How to Remove Malware from an Android Phone Without Losing Your Data

Your phone wakes you up with a full-screen ad for a casino you never installed. Chrome keeps opening a page you didn't ask for. The battery that used to last a day is dead by lunch. It's tempting to jump straight to a factory reset, and just as easy to lose three years of photos doing it.

There's a middle road. Most Android infections are unwanted apps, adware, or a website you accidentally gave notification access to. You can usually identify and remove them without wiping the phone. The order matters, so work through these steps rather than jumping around.

Start With the Symptoms, Not the Fix

Before you delete anything, spend five minutes noting what's actually happening. The pattern tells you where the problem lives.

• Full-screen or lock-screen ads that appear when no app is open
• Your browser redirects to unfamiliar search pages or sweepstakes sites
• Apps you don't remember installing, often with vague names like "System Service" or "WiFi Booster"
• Battery draining fast, or mobile data use spiking for no reason
• A sudden flood of notifications with no clear source
• Settings you didn't change: a new default browser, a new home screen, Play Protect turned off

One pop-up on a single website isn't malware. It's usually a browser notification you subscribed to by tapping "Allow" on a dodgy page. That's a two-minute fix, not an infection.

Back Up Before You Change Anything

Removal steps can go wrong, and if something on the phone is misbehaving, you want a copy of your data that doesn't depend on the phone or a compromised account. Do this first.

Photos and videos

Connect the phone to a computer with a USB cable and copy the DCIM and Pictures folders across. Google Photos is a fine second copy, but check that sync actually finished before you start deleting things.

Messages

For SMS and MMS, an app like SMS Backup & Restore exports everything to a single file you can upload to Google Drive. For WhatsApp, open Settings > Chats > Chat backup and run it manually. Confirm the backup file exists somewhere you can see it — an untested backup is a hope, not a backup.

Accounts

If you suspect anything has been stolen, change your Google password from a different device. That signs other sessions out without touching the phone's data. If banking or payment apps were involved, call your bank directly rather than waiting to see what happens.

Boot Into Safe Mode and Scan

Safe mode loads Android without any third-party apps running. If the ads stop, the culprit is an installed app. If they continue, the problem is deeper — likely a browser notification, or something built into the system.

1. Press and hold the power button.
2. Long-press the on-screen Power off option until Restart in safe mode appears, then tap it. On Samsung phones, hold power and volume down during startup.
3. Wait for the phone to restart. You'll see a small "Safe mode" label in the corner.
4. Use the phone normally for ten or fifteen minutes. Watch for the ads and redirects.
5. Run a scan: open the Play Store, tap your profile icon, then Play Protect > Scan. The same option lives under Settings > Security on most phones.

Play Protect catches known threats, not everything. A second opinion from a reputable security app is reasonable, but you don't need a paid subscription to fix this, and plenty of "antivirus" apps in the store are adware themselves. Stick to names you recognize.

Remove the App That Doesn't Belong

Still in safe mode, go to Settings > Apps > See all apps. Sort by recently installed or last used if your phone offers it, and read the list carefully. Anything you don't recognize, especially something pretending to be a system tool, is a candidate.

Tap it, then tap Uninstall. Restart the phone normally and check whether the ads are gone.

When the Uninstall button is greyed out

That usually means the app has been granted device administrator rights. Go to Settings > Security > Device admin apps (wording varies by manufacturer), deactivate the app, then return and uninstall it. While you're there, check Settings > Accessibility and turn off any service you don't recognize — that permission lets an app read your screen and tap buttons for you.

Clean Up Notifications and Account Access

• In Chrome: three dots > Settings > Site settings > Notifications. Remove every site you don't recognize, then clear browsing data.
• Check Settings > Notifications > Notification history to see exactly what's been pinging you.
• Under Settings > Apps > Default apps, confirm your browser and home app are still the ones you chose.
• Visit your Google account's security page, review Your devices, and sign out anything unfamiliar. Then review third-party apps with account access and revoke anything you don't use.

When Removal Isn't Enough

If the ads survive safe mode, a clean uninstall, and a notification purge, a reset is the reliable answer. Done properly, it doesn't cost you your data.

1. Verify your photo copy and your message backup one more time.
2. Make sure you know your Google account email and password — the phone will ask for them after the reset.
3. Go to Settings > System > Reset > Erase all data. Restart in recovery mode if you can't reach Settings.
4. During setup, choose to set the phone up as new. Do not restore a full backup, which can reinstall the problem app and its permissions.
5. Reinstall apps manually from the Play Store, never from APK files sent to you or downloaded from a random site.
6. Copy your photos back from the computer, restore messages from the backup file, and sign into accounts fresh.

If this is a work phone, talk to your IT department before resetting. A reset can break device management enrolment or breach a company policy, and they may have a faster route.

Keeping It Clean Going Forward

• Install apps from the Play Store and read the permission screen before tapping accept.
• Leave Play Protect switched on so it scans new installs.
• Apply Android and app updates when they arrive — most fix real holes.
• Decline notification requests from websites you don't visit regularly.
• Glance at Device admin apps and Accessibility settings every few months.
• Change your passwords from a different device if you ever suspect they were captured.

None of this requires a technical background. Back up first, isolate the problem in safe mode, remove what doesn't belong, and only reset as a last resort — then restore selectively. If the phone handles work data, or you're simply not comfortable with the steps, a repair shop or your IT team can do it and will usually preserve your photos and messages the same way.

Photo: Yudi Ding / Pexels