Android Malware Removal: Complete Guide

Introduction / Why This Is Needed

Malicious software (malware) on Android can steal personal data, display intrusive ads, send SMS messages to premium numbers, and drastically reduce your phone's performance. Even antiviruses don't always cope with modern threats that masquerade as legitimate apps. This guide describes a step-by-step process for manually detecting and removing such a threat using Android's built-in tools. You will be able to clean your device without using a computer or special knowledge.

Requirements / Preparation

Before starting, ensure that:

• Your device is running Android 8.0 (Oreo) or newer. Instructions for older versions may differ.
• You have access to a Google account to create a backup.
• Battery charge is at least 80% to avoid an unexpected shutdown during the process.
• You are prepared to temporarily lose access to some apps in Safe Mode.

Step-by-Step Instructions

Step 1: Preparation and Backup

First, protect your data. Malicious software can damage the system, potentially requiring a reset.

1. Create a backup:
   • Photos/Videos: Open the Google Photos app → settings → backup.
   • Contacts/Calendar: Ensure synchronization with Google is enabled in Settings → Accounts.
   • Documents/Files: Copy important files to the Google Drive folder or to a computer via USB cable.
2. Write down the names of the main apps you use so you can easily find them later in the Play Store.

Step 2: Reboot into Safe Mode

Safe Mode boots Android with only system apps, disabling all third-party ones. This allows you to remove the virus without interference.

Method for most devices (Samsung, Google Pixel, Xiaomi, Huawei, etc.):

1. Press and hold the Power button.
2. In the menu that appears, long-press the "Power off" button. Usually, a pop-up window appears offering to enter Safe Mode.
3. Confirm the action. The device will reboot.
4. In the lower-left corner of the screen, you will see the label "Safe Mode".

⚠️ Important: If this method doesn't work, search for the exact instruction for your model (e.g., "Samsung Galaxy A52 safe mode"). If nothing works, proceed directly to a factory reset.

Step 3: Find and Remove Suspicious Apps

Now that the malicious programs are inactive, get rid of them.

1. Go to Settings → Apps (or Apps & notifications → See all apps).
2. Scroll through the list in alphabetical order. Look for:
   • Apps with strange names (System Update, Flash Player, Android Booster, etc.).
   • Apps you did not install.
   • Duplicate or similar apps (e.g., two browsers).
3. Tap on the suspicious app.
4. Tap Uninstall (MUST). If the button is inactive, tap Force stop → Clear cache → Clear data → Uninstall.
5. Check administrator rights: Go to Settings → Security → Device administrators (or Special app access → Device admin apps). If you see an unknown app there, uncheck it and then uninstall the app itself.

Step 4: Clear Browser Cache and Data

Most trojans change the browser's homepage, install extensions, and redirect to phishing sites.

1. Open the settings of your main browser (Chrome, Samsung Internet, Firefox).
2. Find the Privacy or History section.
3. Select Clear browsing history, Clear cache, Clear cookies and site data. Make sure "All time" is selected.
4. Go to Extensions or Add-ons and remove anything you did not install.
5. Return to the browser settings and check the Homepage and Default search engine. Set them to Google or another trusted provider.

Step 5: Full Scan with Antivirus

After manual cleaning, run a deep scan.

1. Exit Safe Mode (normal reboot).
2. Install one of these vetted solutions from Google Play:
   • Malwarebytes (free, good at catching adware and trojans).
   • Bitdefender Mobile Security.
   • ESET Mobile Security.
3. Run a full scan, not a quick one.
4. Remove all detected threats.
5. Reboot the device.

Step 6: Final Cleanup and Reset (If Necessary)

If symptoms persist after all steps (ads, strange behavior, rapid drain), the malware may have infiltrated system partitions. The only guaranteed method is a reset.

1. Create a final backup! Ensure all data is saved.
2. Go to Settings → System → Reset options → Erase all data (factory reset).
3. At the bottom, tap Erase all data → Reset phone.
4. The device will reboot and start the cleanup process (5-10 minutes).
5. After rebooting, set up the device as new. Restore apps and data ONLY from a verified backup created BEFORE the infection! Restoring from a backup made after infection can bring the virus back.

Verify the Result

Ensure the problem is solved:

• Ads: Open several apps and websites. There should be no pop-ups, notification banners, or redirects.
• Performance: The phone should run faster, without lag.
• Battery: Drain should occur at a normal rate.
• Bills: Check call and SMS history for premium numbers.
• Browsers: The homepage and search engine should be the ones you set.

Possible Issues

• Cannot enter Safe Mode. Look up the combination for your specific model (e.g., for older Samsung: power off → hold Volume Down during boot). If nothing works, proceed directly to a reset.
• App won't uninstall, says 'Uninstall failed'. It likely has administrator rights. Find it in Settings → Security → Device administrators and revoke its rights first.
• Virus returned after reset. This means you restored a backup created after the infection. Do not auto-restore apps. Install only apps whose name and developer you know for sure from Google Play.
• System apps behaving strangely. If problems persist after removing third-party apps, the firmware itself may have been compromised. In this case, an official firmware reflash is required using official tools (Odin for Samsung, Fastboot for Google Pixel). This is a complex operation requiring a PC.