How to remove a virus from an Android phone (Samsung and Pixel)

Your Android phone is throwing ads at you, the battery's draining fast, or there's an app on it you swear you never installed. You want it gone.

By the end of this guide you'll have found the bad app, stripped its permissions, removed it, and confirmed the phone is clean.

The short answer

Most Android "viruses" are actually a sketchy app. Restart in safe mode so third-party apps can't run, take away any device admin rights the app grabbed, uninstall it, then run a Google Play Protect scan. If that doesn't clear it, back up your photos and contacts and do a factory reset.

Before you start

• Time: 15–30 minutes for the main steps. A reset adds about an hour.
• You'll need: your phone charged above 50%, and your Google account password (and Samsung account password on a Galaxy).
• Back up first. Make sure your photos and contacts are syncing to Google Photos and your Google account before you delete anything. Don't back up apps you suspect.
• Watch for fakes: if a pop-up says your phone is infected and gives you a number to call, that's a scam. See fake virus pop-ups and tech support scams.

Step 1: Confirm it's actually malware

A few signs point to a bad app rather than an aging phone.

1. Notice full-screen ads that pop up outside any app, or on your home screen.
2. Check for apps you don't recognize, especially ones with generic names like "System Service" or a blank icon.
3. Open Settings → Battery and look for an unfamiliar app using a lot of power.
4. Look for data usage spikes under Settings → Network & internet (Pixel) or Settings → Connections → Data usage (Samsung).

If an ad pops up right now, open your recent apps screen immediately. The app that just appeared is often the culprit. Write down its name.

Step 2: Restart in safe mode

Safe mode loads Android with only the apps that came on the phone. If the pop-ups stop, you know a downloaded app is to blame, and it can't fight you while you remove it.

Pixel

1. Open the power menu (hold the power button, or power and volume up together on newer Pixels).
2. Touch and hold Power off or Restart until Reboot to safe mode appears.
3. Tap OK.

Samsung Galaxy

1. Open the power menu (hold the side key and volume down, or swipe down twice and tap the power icon).
2. Touch and hold Power off until the Safe mode icon appears.
3. Tap Safe mode.

You should see "Safe mode" in the bottom-left corner of the screen. Everything else still works; your downloaded apps just won't run.

Step 3: Remove device admin rights

Some malware gives itself device admin rights, which is why the Uninstall button is grayed out. Take that away first.

1. Open Settings and type device admin in the search bar at the top.
2. Tap Device admin apps. On a Pixel it's usually under Security & privacy → More security & privacy; on a Samsung, under Security and privacy → More security settings.
3. Turn off any app you don't recognize or trust. Leave Find My Device and anything from your employer alone.
4. Tap Deactivate to confirm.

While you're in Settings, search accessibility too. Malware loves accessibility access because it lets an app read your screen. Turn it off for anything suspicious.

Step 4: Uninstall the app

1. Go to Settings → Apps (tap See all apps on a Pixel).
2. Tap the suspicious app.
3. Tap Uninstall, then OK.
4. Repeat for anything else you installed around the time trouble started.

The Uninstall button should now be tappable. If it's still grayed out, go back to Step 3.

5. Restart the phone normally to leave safe mode.

Step 5: Run a Google Play Protect scan

Play Protect is Google's built-in scanner. It's free and already on your phone.

1. Open the Play Store.
2. Tap your profile picture in the top right.
3. Tap Play Protect, then Scan.

If it finds something, it'll offer to uninstall or disable it. Follow that. "No harmful apps found" is what you want to see. While you're there, tap the gear icon and make sure scanning is turned on.

Still not working? Try these

1. Check browser notifications. Pop-ups coming from Chrome are often a website you allowed to send notifications, not a virus. Long-press one of the ads to see where it's from, then in Chrome go to Settings → Site settings → Notifications (or Settings → Notifications, depending on your version) and block the site. This is common after visiting fake streaming sites.
2. Clear Chrome's data. Settings → Apps → Chrome → Storage → Clear data (on older versions, Manage space). You'll be signed out of sites.
3. Update everything. Install system updates under Settings → System → Software updates (Pixel) or Settings → Software update (Samsung), then update apps in the Play Store.
4. Factory reset. If the problem survives all of the above, wipe the phone. Back up photos and contacts first, and confirm you know your Google account password, or you'll be locked out after the reset. When you set it back up, reinstall apps from the Play Store one at a time instead of restoring them all at once. That way the bad one doesn't come right back.
   • Pixel: Settings → System → Reset options → Erase all data (factory reset).
   • Samsung: Settings → General management → Reset → Factory data reset.

Business phones: if the phone is managed by your company, don't reset it yourself. Tell whoever handles IT, because the device may need to be removed and re-enrolled, and a work account could be exposed.

Once the phone is clean, change your important passwords from a different device, starting with email and banking. If you think an account was already taken over, follow what to do in the first hour after an email hack.

Keep it from happening again

• Install apps only from the Play Store. Leave the setting that blocks unknown apps turned on.
• Read permissions. A flashlight app has no business asking for accessibility or admin access.
• Don't tap links in random texts. Fake toll and delivery texts are a big source of Android malware. If you already did, use this checklist.
• Keep Play Protect on and install updates when your phone offers them.

Quick answers

Do I need to buy an antivirus app for Android? Not usually. Play Protect plus the steps above handles most cases for free. Avoid "cleaner" apps that promise to speed up your phone.

Can my phone get a virus just from visiting a website? It's rare. What usually happens is a site tricks you into allowing notifications or installing an app, so be suspicious of anything a site asks you to allow.

Will a factory reset definitely remove malware? It removes virtually all app-based malware. Just don't restore the same bad app afterward.

Sources

• Remove malware or unsafe software - Android phone & tablet - Google Account Help
• How to remove viruses and malware from an Android phone
• How to remove a virus from Android

Rather have us clean it up?

If the app won't go away or you'd rather not risk wiping your phone, an ITGoNYC tech can connect through secure remote support, find the bad app, remove it, and lock down your accounts. Busy day in the city? Hand us the problem. Call or text 347-549-9059 now for same-day help, or open a ticket.