Troubleshooting Beginner 9 min read

Android Virus or Just Adware? How to Tell and Remove It

Name: Droid Rooter
Price range: $$

Is it really an Android virus? How to tell adware from malware from bloatware, find and remove it, and the 5 'antivirus' apps to never install on your phone.

By Saad Bin Abdul Hai | Published May 2, 2026

Table of Contents

Virus vs adware vs bloatware — they are not the same thing
Adware
Trojanised apps (closest to “real” malware)
Bloatware
Signs your phone actually has malware
How to find and remove malware on Android
Step 1: Audit recently installed apps
Step 2: Check apps with high battery and data usage
Step 3: Run Google Play Protect scan
Step 4: Boot into Safe Mode and verify
Step 5: Check Privacy Dashboard for permission abuse
Step 6: Reset advertising ID and clear browser data
Safe Mode walkthrough
When to factory reset (last resort, but it works)
5 apps to NEVER install on Android
What does not work
Region-specific malware patterns we see
When to call a professional

The “I think my phone has a virus” message is one of the most common we receive — and roughly 9 times out of 10, the user does not actually have a virus. They have aggressive adware from a free Play Store app, or pre-installed bloatware running rogue, or a single misbehaving app. The fix is dramatically different for each, and randomly running “phone cleaner” apps from the Play Store usually makes the problem worse rather than better. This guide is the systematic playbook for telling what you actually have on your Android and removing it correctly.

Virus vs adware vs bloatware — they are not the same thing

The single most useful thing you can do before “removing the virus” is figure out which of these three you actually have, because each requires a different fix.

Adware

The most common category. An app you installed (often a free utility like a flashlight, photo editor, file manager, ringtone app, or “phone cleaner”) starts showing ads aggressively — full-screen ads when you unlock the phone, ads on your home screen, ads in your notifications. The app might be legitimate but funded by an aggressive ad network, or it might be a rebranded ad-delivery app pretending to be a utility.

The fix: identify and uninstall the offending app. Settings → Apps → sort by recently installed → remove the suspicious one.

Trojanised apps (closest to “real” malware)

A legitimate-looking app that secretly does something harmful in the background — sending SMS to premium numbers, harvesting your contacts, displaying overlay ads on top of other apps, mining cryptocurrency on your CPU, or stealing banking app credentials. Less common than adware but more dangerous.

The fix: identify the app via Privacy Dashboard or unusual data/battery usage; uninstall; change passwords on accounts you use on the phone; if banking app credentials may be compromised, contact your bank immediately.

Bloatware

Apps pre-installed by your phone manufacturer or by your carrier, that you did not choose to install. Most are benign-but-annoying (Samsung Pay if you do not use Pay; manufacturer game centres; pre-installed shopping apps in some regions). Some are aggressive enough to behave like adware (specifically: pre-installed apps on cheap unbranded Android phones).

The fix: disable in Settings → Apps → tap app → Disable. For root users, full uninstall via debloater scripts. Manufacturer bloatware on major-brand devices typically cannot be uninstalled without root.

Signs your phone actually has malware

Look for these specific signals, in order of strength:

Apps you did not install appear on your phone. Settings → Apps → look for unfamiliar names. Strongest single signal.
Ads appear outside any app — on your home screen, on the lock screen, when you unlock the phone, between switching apps. Almost always adware.
Battery drains 30+ percent faster than normal even with the same usage pattern.
Phone runs hot when idle, especially when locked and not in use.
Mobile data usage is dramatically higher than your normal pattern, even when you have not been streaming.
Your phone makes calls or sends SMS by itself (or you are charged for premium SMS).
Browser redirects to ad pages when you tap on legitimate links, or your browser homepage changes by itself.
Banking app stops working unexpectedly with security warnings (this can also be unrelated Play Integrity issues — see context).

One of these alone could be a normal app misbehaving. Two or three together is strong evidence of malware.

How to find and remove malware on Android

A systematic 6-step process. Total time: 30-45 minutes.

Step 1: Audit recently installed apps

Settings → Apps → tap the sort menu → “Sort by install date” → review what was installed in the last 14 days. Anything you do not remember installing is a candidate. Tap each suspicious app → Uninstall.

Step 2: Check apps with high battery and data usage

Settings → Battery → Battery usage → look for apps using significant battery while not actively used. Settings → Network → Data usage → look for apps using mobile data unexpectedly. Anomalies here often point at the malicious app.

Step 3: Run Google Play Protect scan

Open Play Store → tap profile icon → Play Protect → “Scan”. This catches most known malware. If Play Protect flags anything, follow its prompt to uninstall.

Step 4: Boot into Safe Mode and verify

Safe Mode disables all third-party apps so you can confirm whether the symptoms are caused by an installed app:

On most Androids: press and hold Power button → long-press the “Power off” option → “Reboot to safe mode” (the exact path varies by manufacturer; some devices show a separate Safe Mode option).
In Safe Mode, observe whether the symptoms (ads, slowdown, heat) persist. If symptoms disappear in Safe Mode, the cause is a third-party app you can uninstall. If symptoms persist, the cause is system-level (factory reset territory).

To exit Safe Mode, simply restart the phone normally.

Step 5: Check Privacy Dashboard for permission abuse

Settings → Privacy → Privacy Dashboard. Apps accessing microphone or camera without your active use, or accessing location continuously, are red flags. Revoke permissions or uninstall.

Step 6: Reset advertising ID and clear browser data

Settings → Google → Ads → “Delete advertising ID”. This breaks any ad-tracking-based malicious profile linking. Then in Chrome → Settings → Privacy and security → Clear browsing data → check All time, all categories.

Safe Mode walkthrough

Boot into Safe Mode

Press and hold Power → long-press Power off icon → tap Reboot to Safe Mode (path varies by brand).
Verify the Safe Mode label

When the phone restarts, you should see 'Safe Mode' badge in the bottom-left of the screen.
Observe whether symptoms still occur

Wait 15-30 minutes. If ads/heat/lag stop in Safe Mode, the cause is a third-party app.
Identify the culprit by elimination

Restart normally → uninstall the most-recent suspicious app → check if symptoms return → repeat.
Exit Safe Mode

Power button → Restart. Phone returns to normal mode with all apps re-enabled.

When to factory reset (last resort, but it works)

If you have followed steps 1-6 and still see symptoms, factory reset is the nuclear option that essentially always resolves malware on stock (non-rooted) Android.

Before resetting:

Back up photos via Google Photos or USB transfer to PC
Note down the apps you actively use (you will reinstall them after)
Sign out of accounts you do not want auto-restored (specifically the Google account if you suspect it is implicated)
Settings → System → Reset → Erase all data (factory reset) → confirm

After reset, do not restore from a recent Google backup (the backup may include the malware). Set the phone up as new, install apps individually from the Play Store, and skip any pre-installed-restore prompts. If the malware was via your Google account (rare but possible), consider creating a new Google account temporarily to verify the device is clean before signing back in.

5 apps to NEVER install on Android

These categories produce far more malware than any other category in the Play Store and via sideload. Avoid:

Free antivirus apps from outside the Play Store — APK sideloads from websites, SMS links, or random forums. Essentially always malware.
“Free RAM booster” / “Phone cleaner” / “Speed booster” apps — Android does not benefit from these tools; the apps themselves often contain adware. CCleaner, Clean Master, DU Speed Booster — all categories to avoid.
Free flashlight apps that request contacts, location, or storage permissions. Flashlights need only the camera flash permission. Anything more is suspicious.
“Fake GPS” or “Game cheat” apps from unofficial sources — frequently bundled with credential-stealing trojans.
Modded apps from APK sites — modded WhatsApp (GBWhatsApp, FMWhatsApp), modded Instagram, modded YouTube Premium clones. Many are repackaged with malware. The legitimate alternatives (YouTube Revanced from official builds; ReVanced Manager; signed builds only) are safer if you want the features.

What does not work

To save you time:

“Phone scanner” apps that promise to find and remove viruses for free — almost universally either ineffective or themselves malware.
Random “phone cleaner” apps — Android does not need cleanup the way Windows does; these are mostly placebo with ads attached.
Flashing custom ROMs to “remove malware” — does work but is dramatic overkill for what is almost always solvable by uninstalling one bad app.

Region-specific malware patterns we see

Patterns from three years of customer cases across our service regions:

Bangladesh / Pakistan / Nigeria / India low-end market — APK-sideloaded “free Netflix” / “free Spotify” / cracked-game apps are the dominant infection vector. Roughly 60 percent of malware cases we see in these regions trace to a single sideloaded app the customer was warned about by Play Protect and dismissed.
UK / EU / US — phishing-link-driven sideloads are dominant. SMS or WhatsApp links claiming “your parcel is held at customs” or “your bank needs you to verify” leading to fake bank login pages or APK downloads. Roughly 40 percent of cases.
Cheap unbranded Android phones globally — pre-installed adware/spyware on devices from unknown brands. Roughly 15 percent of cases trace to the device itself shipping with bad firmware. For these, factory reset alone does not always fix the issue; a clean firmware reflash from a verified source is often required.
Children-using-parents-phone scenario across all regions — kids installing free game apps that turn out to be aggressive adware. Roughly 10 percent of cases. Setting up a separate user profile for kids, or using Family Link, prevents most of these.

The single best preventive habit across every region: keep Play Protect enabled, never sideload APKs from links in SMS or WhatsApp, and treat any “free” version of a paid app as suspicious by default.

When to call a professional

If you have followed this guide and still see malware symptoms — or if banking app or financial credentials may be compromised and you want a thorough forensic check before continuing to use the device — message us on WhatsApp or Telegram. We can run a remote diagnostic, verify your device is clean, and if needed perform a clean firmware reflash that goes deeper than factory reset. See our performance repair service for what is included.

Frequently Asked Questions

Can Android phones really get viruses?

True self-replicating viruses on modern Android are extremely rare — Android's app sandboxing prevents the kind of code-injection-into-other-apps that a 'virus' technically requires. What people call an Android virus is almost always one of three different things: adware (apps that show ads aggressively), trojanised apps (legitimate-looking apps that secretly do something harmful), or pre-installed bloatware behaving badly. The fix differs by what you actually have, which is why correctly identifying it matters more than panicking about 'a virus'.

How do I know if my Android has malware?

Five reliable signs — battery drains 30+ percent faster than normal even when you are not heavy-using; the phone runs hot when idle; ads appear outside any app (on the home screen, lock screen, in your launcher); apps you do not remember installing appear; or your data plan is being consumed unusually fast. One of these alone could be a normal app misbehaving; two or more together is a strong signal of malware. Open Settings → Apps and look for recently installed apps you do not remember adding.

Should I install an antivirus app on Android?

For 95 percent of users, no. Google Play Protect is built in, runs continuously, and catches the majority of Play Store malware before installation. Reputable third-party Android antivirus apps (Bitdefender, Kaspersky, Malwarebytes) are legitimate but add limited value over Play Protect. The bigger concern is that many free antivirus apps in the Play Store are themselves adware or worse, and antivirus apps from outside the Play Store are essentially never trustworthy. Skip antivirus apps unless you have a specific reason; rely on Play Protect plus careful install habits.

Will a factory reset remove all malware from my Android?

Almost always yes — for malware installed as user apps, factory reset removes it completely. The rare exception is malware that has installed itself as a system app (which requires the device to have been previously rooted, or to have come pre-installed with malware from an untrusted vendor); factory reset on a stock device does not affect system partitions. For most consumers, factory reset after backing up photos and important documents is the nuclear option that genuinely fixes a malware-infected Android.

Are pre-installed apps from manufacturers actually malware?

Mostly no, but some pre-installed apps behave in ways that would qualify as malware on a desktop. Pre-installed apps from Samsung, Xiaomi, Oppo, Realme, Vivo, OnePlus and Google are not malware — they are bloatware (annoying but technically legitimate). Pre-installed apps from less-well-known Android brands (some white-label devices, some grey-import phones) have been documented sending data to advertising networks and adding unauthorised charges. If you bought a budget phone from an unknown brand and you are seeing aggressive ads, this category is a real possibility.