Removing viruses from your cell phone: step-by-step guide on Android and iPhone.
Put Rodrigo Pereira
Advertisements outside the app, unknown permissions, and sudden changes in behavior warrant an investigation on the phone. These signs alone do not prove an infection: authorized notifications, settings, and performance issues can also produce similar symptoms. Start by noting the source of the alert and what has been recently installed or changed.
An unavailable uninstall button may be related to device administration, a system application, or company or school management. Identify which situation applies before removing permissions. Do not disable controls on a managed device without consulting the responsible party, nor delete a system component by name alone.
On Android, the roadmap includes Play Protect, app review, and, when necessary, safe mode and additional analysis. On iPhone, the investigation prioritizes updates, accounts, browser, and profiles. The path depends on the identified symptom; a factory reset requires preparation and is reserved for situations where previous checks have not resolved the problem.
How to tell if your cell phone has a virus
Slow performance and overheating can also be related to the battery, storage, or legitimate tasks. Look for changes that occurred together and note on which screen the problem appears. Signs that warrant further investigation include:
- Ads outside of any appFull-screen advertising on the home screen, lock screen, or on top of other apps. This is the most reliable symptom of adware.
- Battery falling out and device overheating when not in use.: process running in the background.
- Apps you haven't installed: generic icon, name like “Settings”, “Update” or “System Service”.
- Non-standard mobile dataIn Settings > Network & internet > Data usage, an unknown app appears at the top.
- Browser opening by itself Prize pages or "your phone is infected" pages.
The coincidence of signs increases the need for investigation, but does not confirm a diagnosis. If data capture is suspected, avoid entering credentials on that device and use another trusted device to review your accounts. Verification may require an internet connection to update security information; follow the instructions of the tool being used.
Step 1 on Android: Run Play Protect
Every Android device with the Play Store already has a verification tool enabled. Open the Play Store, tap your profile icon in the upper right corner, go to Play Protect, and tap Verify. It analyzes all installed apps and offers to uninstall any it recognizes as harmful. Google describes how it works in... Play Protect official page.
A "no detection" result means the scan did not identify a threat at that time. It does not confirm that every symptom is malware, nor does it guarantee the absence of problems. Also check browser notification permissions and recent applications. The guide to cell phone verification and reading of the result. This interpretation is detailed below.
Step 2: Restart in safe mode.
Safe mode temporarily disables downloaded applications and helps investigate whether any of them are linked to the observed behavior. If the symptom disappears, this is a clue to review recent installations, not an automatic identification of the responsible application. The procedure for entering this mode varies by manufacturer and version.
- Hold down the power button until the menu appears.
- Tap and hold the Power Off option for two or three seconds.
- When “Restart in safe mode” appears, confirm with OK.
- Wait for it to turn on; the "Safe Mode" label is in the lower left corner.
On some Samsung devices, the process is different: turn the phone off, turn it back on, and hold down the volume down button as soon as the logo appears. To exit, restart normally.
Step 3: Find the intruder in Settings > Apps
While still in safe mode, go to Settings > Apps > See all apps. I use three filters:
- Recent appsSort by "Last updated," if your device allows it; anything entered on the day symptoms started goes to the top of the list of suspects.
- Generic name and icon: “Security”, “Update”, gear or shield that you don't recognize.
- Who drains the battery?Settings > Battery > App Usage. Adware appears among the top apps even when you don't open them.
Open the application details and confirm its identity and purpose. If it is not needed and you have identified the reason for removing it, use the uninstall option. A disabled button may have other causes besides administrator privileges: consult the system information before changing special controls.
Step 4: Remove administrator and accessibility privileges, then uninstall.
Special access permissions expand what an app can do. Device administration, accessibility, and display over other apps also have legitimate uses, but deserve review when linked to a suspicious app. Only revoke access permissions whose purpose you have verified, preserving assistive features and managed device settings.
- Open Settings and type “administrator” in the search bar at the top. Go to Device administrator apps (on Samsung: Security and privacy > More security settings) and disable the suspicious app. Only “Find My Device” and apps you recognize should remain there.
- In Settings > Accessibility > Installed apps, turn off any service that you did not configure yourself.
- In Settings > Apps > Special app access, disable the suspicious app under Show over other apps and Install unknown apps.
- Go back to the app details and try uninstalling it according to the manufacturer's instructions. If the device is managed or the component is part of the system, contact the appropriate support. Do not delete data from unknown apps in an attempt to unlock the button.
- Restart normally and see if the behavior reappears. The disappearance of the ad helps in the investigation, but it doesn't prove that all accounts and data involved are protected. Also review sessions and credentials if there are signs of unauthorized access.
If the app doesn't appear even with "Show system apps," or reappears with a different name, it's time for an antivirus app from the store. The same applies to WhatsApp GB: remove it at this stage, because the package comes from outside the store and may carry spyware; I explain what happens to the account in the article about... Is WhatsApp GB safe and what can be used instead?.
Step 5: Store antivirus for what's left
A complementary security tool can analyze the items to which Android allows access and present another report. The scope depends on the product, permissions, and system. The apps below have listings available on the Play Store; compare their features and terms of use before installing or subscribing to a plan.
Malwarebytes: free scan and removal with just a few taps
Malwarebytes offers threat analysis features for Android and additional functions that may depend on a plan. Open the store listing and check which options are available for your account. When you receive a report, read the item ID and the proposed action before authorizing a removal; don't treat every upgrade offer as a detection.
Scanning and removing malware, adware, and spyware on Android, with a free version.
Bitdefender Mobile Security: Behavioral detection and 14-day trial
Bitdefender Mobile Security is the choice for those who want to keep protection on after cleaning. Its features highlight anomaly detection in apps, which observes suspicious behavior in real time. Installation is free with a 14-day trial; after that, it's a subscription. It has a 4.7 rating, over 513,000 reviews, and over 10 million downloads. If you don't want to pay, Avast One (4.7 on the Play Store, over 100 million downloads, free version) is a third option we checked.
Android antivirus with app and file scanning and detection of suspicious behavior; 14-day trial.
Run the scan option available in the app and read the reported scope. After a removal action, restart if the tool recommends it and observe the behavior. If the symptom persists without a clear diagnosis, review other causes and seek manufacturer support before wiping the entire device.
Step 6: Factory reset, the final step.
Resetting the device erases local data and user-installed applications, but it does not automatically resolve a compromised account or guarantee the removal of threats present in the firmware. It requires a verified backup and access to the accounts used on the device. If the problem persists after a careful reset, contact the manufacturer or a qualified service provider.
- Check the backup settings in Settings > Google > Backup: photos in Google Photos; contacts, SMS, and settings in your account. If it's disabled, turn it on and wait for it to complete.
- Copy to your computer what is not automatically backed up: the Download folder and the WhatsApp backup (Chats > Chat backup).
- Write down the password for your device's Google account: after resetting, Android will ask for this login to unlock the device.
- Remove the SD card first and scan it with antivirus software afterward; an APK stored on the card will survive the reset.
The path usually appears in Settings > System > Reset options, or in the manufacturer's restore menu. Read the effects before confirming. During the initial setup, review which applications will be reinstalled; automatically restoring the same configuration may bring back the cause of the problem.
iPhone: How to investigate using system features
iOS limits an app's access to other apps' data. Therefore, third-party security apps don't perform an unrestricted scan of the entire system like a computer antivirus. They may offer specific functions related to browsing, network, and account management. iPhone protection guide It separates these functions from the actions performed in the adjustments.
Among the possible causes that can be verified on the iPhone are notifications from websites, unwanted calendars, and configuration profiles. These examples do not exhaust the system's risks. Update your device and investigate the observed signal; an official notification of a targeted threat requires following Apple's specific guidelines.
- Update iOS In Settings > General > Software Update. Apple's patches close the vulnerabilities that known attacks exploit.
- Review configuration profiles. Go to Settings > General > VPN & Device Management. Confirm the source before removing: deletion may erase settings, apps, and associated data. On a company or school device, contact your administrator. See the Apple's guidance on profiles.
- Review unwanted calendars.In the Calendar app, open Calendars, tap on calendar information, and look for Delete or Cancel Subscription. Check which calendar will be affected before confirming, preserving your personal events.
- Clean up Safari In Settings > Safari > Clear History and Website Data. This removes the false alert and resets the permissions granted to websites unintentionally.
- Review the apps In the App Library and in Settings > your name > Subscriptions: delete what you haven't installed and cancel what's charging you.
- Redefine, If symptoms persist, go to Settings > General > Transfer or Reset iPhone > Erase All Content and Settings, making sure you backed up your data to iCloud beforehand; the step-by-step instructions are in [link to iCloud backup]. How to reset your iPhone to factory settings..
After cleaning: close the doors through which he entered.
Removing it is only half the job: the malware may have read what you typed. Do the following:
- Change the password for your Google account or Apple ID, primary email, and bank account from another device, and enable two-step verification.
- Check your statements and close any open sessions in the bank's app that you don't recognize.
- Review permissions in Settings > Privacy > Permissions Manager (on iPhone, Settings > Privacy & Security): camera, microphone, location, and files are only allowed for apps that use them in front of you.
- Leave “Install unknown apps” turned off for all apps, including the browser and WhatsApp, the two most common APK delivery methods.
- Don't replace antivirus software with a "RAM booster": it closes processes that Android reopens, consumes more battery, doesn't remove malware, and often asks for the same accessibility permissions that the malware uses.
Prevention from here on out, including what Play Protect already does by default and how to read an app's permissions before installing, is covered in the guide on... Android malware and what Play Protect already does..
Common questions
Is it possible to remove viruses from a cell phone without formatting it?
Some problems are resolved by reviewing permissions, removing an identified application, or adjusting browser settings. The solution depends on the cause. Resetting the application should be considered after checking the manufacturer's data and instructions; it is not a universal guarantee of removal.
Does free antivirus software remove the virus or just warn you about it?
This depends on the features offered by the product and the item detected. Some apps allow you to check and guide removal without a subscription; others require a plan or offer only certain free features. Check the current conditions in the store and read the proposed action in the report.
I did a factory reset and the ad reappeared. Why?
Three common causes: an APK saved on the SD card was reopened, the app that caused the problem returned after restoring from backup, or you reinstalled it. Look in the list of apps for the one that returned after restoring, uninstall it, and scan the SD card with antivirus software.
My iPhone showed "virus detected". Is it a virus?
If the message appeared on a page with a countdown timer and an installation offer, it may be a misleading advertisement. Close the page and check the warnings in the settings or on the corresponding official channel. Do not conclude that your iPhone is infected based solely on this text.
Identify the source of the warning and follow the step corresponding to your system. Note the result to guide support if the problem persists.
