mode combination |
| Malware reappears after a factory reset | It was reinstalled through a cloud backup restore | Set up the phone fresh and reinstall apps individually instead of restoring a full backup |
| Play Protect finds nothing but symptoms continue | The threat may be a browser based scam rather than an installed app | Clear all browser data and check installed browser extensions or unusual default apps |
Locking Things Down After Cleanup
- Go to Settings, then Apps, then Special app access, and check Install unknown apps, disabling it for anything that does not genuinely need to sideload software
- Change passwords for any account you accessed on the phone while it was likely infected, starting with email and banking
- Review app permissions periodically rather than only after an infection, since a permission granted months ago is easy to forget about entirely
- Stick to the Play Store for app installs going forward, and read permission requests before accepting rather than tapping through them automatically
Types of Android Malware You Might Actually Be Dealing With
| Type | What it does |
| Adware | Floods your screen with ads, sometimes outside any app or browser, and can track activity for ad targeting |
| Spyware | Quietly monitors activity, messages, or location, often hidden inside a seemingly normal app |
| Trojan | Disguises itself as a legitimate app while performing malicious actions in the background, including banking trojans that abuse Accessibility Service |
| Ransomware | Locks or encrypts files and demands payment, less common on Android than on desktop but still real |
| Scam or fake update app | Impersonates a system update or popular app to trick you into installing it directly |
Prevention: Keeping Your Phone Clean Going Forward
- Install apps only from the Play Store, and be skeptical of anything asking you to sideload an APK from a link or text message
- Read permission requests at install time rather than tapping through automatically, and question why a flashlight app would need access to your contacts
- Keep your Android version and all apps updated, since updates frequently patch the exact vulnerabilities malware relies on
- Avoid tapping links in unexpected texts or emails, even ones that appear to come from a service you use
- Check Accessibility Service and device admin permissions every few months as routine maintenance, not just when something already feels wrong
Frequently Asked Questions
Can Android phones actually get viruses?
True self replicating viruses are rare due to Android’s app sandboxing. Most real world infections are adware, scam apps, spyware, or trojans instead, and the removal steps in this guide address all of them.
Why won’t a suspicious app uninstall from my phone?
This is very often caused by the app abusing Accessibility Service or device admin permissions to block its own removal. Revoke both permissions under Settings before attempting to uninstall it again.
Is Google Play Protect enough, or do I need a separate antivirus app?
For most people who install apps only from the Play Store, Play Protect alone is genuinely sufficient. A dedicated antivirus app adds real value mainly if you sideload apps regularly or want continuous real time scanning.
Will a factory reset definitely remove the virus?
Almost always, yes, but only if you set the phone up fresh afterward. Restoring a cloud backup that includes app data can reinstall the same malicious app along with whatever permissions let it persist in the first place.
Conclusion
Knowing how to remove virus from Android comes down to working through the process in the right order, disconnect, boot into Safe Mode, find and remove the suspicious app, and check Accessibility Service and device admin permissions specifically if removal is not going smoothly. Play Protect covers most people well with zero extra cost, and a factory reset remains a reliable last resort as long as you set the phone up fresh afterward rather than restoring a backup that might carry the problem right back with it. A few careful minutes now, working through the real cause rather than just the symptoms, is what actually gets your phone clean and keeps it that way.