How to remove virus from Android | How to stop Android virus

If you believe your Android phone or tablet has a virus then the good news is it's really easy to delete. Here's how to stop an Android virus and how to remove a virus from Android. Plus, we show you how to avoid a variety of Android malware, including the Ghost Push Trojan and Googlian, Godless, Gunpoder and Mazar viruses.

Step 1 

Android viruses are installed via third-party apps; to remove an Android virus put your device in Safe mode, if necessary remove its administrator status and then uninstall the affected app. If all else fails a factory reset will clear the infection. In this article we offer a step-by-step guide on how to remove malware from an Android phone or tablet, plus how to avoid it in the first place.

First of all, it's worth pointing out that it's unlikely that your Android phone or tablet has a virus. What you're more likely to be seeing is an ad that wants to convince you Android is infected and you need to download an app, or a dodgy pop-up, or perhaps your device is just misbehaving. But viruses for Android do exist.

If you're sure your device has a virus, read on to find out how to remove it, as well as how to avoid Android malware in the first place.

Step 2 

How to avoid Android malware, including how to avoid Ghost Trojan, Godless virus, Gunpoder virus, Mazar virus, Googlian virus

All Android viruses are delivered via apps installed on your device, so if your phone or tablet doesn't already have a virus, the best way to avoid it is to be very careful which apps you install. A rule of thumb - unless you know what you're doing - is to never install software outside of the Google Play app store, and by default your phone- or tablet settings will be configured to prevent this.

This is certainly true of the Gunpoder virus, which hit the headlines after Palo Alto Networks discovered it could sneak on to your phone via Nintendo game emulators installed outside Google Play - and even has the cheek to make you pay for the priviledge. Fortunately, Gunpoder hasn't been seen to affect UK users as of yet, but it's still worth taking measures to protect yourself from the Gunpoder virus and other Android viruses that may be released in the future.

It's also true of the Ghost Trojan, malware that appeared some two years ago but still nearly half of all Android devices are vulnerable to it. At its peak it was known to infect up to 600,000 Android users per day, running a malicious DEX file that can root devices and run malicious processes, install apps, display ads and steal your personal information. The Ghost Trojan can be installed when users install apps from outside Google Play, but it affects only devices running Android Lollipop or older.

More recently the Mazar virus has appeared, arriving on your phone via a link in a text message that downloads the Tor browser. Right now it appears to have affected devices only in Denmark, although it could potentially spread further.

Worryingly, though, the Godless virus which comes in app form can be delivered via apps found in Google Play. These are usually legitimate-looking apps, such as copies of games and flashlight apps (Summer Flashlight is one such app), but from unknown developers. Trend Micro has also found on the web some copies of otherwise clean Google Play apps that include the code.

Godless affects only Android Lollipop devices and has the ability to root your phone and install other (potentially harmful) software. The security company's advice is to ensure you vet the developer as well as the permissions whether or not you're installing an app from Google Play.

The most recent Android virus to hit the headlines is targeting users primarily in Asia but also in Europe, Africa and the Americas. It's based on 'Googlian' malware, and particularly drawn to devices running Android 4.1 Jelly Bean, Android 4.4 KitKat and the Android 5.0 Lollipop (if you can update, you should).

Googlian has already managed to breach more than a million Google accounts, taking data from Gmail, Google Photos, Google Docs, Google Play and other Google services, and can also install third-party apps from the Google Play store to earn revenue.

Googlian, as with other types of Android malware, finds its way on to phones and tablets through infected apps on third-party app stores. Our advice, as ever: do not install apps from outside Google Play unless you're absolutely certain they are legit. 

Step 3

To ensure you don't inadvertently install malware through the installation of apps outside of Google Play, open your Settings menu, look for the Security option, then ensure the option for Unknown Sources (allow installation of apps from unknown sources) is disabled. 

If you're determined to install an app from outside Google Play, do your research. Check its permissions (does a video player really need to see your contacts?), look online for reviews and have a good look at the developer's site to see what else it offers. In the case of Gunpoder, be particularly wary of Nintendo game emulator apps. 

You can also install an antivirus app, and plenty of free Android antivirus appsare available that are able to detect and remove malicious apps, for example 360 Mobile Security, Avast and Lookout. These all include an app scanner that will seek out anything dodgy, but note that these apps can also trigger false-positives - reporting an app you've been using for months as malware when you know it's fine. In most cases you can simply ignore these alerts. Also, again with Gunpoder in mind, these apps may not pick up on malicious behaviour if the app is able to hide it from them - Gunpoder uses the Airpush adware library to conceal that behaviour.  

If you believe you already have a virus on your Android phone or tablet - perhaps one that is resisting your attempts to uninstall the associated app or even let you bypass the lock screen - a factory reset will remove it, returning your device to its out-of-the-box state. But doing so also means you'll lose everything on your phone that's not backed up. Instead, follow the below steps to remove a virus from Android.

Step 4

How to remove a virus from Android 

Put your phone or tablet into Safe mode. This prevents any third-party apps running, including any malware. On many devices you can press the power button to access the power off options, then press and hold Power off to bring up an option to restart in Safe mode. If this doesn't work for your device then you should Google 'How to put [your model name] into Safe mode' and follow the instructions. When in Safe mode you'll see 'Safe mode' at the bottom left of the screen.

Step 5 of 7:

Open your Settings menu and choose Apps, then make sure you're viewing the Downloaded tab. If you don't know the name of the virus you think has infected your Android phone or tablet, go through the list and look for anything dodgy-looking or that you know you haven't installed or shouldn't be running on your device.  

Step 6 of 7:

Tap on the malicious app (clearly it won't be called 'Dodgy Android virus', this is just an illustration) to open the App info page, then click Uninstall. In most cases, this is all you need to do to remove the virus, but occasionally you might find the Uninstall button is greyed out. This is because the virus has given itself Device administrator status. 

Step 7 of 7:

Exit the Apps menu and tap on Settings, Security, Device Administrators. Here you'll find a list of any apps on your phone or tablet with administrator status. Simply untick the box for the app you want to remove, then tap Deactivate on the next screen. You should now be able to return to the apps menu and remove that app. 

With the virus now off your Android phone or tablet, all you need to is restart the device to take it out of Safe mode. Now that it's working correctly it's a good time to back up whatever important data you have stored on the device, and install an Android antivirus app to protect you from any future viruses that come your way.