How to Remove Malware or a
Virus from Your Android Phone
Battery draining unusually fast, pop-up ads appearing from nowhere, apps you didn't install, data usage spiking — these are the warning signs. Here's how to confirm an infection and remove it.
Last updated: July 2026 · 7 min read
Warning Signs Your Android Has Malware
Battery draining much faster than usual
Malware runs in the background continuously — mining crypto, transmitting data, or displaying hidden ads. Battery drain of 30–50% faster than normal without a new app installation is a red flag.
Pop-up ads appearing on the home screen or outside apps
Ads that appear even when you're not browsing are a clear sign of adware installed on your phone.
Data usage has spiked without explanation
Malware often uploads your data to remote servers. Check Settings → Network → Data Usage for apps using unusual amounts of background data.
Apps you didn't install appear on your phone
Some malware downloads additional apps silently. If you see apps you don't recognise — especially with generic names — investigate immediately.
Phone heats up even when idle
Constant background processing causes abnormal heat. If your phone is warm even when the screen is off and nothing is actively running, something is working in the background.
Your contacts receive strange messages from you
SMS or WhatsApp messages sent from your account that you didn't write suggest your phone or account has been compromised.
Step 1: Find and Uninstall Suspicious Apps
Check all recently installed apps
Go to Settings → Apps → sort by installation date. Look for anything installed around the time the problems started. Pay attention to apps with generic names, no clear purpose, or apps you don't remember installing.
Check apps with Device Admin permissions
Settings → Security → Device Admin Apps. Legitimate apps that need this: your company's MDM software, banking apps sometimes. Anything else with Device Admin should be removed immediately.
Look for apps with Accessibility permissions
Settings → Accessibility → Downloaded Apps. Malware often abuses Accessibility to capture what you type and tap. Remove any app here that doesn't obviously need it (screen readers, disability tools).
Uninstall any APK-installed apps
Apps installed from outside the Play Store (APK files shared via WhatsApp, Telegram, or websites) bypass Google's security scanning. If you installed any APK recently, that's the most likely infection source.
Step 2: Run Google Play Protect
Open the Play Store → tap your profile icon → Play Protect → tap Scan. Google Play Protect scans all installed apps against Google's malware database. It's built-in, free, and updated continuously — and it's usually the best scanner available for Indian Android phones.
If Play Protect finds something, follow the removal instructions. If you want a second opinion, Malwarebytes for Android (free version) is reliable and doesn't itself contain adware — a common problem with third-party antivirus apps from lesser-known developers.
Step 3: If the Problem Persists — Safe Mode and Factory Reset
Boot into Safe Mode
Hold the power button → long-press "Power off" until Safe Mode appears → tap OK. In Safe Mode, only system apps run — third-party apps are disabled. If the problems disappear in Safe Mode, a third-party app is the culprit. Identify and uninstall it.
If you can't find the app: Factory Reset
Settings → General Management → Reset → Factory Data Reset. This removes everything and returns the phone to factory state. Back up your photos, contacts, and WhatsApp first (Google Drive backup for contacts; WhatsApp drive backup for chats).
Restore only from trusted sources
After reset, don't restore from a backup if you suspect the backup itself is infected. Reinstall apps individually from the Play Store rather than restoring an app backup.
After Removing Malware: Change These Immediately
Google account password
Any password you typed while infected may have been captured by a keylogger.
WhatsApp two-step verification PIN
Enable or change it under WhatsApp → Settings → Account → Two-step verification.
Banking app PINs and UPI PIN
Change your UPI PIN in GPay, PhonePe, or Paytm. Change your banking app login password too.
Disable "Install Unknown Apps"
Settings → Apps → Special App Access → Install Unknown Apps. Revoke this permission from every app.
The Single Best Prevention: Never Install APKs from WhatsApp
The overwhelming majority of malware on Indian Android phones comes from APK files shared via WhatsApp or Telegram — fake versions of popular apps (GPay, Truecaller, IRCTC), "free" versions of paid apps, and "government apps" shared during news cycles. If an app isn't on the Play Store, don't install it regardless of who sends it.