Start with Google Play Protect, then check unfamiliar apps and the special access they hold. If the problem happens only in Chrome, it may be a website notification or deceptive page rather than an infected phone. Pop-ups, heat, or battery drain alone do not prove malware; look for unexplained changes, suspicious access, or account and financial activity.
Which signs of Android malware deserve attention?
Malware is broader than a traditional computer virus. Google’s Android malware policy covers potentially harmful applications, including threats such as trojans, phishing, spyware, and malicious software that can steal credentials, transmit personal data, control a device, send spam, or commit fraud. Google’s Android malware policy uses the broader category “potentially harmful applications” (PHAs); not every intrusive or deceptive app has the same capabilities or risk.
| Sign | How to interpret it | What else could explain it? |
|---|---|---|
| Play Protect warns about an app | High-priority warning: follow the removal or disable instructions and investigate the app. | A detection can be mistaken, but do not restore or re-enable the app unless Google or your device maker confirms that. |
| An unfamiliar app appeared near the time trouble began | Concerning, especially if installed from an APK, link, file manager, or unofficial store. | It may be preinstalled by the manufacturer or carrier, or restored from a backup. |
| Unusual permissions or special access | Concerning when access is unrelated to what the app claims to do. | Legitimate apps sometimes need sensitive access; consider the app’s purpose and developer. |
| Persistent pop-ups, new tabs, or browser redirects | Investigate whether they appear outside the site or app that normally shows ads. | A website’s notification permission, a deceptive page, or an app can cause them without proving a system-wide infection. |
| Unexplained messages, password resets, unfamiliar logins, or financial transactions | Urgent: possible account or financial compromise, whether or not malware is installed. | Someone may have obtained credentials through phishing or another route. |
| Battery drain, heat, slowness, crashes, high data use, or low storage | Weak clues on their own; investigate, but do not treat them as a diagnosis. | An aging battery, poor reception, background syncing, an app update, or low free storage can cause similar problems. |
Google lists unfamiliar apps, persistent pop-ups, browser changes, and other unusual behavior as warning signs, not proof of infection. A phone can also be slow or unstable for ordinary reasons. Google says Android problems may occur when less than 10% of storage is free; treat that as a troubleshooting threshold, not a malware indicator. Google’s malware guidance and Android storage and troubleshooting guidance explain these possibilities.
Run Google Play Protect first
- Open Google Play Store.
- Tap your profile picture or initial, then tap Play Protect.
- Review the displayed security status and last scan, and run a scan if the option is shown.
- From Play Protect, open Settings and confirm Scan apps with Play Protect is on.
- If you have installed apps from outside Google Play, turn on Improve harmful app detection.
Google says Play Protect checks apps from Google Play and other sources, and supports periodic, on-demand, and real-time checks. Depending on its assessment, it may warn you, block an installation, disable an app, or remove it. Google’s Play Protect instructions describe the user-facing controls; Google’s technical overview explains its coverage and protections.
#1 Best Overall
- Android Security & protection
- Daily Virus Database checkup and updates
- Scan Apps and Files
- System Cleaner Integrated
- Virtual Private Network (VPN)
A clean result means Play Protect did not detect a known or sufficiently suspicious app at that time. It does not certify every app, rule out specialized threats, confirm that your accounts are safe, validate a website’s notifications, or show that your phone has the latest security update.
Find apps you do not recognize
Check both the Play Store and your phone’s Settings. Pay particular attention to apps added around the time the symptoms began, apps installed from an APK or link, and apps whose purpose or developer you cannot verify. An unfamiliar name is a reason to investigate, not by itself proof of malware.
Review the Play Store list
- Open Google Play Store and tap your profile icon.
- Tap Manage apps & device, then Manage.
- Review installed apps and, if your version offers it, sort or inspect them by recently added.
- Choose an app you do not need or trust, then tap Uninstall.
Google documents this route, while noting that some app-management steps vary by Android version. Android’s app-removal instructions provide further guidance.
Rank #2
- Payment Protection – lets you to shop and bank safely online
- Proactive Anti-Theft – powerful features to help protect your phone, and find it if it goes missing:
- Anti-Phishing – uses the ESET malware database to identify scam websites and messages
- Call Filter – block calls from specified numbers, contacts and unknown numbers
- Antivirus – protection against malware: intercepts threats and cleans them from your device
Inspect Settings
On many phones, open Settings → Apps or Apps & notifications → See all apps, select an app, and choose Uninstall. Labels vary among Pixel, Samsung Galaxy, Motorola, OnePlus, Xiaomi, and other devices. Use Settings search for terms such as Apps, App permissions, Special app access, Accessibility, and Device admin apps rather than assuming one path fits every phone. Do not delete system components at random.
Free tools Windows power users keep installed
One-click scans. No signup required.
Review permissions and special access
A permission is not evidence of malware by itself. Ask whether the access makes sense for the app’s stated job, and revoke access you cannot justify. Pay closest attention to these controls:
- Accessibility: Can support assistive features, but an abusive app may use it to read or interact with screen content.
- Notification access: May expose private notifications, including messages and one-time codes.
- SMS and calls: Sensitive access that can be abused in fraud or account takeover.
- Device administrator: May make an app harder to remove.
- Display over other apps: Can be used to put deceptive screens over other apps.
- Install unknown apps: Lets an app initiate software installation from outside Google Play.
- VPN: Can route network traffic through the app.
- All files access: Broad storage access that should have a clear purpose.
- Camera, microphone, location, and contacts: Check for grants or use that do not fit the app’s function.
Battery use and unrestricted background activity can help identify persistent activity, but neither proves malware. Android’s Security & privacy overview can help locate controls: Google says Android 13 and later commonly combine them there, while Android 12 and earlier may show separate Security and Privacy menus. Google’s menu guidance covers this version difference.
Rank #3
- - Light weight, lightning quick scanning of apps
- - Automatic scanning of newly installed apps to protect against a breach by malware, spyware, trojan and virus threats
- - Notifies you of harmful apps with the option to remove them immediately
- - Online virus definition updates to ensure that you always have the latest version available
- - Extremely low battery usage
Use Safe Mode if the app will not uninstall or symptoms persist
Safe Mode temporarily disables downloaded apps. If the problem stops there, a downloaded app becomes a more likely cause, though Safe Mode does not identify the app automatically. Entry steps vary by manufacturer; Google’s general instructions for persistent pop-ups describe this common method:
- Press and hold the phone’s power button.
- Touch and hold Power off.
- Confirm the option to reboot into Safe mode, if your phone offers it there. Some devices use a different button combination.
- Uninstall recently downloaded apps one at a time.
- Restart normally after each removal and check whether the symptom returns.
If an app resists removal, first check whether it has device-administrator rights or an enabled Accessibility service. Revoke the relevant special access, remove the app from Device admin apps if listed, then try uninstalling again. If the phone is managed by an employer or another organization, ask its administrator before changing management controls. Do not use ADB or bootloader tools unless you understand the risks and are following device-specific support guidance. Google describes Safe Mode and app troubleshooting in its Chrome pop-up and malware instructions and Android troubleshooting guidance.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →If the warning or pop-up appears only in Chrome
A webpage can display a fake “your phone has a virus” alert to pressure you into installing an app, calling a number, or paying. A site may also have permission to send notifications. Neither situation alone proves the phone has an installed infection. Do not tap a suspicious clean, update, call support, or download antivirus button, and do not install an APK offered by the page.
Rank #4
- THREAT DETECTION – Stay one step ahead. Suspicious links, risky sites, viruses, and scams, caught automatically before they reach you.
- PERSONAL INFO PROTECTION – Keep your personal info safer. Identity monitoring watches for your exposed info and tells you what to do about it.
- SECURE CONNECTIONS – Just a few easy clicks, and we'll automatically protect your info on public Wi‑Fi, every time you connect.
- GUIDED ACTION – Know what matters and what to do next. Clear alerts and simple guidance make it easy to take action.
- MORE THAN ANTIVIRUS – Scam protection, identity monitoring, VPN, web protection, and antivirus work together to protect you, all in one place.
- Close the suspicious tab without interacting with its alert.
- For unwanted site notifications, open Chrome and go to the offending site if needed.
- Tap the page-information icon, then Permissions → Notifications.
- Turn notifications off for that site.
- Keep Chrome’s Safe Browsing protections enabled and check whether unfamiliar apps or redirects remain outside that site.
Google recommends avoiding suspicious program-update or download pop-ups and documents how to revoke website notification access in its Chrome guidance. A real unsafe-download warning should also be treated differently from a webpage trying to sell you a cleaner.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Secure accounts and money if anything was exposed
If you see unfamiliar logins, sent messages, changed recovery details, password-reset messages you did not request, or financial activity you cannot explain, act on the account side as well as the phone. Removing an app does not undo stolen credentials or revoke every session.
- Use a different, trusted device if possible, especially if the suspect phone may have screen-reading or remote-control access.
- Change your Google password and review Google Security Checkup; sign out sessions you do not recognize and verify two-step verification.
- Change important passwords entered on the suspect phone, prioritizing email, banking, payment, and social accounts.
- Contact your bank or payment provider through its official app or phone number if a transaction, payment detail, or financial login is in question.
- Check sent messages, recovery details, and recent account activity for changes you did not make.
Google includes Security Checkup in its Android malware response guidance.
Best Value
- Real-Time Virus Protection: Detect and remove malware, spyware, and viruses instantly.
- Junk File Cleaner: Clear unnecessary files to free up valuable storage space.
- Battery Saver: Extend your device’s battery life with efficient power-saving tools.
- Privacy Scanner: Keep your personal data secure with advanced privacy protection features.
- Wi-Fi Security: Detect and avoid unsafe networks to ensure secure online browsing.
Install available Android and security updates
Check the operating-system update, Android security update, and Google Play system update separately; an update in one category does not necessarily update the others. On Google’s generic Android interface:
- Open Settings → System → Software updates to check for an Android update.
- Open Settings → Security & privacy → System & updates.
- Check Security update and Google Play system update.
Menu labels depend on Android version and manufacturer. If no update appears, restart and check again. Older devices may no longer receive current patches; consult the manufacturer or carrier for that model’s support status. Google gives these update steps in its malware guidance.
When to factory-reset—and what to prepare
A reset is a later escalation, not the first response to one pop-up or a warm phone. Consider it if symptoms persist after app removal, Play Protect checks, updates, and Safe Mode troubleshooting; you cannot identify or remove a suspected app; an unknown administrator controls the device; or there is strong evidence of persistent compromise. A reset may also be appropriate before handing the phone to another person.
Prepare before wiping
- Back up photos and necessary files, but avoid preserving or reinstalling an app or APK you suspect.
- Confirm that you know the Google Account password and can use its recovery methods.
- Export authenticator or passkey data where applicable, and record important app names and licenses.
- Contact your bank first if financial fraud is occurring.
- Preserve the device and relevant evidence if it is part of a workplace, legal, or personal-safety investigation; seek appropriate professional advice before wiping.
A factory reset removes local data and uninstalls apps with their associated data. It does not repair a compromised online account, and restoring a malicious app or APK can bring the problem back. Google warns that a reset erases phone data and recommends backing up first. Android reset and troubleshooting guidance and Google’s reset instructions explain the process.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →When to get help
- Manufacturer or carrier: The device remains unstable, you cannot safely identify a system or preinstalled app, or the problem continues in Safe Mode.
- Workplace IT or device administrator: The phone is employer-managed or supervised.
- Bank or payment provider: You find unauthorized transactions or suspect payment details were exposed.
- Qualified security professional: Malware returns after a reset, the phone contains sensitive business, health, or legal information, or you cannot safely determine what was changed.
Do not assume a paid scanner is required before using Play Protect, reviewing apps and access, and testing Safe Mode. If uncertainty remains, a reputable second-opinion scanner from Google Play may be an option, but no single scan can guarantee a device or account is clean. Avoid installing multiple always-on scanners or any tool promoted by a suspicious pop-up.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
