Start with Google Play Protect, then install Android and security updates, remove apps you do not trust, and review your Google Account. Those steps can remove ordinary malicious software, but they cannot prove that every form of surveillance is gone.
If a partner, family member or another person may be monitoring the phone, pause before deleting anything. Changes can alert the person, remove evidence or increase danger. Use a device and account they cannot access to make a safety plan before you clean or reset the phone.
As an Amazon Associate I earn from qualifying purchases.
What “spyware” can mean on Android
Spyware is software that collects information or activity from a device without the owner’s informed consent. It may try to read messages, record location, access photos or observe activity. When someone close to you secretly installs monitoring software to control or track you, safety organizations commonly use the term stalkerware. Stalkerware is a personal-safety issue as well as a technical one.
Free tools Windows power users keep installed
One-click scans. No signup required.
Battery drain, unusual data use, pop-ups, overheating, crashes or an unfamiliar app are clues, not proof. The same symptoms can come from an aging battery, a faulty app, account takeover, forwarded messages, shared passwords or someone who has physical access to the phone. A person can also learn information through a Google, cloud, carrier or social account without installing spyware on the handset.
#1 Best Overall
That is why removal has two parts: check the phone itself and secure the accounts connected to it. If another person may be monitoring you, do the planning from a safer device rather than assuming an on-phone cleanup is invisible.
Choose a response path before changing the phone
| Situation | First response | Main benefit | Main risk or limitation |
|---|---|---|---|
| You suspect an ordinary malicious app | Run Play Protect, update Android, review installed apps and remove software you do not trust. | Uses built-in Android checks and can address detected harmful apps without erasing personal data. | A clean scan does not establish that all surveillance is absent. |
| You suspect secret monitoring by a partner, relative or another person | Use a safer device to consider safety, evidence and account access before removal. | Reduces the chance that a change immediately alerts the person or removes information you may need. | Leaving the phone unchanged for a period can feel uncomfortable and may allow monitoring to continue. |
| Signs continue after scanning and app review | Prepare for a factory reset or contact the phone manufacturer. | A reset removes phone data, apps and their data. | It causes data loss, has device-specific steps and can reintroduce stalkerware if an unsafe backup is restored. |
Android menu names and locations vary by version and manufacturer. If a label in this guide is missing, search the Settings app for the term shown or use the device maker’s instructions for that model.
1. Put personal safety ahead of technical cleanup
NNEDV Safety Net Project advises: “Before looking for or trying to remove stalkerware, think about your safety.” Treat that as a decision point, not a warning to skim.
When a person may react to losing access
If the suspected monitor is a partner, family member, employer or other person with access to you, changing a password, deleting an app or resetting the phone may be visible. The person may ask why the phone changed, retaliate, or switch to another way of obtaining information. A reset can also erase messages, logs or other evidence that an advocate or investigator could find useful.
Use a safer device and account
For sensitive searches, calls and planning, use a phone or computer the person cannot unlock, administer or monitor. Avoid signing into your usual Google or cloud account on that device if the other person may know its password or recovery methods. A library, workplace or trusted person’s device may be safer, provided using it does not create a new risk.
Get support before deletion when needed
Consider a domestic-violence, stalking or digital-safety advocate before you remove anything. Explain that you are concerned about phone surveillance and ask about evidence preservation, a safe time to make changes and a replacement-device plan. Do not confront the suspected person solely because an app or symptom looks suspicious.
2. Run Google Play Protect
Play Protect is Android’s built-in app-safety service. Google says it checks apps from Google Play and other sources, can warn about potentially harmful apps, and may disable or remove an app it identifies. It is a strong first check, not a guarantee that every spyware or stalkerware installation will be found.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Open the scanner
- Open the Google Play Store.
- Tap your profile picture or profile icon.
- Choose Play Protect.
- Check that app scanning is enabled, then start a scan.
The exact wording can differ by Android release. Read the result and follow Google’s removal or disable prompt if Play Protect flags an app. Do not dismiss a warning merely because you recognize the app’s name; verify why it was flagged and whether you still need it.
Check apps installed outside Google Play
If you have installed an APK from a website, message, file manager or another store, open Play Protect’s settings and enable improved harmful-app detection when that option is offered. This allows Google to send previously unknown apps for analysis. Sideloaded-app scanning improves coverage but still does not promise detection of every monitoring tool.
Record what you find before removing it
If doing so is safe, note the app name, developer, install date, permissions and the date and time of the warning. Screenshots can help an advocate or manufacturer support representative. Do not preserve evidence at the expense of immediate safety, and do not open an app just to investigate it.
3. Install Android, security and Google Play system updates
Out-of-date system components can leave known weaknesses unpatched. Google’s Android malware guidance recommends checking Android updates, security updates and Google Play system updates.
Recommended Free Tools
- Open Settings.
- Use the Settings search field for system update, security update or Google Play system update, or open the corresponding update section shown on your device.
- Install available updates and restart when prompted.
Keep the phone connected to power or sufficiently charged and use a trusted Wi-Fi connection if the update is large. A manufacturer may place these controls under System, Software update, Security and privacy or a similar heading. If your phone no longer receives updates, that is a reason to ask the manufacturer for support; it is not proof that spyware is installed.
4. Review installed apps and permissions
After scanning and updating, inspect the complete app list rather than relying only on the home screen. Look for apps you do not recognize, apps installed around the time the symptoms began, duplicate-looking tools, or software with a name that does not match its function.
Remove an app you do not trust
- Open Settings and search for Apps or App management.
- Open the full list of installed apps and select the app you want to examine.
- Review its name, permissions and storage information.
- If you are confident it is unwanted and removal is safe, choose Uninstall and confirm.
Google’s app-removal instructions differ in some details by Android version. You may also be able to press and hold an app icon and select Uninstall. If the uninstall control is unavailable, the app may be a preinstalled system component, have device-administrator privileges or be managed by an organization.
Do not delete unfamiliar system components impulsively
Some Android services have generic names or no launcher icon and are required for calls, updates or accessibility features. Removing a critical component can make the phone unstable. If an unfamiliar item cannot be removed, search the exact name in the manufacturer’s support pages or ask support from a safer device. In a suspected stalkerware case, document the item first if that is safe.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Check powerful access settings
Review which apps have accessibility access, device-administrator status, notification access, location access, microphone access, camera access or permission to install unknown apps. These settings are not proof of spying: legitimate password managers, accessibility tools, parental controls and security software may need them. The relevant question is whether each listed app is expected, necessary and controlled by you. Menu locations vary, so use Settings search if you cannot find a category.
5. Secure your Google Account and connected accounts
Cleaning the handset does not remove access that someone else has to your online accounts. Google recommends reviewing account security after addressing suspected malware.
Run Google Account Security Checkup
- Open your Google Account settings from a trusted device.
- Start Security Checkup.
- Review recent security events, signed-in devices, recovery phone numbers, recovery email addresses, third-party access and saved sign-in methods.
- Sign out devices and sessions you do not recognize, and remove access that you no longer need.
Use a new, unique password if another person may know the old one. Change it from a device and account they cannot access; changing it on a monitored phone may reveal the new password. Consider two-factor authentication, but choose a method the suspected person cannot intercept or control.
Secure accounts outside Google
Make a list of services that can reveal your location, messages, photos, browsing or purchases. Depending on your situation, this may include carrier billing, cloud storage, email, social networks, messaging, family-location services and smart-home accounts. Change credentials, recovery options and active sessions from the safer device. Ask your mobile carrier how to protect the account with a new PIN and how to check for unauthorized changes.
If the other person controls the recovery email, phone number or a shared password manager, changing only the handset password will not solve the access problem. Plan account recovery first, and tell the provider that account safety may involve coercive control or stalking if that is relevant.
6. Decide whether a factory reset is appropriate
Google’s Android Help guidance says: “If you find signs of malware, you might need to reset your Android device or ask the company that made your device for help.” A reset is a possible next step when scans, updates and app review do not resolve the concern; it is not an automatic response to every battery or performance problem.
Understand what a reset erases
- Data stored on the phone is deleted.
- Installed apps and their local data are removed.
- Device settings return to their factory state.
- Information already synchronized to an online account may remain in that account, but you must verify what is actually backed up.
A factory reset is different from restarting the phone or deleting one app. Assume that anything not safely backed up will be lost.
Complete the pre-reset checklist
- Confirm that you know the Google Account credentials previously used on the phone. Android may require them after the reset.
- Confirm the current screen-lock PIN, pattern or password.
- Back up photos, contacts, documents and authenticator information you genuinely need, using an account and device the suspected person cannot access.
- Export essential records or evidence separately if doing so is safe.
- Charge the phone and connect it as the manufacturer or Google instructs.
- Write down model-specific information, such as the exact model number and carrier, so you can follow the correct reset procedure.
Do not reset first and discover afterward that you cannot pass account verification or recover an important two-factor-authentication method.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstall7. Reset the phone and set it up carefully
The reset path differs by Android version and manufacturer. In Settings, search for factory reset, erase all data or reset options, then read every confirmation screen. Some devices place the command under System; others use General management or a similar section. If the phone is inaccessible, use the manufacturer’s official recovery instructions rather than guessing button combinations.
- Open the device-specific reset menu.
- Read the list of accounts and data that will be removed.
- Enter the screen-lock credential and confirm the reset when you are ready.
- Wait for the phone to erase and restart; do not interrupt the process.
- During setup, install system and security updates before restoring personal content.
- Sign in only to accounts you have secured and use a new screen lock that another person cannot guess.
- Install apps individually from trusted sources and review each requested permission.
Do not automatically restore a risky backup
NNEDV Safety Net notes that a factory reset may remove stalkerware, but restoring apps or files from a backup can put it back. In a suspected stalkerware situation, do not select the option that blindly reinstalls every previous app. Restore only files you have checked, and obtain apps again from the official store when possible. If you are unsure which backup is safe, ask a digital-safety advocate or the manufacturer before restoring it.
8. If monitoring or malware signs remain
Ask the manufacturer for model-specific help
Google advises contacting the company that made the device when signs of malware persist. Provide the model, Android version, update status, Play Protect result and the steps already taken. Manufacturer support can identify a known firmware issue, explain a model-specific reset or tell you whether the phone still receives security updates.
Take rooted or modified phones seriously
A rooted phone or one running a modified operating system may have reduced Android security protections. Do not improvise firmware-flashing instructions from an unverified forum. Use the manufacturer’s procedure for restoring the original operating system, or obtain help from a qualified service provider chosen from a safer device. Restoring software may erase data and can create account-verification requirements, so secure and back up what you need first.
Consider that the access route may be elsewhere
If a reset and clean setup do not explain the information another person knows, investigate accounts, shared location services, carrier access, Bluetooth trackers, smart-home devices and physical access to the phone. A clean handset does not prevent a person with valid account credentials from reading synchronized data. Change credentials and recovery methods, revoke sessions and ask the relevant provider for account-security help.
Common symptoms and what they can—and cannot—show
| Symptom | Possible explanations | Useful next check |
|---|---|---|
| Battery drains unusually fast | High screen brightness, a damaged battery, intensive legitimate apps, poor signal or background activity, including possible malware. | Review battery usage by app, update the system and run Play Protect. |
| Mobile data use rises | Video or cloud sync, automatic updates, tethering, account activity or an unwanted app sending data. | Check per-app data use and unfamiliar apps; also review connected-account sessions. |
| Pop-ups or browser redirects appear | A browser notification, ad-supported app, unsafe website or malicious software. | Identify the app or notification source, remove untrusted software and scan. |
| The phone overheats or slows | Charging conditions, an old battery, a stuck process, a demanding app or malware. | Restart, install updates, inspect battery and app usage, then escalate if it continues. |
| Someone knows private information | Account access, shared passwords, location sharing, physical access, social engineering or stalkerware. | Use a safer device to review Google and connected accounts and make a safety plan. |
None of these symptoms alone identifies spyware. The pattern, timing, account access and personal circumstances matter more than a single indicator.
Preserve evidence without increasing danger
If you may need legal, workplace or safety support, preserve information before deleting it when that is safe. Record dates, unfamiliar app names, warnings, account alerts and changes you observed. Store copies somewhere the suspected person cannot access. A factory reset can remove useful evidence, while leaving a monitoring app in place can expose your planning. An advocate can help balance those competing concerns.
Do not install a random “spyware remover” or security app solely because an advertisement promises certainty. The procedure above relies on Android’s built-in controls, account security and manufacturer support. Third-party tools can request broad permissions and may introduce another privacy risk.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →A practical order of operations
- From a safer device, decide whether deleting or changing anything could alert or endanger someone.
- On the Android phone, run Play Protect and enable improved harmful-app detection for apps from outside Google Play when available.
- Install Android, security and Google Play system updates.
- Review installed apps and remove unfamiliar or untrusted software when safe.
- Run Google Account Security Checkup and secure carrier, cloud and other connected accounts from a device they cannot access.
- If signs continue, confirm credentials, preserve wanted information and evaluate a factory reset or manufacturer support.
- After a reset, update first, avoid blindly restoring backups and reinstall apps selectively.
- If the concern remains, investigate account and physical-access routes and seek device-specific or safety support.
This sequence addresses ordinary Android malware while leaving room for the different risks of stalkerware. A successful scan or reset is one part of the response, not proof that no one can access your information.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
