Driver FixRecommendedSound, Wi-Fi or graphics acting up? Check drivers firstFind missing or outdated drivers fast.Check DriversHalloween DealsAmazon USHalloween week deals: useful picks before month-endAmazon US: current deals, useful picks and tech finds.Check DealsPC HealthRecommendedCrashes, freezes, slowdowns? Check your PC nowSpot repairable issues before they interrupt work.Check PC×
FREEDOM251

Freedom251 › Blog › Android

How to Remove Malware From an Android Phone Without a Factory Reset

By Freedom251 Team · · 8 min read

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

In many cases, you can remove suspected malware without erasing your Android phone. Start with Google Play Protect, install every available system and security update, remove unfamiliar or recently installed apps, and use Safe mode to isolate an app that will not identify itself. Then review your Google Account security. These steps preserve your photos, messages, and settings unless you choose to uninstall a specific app.

Pop-ups, redirects, slow performance, and unexpected account activity are warning signs, not proof of malware. If the symptoms continue after these checks, Google says a factory reset or help from the phone manufacturer may be necessary.

As an Amazon Associate I earn from qualifying purchases.

What counts as a possible malware warning sign?

Android behavior can become unusual for many reasons, including a buggy app, an unwanted browser notification, a nearly full device, or an account problem. Treat the following as clues that justify a check, not as a diagnosis:

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
  • Persistent pop-ups that appear outside the app you are using.
  • Unexpected sign-outs from your Google Account.
  • A phone that becomes unusually slow.
  • Browser redirects or changes to the browser’s home page or search behavior.
  • Messages sent from your accounts without your action.

Record when the behavior started and which app or website was open. That timeline helps you identify a recently installed app or a browser permission without deleting anything unnecessarily.

#1 Best Overall
Sale
TOZO A1 Wireless Earbuds Bluetooth 5.3 Light Weight in Ear Headphones | IPX5 Waterproof,2 Mics for AI Calls,Immersive Premium Sound Bass Headset with Charging Case,32 EQ via App Black
  • [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
  • [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
  • [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
  • [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
  • [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.

Choose the least-disruptive fix first

Action What it does Disruption When to use it
Play Protect scan Checks installed apps, including apps obtained outside Google Play, and can warn about, disable, or remove harmful software. Low First check for any suspected app infection.
System and security updates Installs available Android, security, and Google Play system fixes. Low Run alongside the scan, especially when the device is behaving unusually.
Uninstall an untrusted app Removes that app and its local data from the phone. Moderate Use when an app is unfamiliar, recently installed, or flagged by your investigation.
Safe mode Temporarily disables downloaded apps so you can compare the phone’s behavior. Low Use when symptoms continue or an app resists diagnosis.
Factory reset Erases phone data and returns the device to its reset state. High Last resort when signs remain after the no-reset steps; back up first.

Step 1: Run Google Play Protect

Play Protect is built into the Play Store and scans apps from Google Play as well as apps installed from other sources. It can display a warning, disable an app, or remove an app it identifies as harmful.

  1. Open the Google Play Store.
  2. Tap your profile picture or profile icon.
  3. Choose Play Protect.
  4. Review the scan result and start a scan if one is not already running.
  5. Open Play Protect settings and make sure app scanning is enabled.

Menu names and their exact placement can vary by Android version and manufacturer. If you installed an app outside Google Play, enable improved harmful-app detection in Play Protect settings when that option is available. This allows Google to examine potentially harmful apps from outside the Play Store more closely.

Follow the action shown for a flagged app. A warning is a reason to remove or investigate that app, not a reason to install another “virus detector” advertised in a pop-up. If Play Protect reports no problem but the symptoms continue, proceed with the remaining steps; a clean scan does not explain every browser, account, or software problem.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Step 2: Install Android and security updates

Out-of-date system components can leave known problems unresolved, so check updates before spending time on more disruptive measures. Android presents these controls in different places depending on the phone maker and software version.

Rank #2
Sale
Smart Watch for Men Women Compatible with iPhone Samsung Android Phone 1.69 inch Full Touch Screen IP68 Waterproof Bluetooh Fitness Tracker Heart Rate/Sleep Monitor (Black)
  • 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
  • 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
  • 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
  • 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
  • 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
  1. Open Settings.
  2. Look for entries named System update, Software update, or a similar label.
  3. Check for an Android system update and install it if offered.
  4. Return to Settings and look for a Security update or Android security update.
  5. Check for a Google Play system update as well.
  6. Restart when Android requests it, then observe whether the original behavior returns.

Keep the phone connected to power when an update is large, and use a reliable Wi-Fi connection if your device or plan requires it. The important point is to check all three categories—Android system, security, and Google Play system—because they may be presented as separate controls.

Step 3: Review and remove untrusted apps

Look for apps you do not recognize, apps you installed immediately before the symptoms began, and apps that came from a source you do not trust. Do not remove a system component merely because its name is unfamiliar; focus on downloaded apps you can identify.

  1. Open Settings.
  2. Open Apps, Apps & notifications, or the equivalent app-management screen.
  3. Sort by recently installed or recently updated if your phone offers that option.
  4. Open an app’s information page and verify its name, installation date, and permissions as shown by your device.
  5. Choose Uninstall for an app you no longer trust, then confirm.
  6. Restart the phone and check whether the specific symptom has stopped.

Uninstalling removes the app and its local data. If you need information stored only inside that app, consider whether you can export or otherwise preserve it before removal. Do not reinstall the app merely to test it again if Play Protect or your own investigation identified it as suspicious.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

If Android will not let you uninstall an app, do not assume that the app is definitely malware. Some legitimate apps have device-administration privileges or are managed by an employer or school. Continue with Safe mode and the device maker’s support instructions rather than repeatedly tapping a suspicious pop-up.

Rank #3
New Bee Guitar Cable 10ft Electric Instrument Bass AMP Cord | 6.35mm Jack, Durable Design, Stage and Home Studio Use, Low Noise Shielded Electric Cord for Bass, Keyboard, Amp, Mixer
  • [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
  • [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
  • [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
  • [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
  • [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by

Step 4: Use Safe mode to isolate downloaded apps

Safe mode is a diagnostic state, not a malware remover by itself. It temporarily disables downloaded apps while leaving the core Android system available. The method for entering Safe mode differs by manufacturer and Android version, so use the power-menu instructions specific to your phone.

  1. Enter Safe mode using your manufacturer’s method. Android normally displays a Safe mode label on the screen when it succeeds.
  2. Use the phone for long enough to reproduce the original behavior: open the browser, check notifications, or perform the task that exposed the problem.
  3. If the symptom stops in Safe mode, restart the phone normally.
  4. Remove recently downloaded apps one at a time.
  5. After each removal, restart normally and check whether the symptom returns.

Removing one app at a time gives you a clear cause-and-effect check. If you delete several apps together, you may lose the ability to identify which one caused the behavior. When the symptom does not stop in Safe mode, a downloaded app is less likely to be the immediate cause; continue with updates, browser-permission checks, and account security rather than assuming the phone is clean.

Step 5: Check whether the “malware” is actually a website notification

Some alarming messages are notifications that a website was allowed to send through Chrome. They can look like security warnings even when no malicious Android app is installed. If the messages appear only as website notifications, investigate the browser’s site-notification permissions first.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
  1. Open Chrome.
  2. Open the three-dot menu and choose Settings.
  3. Open Site settings or Notifications, depending on the version.
  4. Review websites allowed to send notifications.
  5. Block or remove permission for a site you do not recognize.

Labels can vary, and other browsers use different menus. The deciding clue is where the alert originates: a message tied to one website and the browser’s notification system calls for a permission review, while behavior that continues across apps warrants the broader Play Protect, update, uninstall, and Safe mode sequence.

Rank #4
BSIMB 15.6" Digital Family Calendar & Chore Chart, No Subscription Fees
  • Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
  • Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
  • All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
  • Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
  • Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

Step 6: Review Google Account security

Malware can affect accounts as well as the phone. An unexpected sign-out or a message sent without your action should therefore trigger an account review even if Play Protect finds nothing.

  1. Open your Google Account settings from the phone or a trusted browser.
  2. Open Security Checkup.
  3. Review the issues it presents and complete the recommended account-security actions.
  4. Check again after removing a suspicious app or completing an update, especially if the original symptom involved account activity.

Keep the phone’s malware investigation and the account review connected: removing an app does not by itself explain messages or sign-ins that already occurred, and an account problem can continue after the phone appears normal.

Step 7: Verify that the problem is gone

Do not judge the result solely by whether one pop-up disappeared. Verify the conditions that originally raised concern.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
  • Use the browser and apps that previously showed redirects or pop-ups.
  • Confirm that the phone is no longer unexpectedly slow during the same tasks.
  • Check whether Google Account sign-outs or unrequested messages recur.
  • Run Play Protect again after removing an app or installing updates.
  • Confirm that Safe mode is no longer active after the final restart.

If the behavior returns only after a particular app is installed, uninstall that app and avoid restoring it from an untrusted source. Use software from official sources and treat unsolicited “your phone has a virus” pages as untrusted messages rather than as instructions to download a scanner.

Troubleshooting branches when the first steps do not work

What you observe Next move Why
Play Protect flags an app Follow its warning, disable or remove the app as directed, then restart and verify. Play Protect can warn about, disable, or remove harmful apps.
The problem stops in Safe mode Restart normally and remove recent downloaded apps one by one. Safe mode temporarily disables downloaded apps, making an app-related cause more likely.
The problem appears only as Chrome notifications Review and revoke the responsible website’s notification permission. A website permission can produce alarming alerts without an installed malware app.
The phone remains affected in Safe mode Complete updates and Account Security Checkup, then seek manufacturer help if signs persist. The issue is not being suppressed by disabling downloaded apps.
Unexpected account activity continues Address the issues shown by Google Account Security Checkup and continue the device investigation. Phone symptoms and account compromise can overlap but are not identical problems.

When a factory reset becomes necessary

A factory reset is not the first step in Google’s malware-removal sequence. It is a fallback when the warning signs continue after Play Protect, updates, app removal, Safe mode testing, browser-permission checks, and account review—or when the phone maker determines that a reset is required.

A reset is disruptive because it erases phone data. Before starting one, back up the data you need and confirm that you can sign back in to the accounts and services you use. The exact reset menu varies, but it is generally found in Settings under a system, reset, or backup-and-reset section. Read the confirmation screen carefully so you understand what will be deleted.

“If you find signs of malware, you might need to reset your Android device or ask the company that made your device for help.”

What’s actually slowing this PC down?

Pick the symptom - the matching free tool is one click away.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Google Account Help, “Remove malware or unsafe software,” undated page accessed October 13, 2026

If you cannot complete the no-reset steps, the phone behaves abnormally even in Safe mode, or you are unsure which system component is involved, contact the manufacturer before experimenting with advanced changes. Manufacturer-specific instructions are safer than generic button combinations that may vary by model.

How to avoid repeating the problem

  • Keep Play Protect app scanning enabled.
  • When available, enable improved harmful-app detection for apps obtained outside Google Play.
  • Install Android, security, and Google Play system updates when offered.
  • Review the source before installing an app, and prefer official distribution channels.
  • Review browser notification permissions when a warning is tied to one website.
  • Use Safe mode as a diagnostic comparison instead of deleting many apps at once.
  • Review Google Account Security Checkup when you see unexpected sign-outs or account activity.

These controls address different failure points: Play Protect examines apps, updates address system software, Safe mode isolates downloaded apps, browser settings handle website notifications, and Security Checkup addresses the account. Using them in that order gives you the best chance of resolving a suspected infection without wiping the phone.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

AndroidGoogle Play ProtectMalware Removalphone securitySafe Mode

Leave a Reply

Your email address will not be published. Required fields are marked *

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Recommended PC Tool
Recommended PC Tool
Windows Errors? Fix Them Before They SpreadFree repair scan
Crashes, No Sound, or Screen Glitches?Free driver scan

Two free Windows tools

One Free Minute Could Fix That PC

Before you go - each of these free tools takes about a minute and tackles what quietly slows a Windows PC down.

Special offer. View Outbyte info, uninstall instructions, EULA, and Privacy Policy.