Malware · guide

How to remove virus from Android, the documented way

By Alberto Gulotta · Updated · 16 min read

How to remove virus from Android starts with a switch rather than an app: check Google Play Protect is on, take both pending updates, remove apps you did not get from the Play Store, and run the account security check-up. The scanner is already installed, and the useful question is whether it was ever turned off.

What Play Protect already does on the phone, before anything is installed Google states that Play Protect scans 200 billion Android apps every day, that it checks every app on a device regardless of where it was downloaded from, that it scans each device once a day, and that it is on by default. When it finds a harmful app it notifies the user, and where the app has no benefit it can remove it and block future installs. THE SCANNER THAT IS ALREADY THERE 200 billion apps a day Google’s own figure for what Play Protect scans Every app on the device “regardless of where the app was downloaded” Once every day on by default, and it can remove what it finds Which is why step one is a check, not an installation The useful question on Android is not which scanner to add. It is whether the one already running was ever switched off — and, if apps came from outside the store, whether the AI Tools Primer · figure
The one figure none of the three results on this question carries, and it changes what the first step should be. Figure drawn by AI Tools Primer.

Google’s first sign is not on the phone at all

Every list of symptoms opens with slowness, heat and battery drain, which are the three things a tired phone does anyway. Google’s own page opens somewhere else, and it is the most useful sentence on it: your device might have malware if “Google signed you out of your Google account to protect your device”.

That is worth more than any symptom you have to judge, because it is not a judgement. Either it happened or it did not. Google attaches a consequence to it too: “if you don’t get rid of malware from your device, you might get signed out again” — so a repeated sign-out is not a glitch to work around, it is the same message being sent twice.

The rest of Google’s list is grouped, and the grouping tells you where to look. On the device: virus messages, an antivirus program that no longer works, slowness, less space than before. In the browser: pop-up ads and new tabs that will not go away, unwanted extensions or toolbars that come back, pages going somewhere you did not ask for, a changed homepage or search engine. And one on its own, which belongs to neither: “your contacts get emails or messages from you, but you didn’t send them”.

That last one points at the account rather than the phone, which is why Google’s fourth step is a security check-up rather than another scan.

Google’s four steps, in its own order, with what each one is actually for. Quoted from the Google Account Help page on removing malware, read on 9 September 2026.
StepWhereWhat it is for
1. Turn on Play Protect Play Store › profile icon › Play Protect settings The scanner is already on the phone. This confirms it is switched on.
2. Take the updates Settings › Security & privacy › System & updates Two separate things live here: a security update and a Google Play system update.
3. Remove apps you do not trust Settings › Apps › See all apps Google’s test is not “suspicious” but “didn’t get from the Google Play Store”.
4. Check the account, not the phone myaccount.google.com/security-checkup The step people skip, and the one that stops you being signed out again.

Step one is a switch, not an installation

Here Android differs from the iPhone in a way that is worth stating plainly, because it changes the advice rather than just the tone. On Android a system-wide scanner genuinely exists, and it is already running. Google Play Protect “checks all apps on a device, regardless of where the app was downloaded”, scans each device once a day, and — Google’s figure, published in its developer documentation — “scans 200 billion Android apps every day” across the platform.

What it does when it finds something is documented rather than implied: it warns you, it “may deactivate or remove harmful apps from your device”, and “in cases where the PHA has no benefit to users, Google Play Protect can remove the PHA from affected devices and block future installs”. It also warns about apps that break Google’s unwanted software policy “by hiding or misrepresenting important information”, and it may reset the permissions of apps you have not used.

So the first step is to check it is on, not to add a second one: Play Store, profile icon, Play Protect settings, then Scan apps with Play Protect. Google states it “is on by default, but you can turn it off” — and a phone that has been through a few hands, or through an enthusiastic tutorial, is exactly the phone where it was turned off.

One setting sits underneath and matters more than it looks. If anything on the phone came from outside the Play Store, Google’s instruction is to turn on Improve harmful app detection, which sends unknown apps to Google to be examined. Without it, the apps most worth checking are the ones getting the least attention.

Then the other three, in Google’s order

Take the updates, and notice there are two. Under Settings, Security & privacy, System & updates there is a security update and a separate Google Play system update. They are not the same and one can be current while the other is months behind. Google’s own tip for when nothing appears is worth having: restart the phone and look again.

Remove apps you do not trust, in Settings, Apps, See all apps. Google’s test is more useful than “anything suspicious”, because it does not require you to guess: uninstall anything “that you don’t need, don’t trust, or didn’t get from the Google Play Store”. Origin is a fact you can check; suspiciousness is not.

And then leave the phone alone and check the account. Google’s fourth step is myaccount.google.com/security-checkup, and it is the one people skip because it does not feel like cleaning. It is the step that matches the first sign on Google’s own list: if something was signed in as you, removing an app does not sign it out.

The step Google’s page leaves out, and the honest thing about it

The official removal page does not mention safe mode. Google documents it separately, as a way to find a problem app rather than to remove one, and that distinction is the whole value: safe mode starts the phone without any downloaded apps, so it answers one question cleanly.

Google’s two outcomes are worth quoting because they include the one nobody wants: if the problem disappears, “an app is likely causing your problem”; and if it does not, “if the problem doesn’t go away, an app isn’t causing your problem”. The second is the more common result on a phone that is simply old, and it is a real finding rather than a failed attempt — it says to stop hunting for malware.

If the problem does go away, the method is a bisection, not a scan: exit safe mode, remove recently downloaded apps one at a time, and restart normally after each one until the problem stops coming back.

And here is the part that is easy to overstate. Google does not publish a single way in. Its page says “restarting in safe mode varies by phone. To learn how to restart your phone in safe mode, visit your manufacturer’s support site” — so a guide that hands you one key combination is describing somebody else’s handset. Google’s own practical warning is smaller and truer: safe mode removes some Home screen widgets, so take a screenshot first if you use them.

Safe mode as a bisection: what it proves, and what it does not Restart in safe mode, which loads the phone without downloaded apps. If the problem disappears, a downloaded app is causing it and can be found by removing recent apps one at a time with a restart after each. If the problem stays, no app is causing it and the fault is elsewhere. Google states that how to enter safe mode varies by phone. A TEST THAT ANSWERS YES OR NO, NOT A CLEANING Restart in safe mode downloaded apps do not load Use the phone normally, and watch the question is only whether the problem is still there Problem gone “an app is likely causing your problem” — exit, then remove recent apps one at a time, restarting after each Problem still there “an app isn’t causing your problem” — stop looking for malware and look at the hardware or the system Google does not publish one key combination: “restarting in safe mode varies by phone”, and it sends you to the manufacturer. Any guide giving a single combination is guessing at yours. AI Tools Primer · figure
The value is the negative answer: half the phones brought in for a virus leave safe mode still broken, which is the finding. Figure drawn by AI Tools Primer.

What is different here from the iPhone, in three lines

Same question, different machine, genuinely different answers — and the difference is not about which is safer.

A scanner exists, and you already have it Play Protect checks every app on the device whatever its origin, once a day, on by default. On iOS nothing can scan anything, because every app is sealed inside its own sandbox. That single fact is why the first step on the two platforms is not the same step.
Apps can come from outside the store, which is the trade It is the reason Android has a scanner and needs one, and the reason Google’s uninstall test is about where an app came from rather than how it looks.
The account is on the list either way Being signed out is Google’s first named sign, and messages your contacts received but you did not send is the last. Neither is fixed by anything you do to the handset.

What the first page of results does not have. On this question Google returns very few ordinary results: its own support page, which is short and stops at four steps; a forum thread of a few dozen words; and one long guide published by a company that sells security software. None of the three carries the figure that changes the first step — that the scanner is already installed and already running — and none of them mentions safe mode, which is the only step that can tell you the problem is not an app at all. Both facts are in Google’s own documentation, two clicks from the page that ranks first.

And the case where none of this applies. If the phone is an iPhone, almost none of it transfers: there is no scanner, no safe mode and no installing from outside the store, so how to remove virus from iPhone is a different procedure with different steps, and can iPhones get viruses explains why. If the trouble is a browser rather than a phone, pop-up ads have three separate causes.

Where to start

Three ways in.

“Is it even a virus?”
Google’s first sign — the sign
“Which scanner do I install?”
None: you have one — play protect
“I have done all that”
The test that gives a no — safe mode

The same question, other machines

What can be installed differs on each platform, so the removal steps differ with it.

How to remove virus from iPhoneThree settings, no scanner, and the configuration profile Apple documents twice.Open this guide → Can iPhones get virusesThe three mechanisms that make a self-spreading virus impossible, and what happens instead.Open this guide → Removing malware from a computerThe full sequence on Windows, and the four blind spots a single scan leaves behind.Open this guide →

When the phone is not the problem

Most of the symptoms on every virus checklist have duller and more likely causes.

Pop-up adsThree separate faults wear the same symptom, and only one is on the device.Open this guide → Android apps crashingThe order to work through, starting with the one that costs nothing.Open this guide → A phone that keeps restartingThe symptom safe mode was built for, and what it means when safe mode changes nothing.Open this guide → After a data breachWhat to do when the account was taken and the phone was never touched.Open this guide → Turning the pop-up blocker offThe browser setting on Android and on a computer, and Google’s route through Site settings.Open this guide →

Questions people also ask

How do I tell if my phone has a virus?

Google’s first named sign is not a symptom you judge: being signed out of your Google account to protect the device. After that, pop-up ads and new tabs that will not go away, extensions that come back, a changed homepage — and messages your contacts received that you did not send.

Does Android have a built-in virus cleaner?

Yes. Google Play Protect is on by default, scans the device once a day and checks every app “regardless of where the app was downloaded”. Google says it may deactivate or remove harmful apps, and can block future installs of ones with no benefit to users.

Does restarting your phone get rid of viruses?

Restarting normally changes nothing here. Restarting into safe mode does something more useful: it starts the phone without downloaded apps, so it tells you whether an app is the cause at all. If the problem persists in safe mode, Google’s conclusion is that no app is causing it.

How do I run a security check on my phone?

Two separate checks. On the device: Play Store, profile icon, Play Protect settings. On the account, which is Google’s fourth step and the one usually skipped: myaccount.google.com/security-checkup.

How do I get rid of a fake virus warning on Android?

A warning inside a web page is a web page. Close the tab and clear the browser’s site data. A warning that appears when the browser is closed is a notification an app or site was granted, and it is withdrawn in the browser or system notification settings.

Should I install an antivirus app on Android?

Google’s scanner is already there and covers apps from any source. The NCSC’s guidance is that antivirus is not needed on Android in its default configuration, and that running more than one product on a device gives minimal benefit and may cause conflicts.

Not covered here. It does not recommend an antivirus app. Google’s scanner covers apps from any source and is already running, and the NCSC advises against running more than one such product on a device at all.

It does not cover a work phone managed by an employer, where an administrator controls what can be installed and removed, and where the answer is to ask them rather than to uninstall.

And it does not cover rooted phones, where the protections this page relies on have been deliberately removed and none of the reasoning holds. What holds instead is simple: the four steps and their menu paths are quoted from Google’s own support page rather than reconstructed, the Play Protect figures come from Google’s developer documentation with the wording intact, the safe mode section says that Google publishes no single key combination instead of inventing one, and the one long guide on this question that sells security software is named as such.

Sources

  1. Google Account Help — Remove malware or unsafe software (Android): the four official steps and their menu paths, the statement that being signed out of your Google account to protect the device is a sign of malware and that it can happen again if the malware is not removed, the grouped list of signs on the device and in the browser, and the instruction to uninstall anything not needed, not trusted or not from the Play Store — support.google.com, read 9 September 2026.
  2. Play Protect — On-device protections, Google for Developers: that Play Protect scans 200 billion Android apps every day, that it checks all apps on a device regardless of where they were downloaded from, that it scans each device once a day, and that it can remove an app with no benefit to users and block future installs of it — developers.google.com, read 9 September 2026.
  3. Google Play Help — Use Google Play Protect to help keep your apps safe and your data private: the list of what Play Protect does, including deactivating or removing harmful apps and warning about apps that hide or misrepresent important information; that it is on by default but can be turned off; and the Improve harmful app detection setting for apps installed from outside the store — support.google.com, read 9 September 2026.
  4. Android Help — Find problem apps by rebooting to safe mode on Android: that entering safe mode varies by phone and that Google directs you to the manufacturer rather than publishing one method, the two conclusions to draw depending on whether the problem persists, the one-app-at-a-time removal method afterwards, and the warning that safe mode removes some Home screen widgets — support.google.com, read 9 September 2026.
  5. National Cyber Security Centre — Antivirus and other security software, Device security guidance: that antivirus products should not be needed on Chrome OS, Android and iOS in their default configuration; that Play Protect “acts much like a traditional AV product and regularly scans apps”; and that running more than one antivirus product on a device gives minimal benefit and may cause conflicts — www.ncsc.gov.uk, read 9 September 2026.

Written by Alberto Gulotta

Founder and editor of AI Tools Primer, writing from Palermo, Italy. Thirty-five years of taking computers apart, starting with a Commodore 64 — the long version is on the about page.

Something wrong on this page? Write to aitoolsprimer@gmail.com and it gets fixed.

Written on 9 September 2026.

Independence and limits

No affiliate links and no paid placements anywhere on this site. Nobody pays to appear here, and no company has seen this page before you did.

This is general information, not professional advice. Where a page touches money, health, safety or the law, it names its source and the date it was read — and your situation may still differ. See the privacy page and the cookie policy.