Step-by-Step Guide to Removing Spyware and Adware from Android
Spyware and adware turn a useful phone into a noisy surveillance tool. Spyware watches what you do and sends data elsewhere. Adware floods your screen with ads and slows your phone down. Both often arrive inside apps that look harmless. A free game, a simple torch tool, or a photo editor can carry them, and the first sign is usually a popup you never asked for, a battery that drains overnight, or a phone that feels hot while doing nothing.
Removal works best when you follow a calm order. Rushing can leave pieces behind that reinstall the threat the next day. I have cleaned infected phones for friends and family, and the pattern is always the same: the people who rush delete the wrong app and miss the real one, while the people who work through a checklist find the culprit in under an hour. This guide is that checklist, from the first symptom to the final verification.
Work through the steps in order. Do not skip the backup step, do not skip safe mode, and do not reinstall anything until the phone has been clean for a full day. Patience here is the difference between a phone that stays clean and one that gets infected again next week.
How to tell spyware and adware apart on your phone
Spyware and adware overlap, but they behave differently, and knowing which one you face changes the cleanup. Adware is loud. It pushes popups over other apps, opens browser tabs you never asked for, and shows ads on the lock screen. It wants your attention, because attention is how it earns money. Spyware is quiet. It hides in the background, reads messages and location, and sends data to a remote server. It wants you to notice nothing at all.
The symptoms tell the story. Sudden popups, a new home screen shortcut you never created, or a browser homepage that changed itself all point to adware. Battery draining twice as fast as usual, mobile data spiking while the phone sits idle, or a phone that feels warm in your pocket all point to spyware working in the background. Some infections do both, which is why the cleanup in this guide covers both at once.
Before you touch anything, write down the symptoms in plain words. Note when popups appear and which app was open at the time. Note any new app names, any battery or data spikes, and the date the trouble started. This record guides your removal steps, and it helps you confirm later that the problem is truly gone. If you are unsure whether your symptoms match an infection at all, compare your notes with signs your Android phone is infected first, because a clear suspect list saves time and avoids deleting apps you actually need.
Prepare the phone before you remove anything
Preparation takes ten minutes and prevents most cleanup disasters. First, keep the phone charged to at least half, because a shutdown during removal can leave broken app data behind. Second, back up what matters: copy photos, documents, and chat exports to trusted storage, and write down login details for trusted apps, because you may need to sign in again after a reinstall. Skip app data from suspect apps. That data may hide the threat.
Third, disconnect from public Wi-Fi during cleanup if you can, and use your home network or mobile data with care. This limits data leaks while you work, and it stops some threats from downloading new parts. Fourth, turn off automatic reinstall of removed apps where possible. Some backup tools restore apps at once, and that restore can bring back the threat you just removed. Check your backup settings before you remove suspects, pause app restore until the phone is clean, and turn it back on only after you verify the result.
What to back up and what to leave behind
Back up photos, videos, documents, contacts, and messages through your trusted cloud account or a computer. Do not back up the full app list blindly, because a full restore brings back the infection too. Do not copy installer files from your download folder, because an old installer can reinstall the threat with one accidental tap. Delete installers from unknown sources now, and clear the folder after every manual install from now on.
Write down your suspect list first
Open Settings, then Apps, and scroll the full list slowly. Write down every app you do not remember installing, every app with a generic name or a blank icon, and every app installed around the date your symptoms started. Check install dates if your phone shows them. Recent installs near the start of symptoms deserve close review. This list is your map for the safe mode session that comes next.
Enter safe mode and find the suspects
Safe mode blocks third-party apps from running and gives you a clean space to work. On most phones, press and hold the power button, then long-press the Power off option on screen, and tap the safe mode prompt when it appears. The phone restarts with a safe mode label on screen, and third-party apps look greyed out or hidden. The exact gesture varies slightly by brand, so check your model if the long-press does not work.
Test the phone in safe mode for a few minutes. Open the browser and a few system apps, and check whether popups still appear. If popups stop, a third-party app is the likely cause. If popups continue, the cause may sit deeper, in a system setting, a browser permission, or a device admin app. Note the result before you move on, because this test narrows the search a lot.
While still in safe mode, open Settings and view all apps again. Compare the list with your suspect list, and look for apps that are greyed out but still present. Those are your prime suspects. If you need a refresher on what safe mode can and cannot do, read safe mode help for troublesome apps before you start removing anything, because safe mode is the safest place to delete a stubborn app.
How to remove a suspect app that fights back
Remove suspects one at a time. Open the app info page and tap Uninstall. If the button is greyed out, the app probably holds device admin rights. Go to Settings, then Security, then Device admin apps, turn off admin rights for the suspect, and return to app info to try again. This two-step method defeats the most common persistence trick on Android.
Some threats use two apps that protect each other. Removing one triggers the other to reinstall it. Watch for a repeat install after each removal. If an app returns, note its partner app, and remove both in the same safe mode session if you can. Restart the phone after the pair is gone, and check the app list again to confirm neither returned.
The removal order that breaks persistence
Revoke permissions first, then turn off device admin rights, then clear storage and cache for the suspect app, and only then tap Uninstall. Clearing storage removes data the app may use to restore itself, and revoking permissions stops it from acting while you work. Uninstall one suspect at a time and restart to test the result, rather than deleting five apps at once and guessing which one mattered.
Clean permissions, admin rights, and accessibility after removal
Removal alone is not enough. After the suspects are gone, review permissions for the apps that remain. Spyware often asks for broad access at install time: location, messages, contacts, and accessibility service. Accessibility access is powerful and deserves special care, because it can read screen content and automate taps. Turn it off for any app that does not truly need it, and keep it only for trusted tools you use daily.
Check device admin apps again after cleanup. A clean list should show only system tools or trusted security apps. Remove any unknown entry. Check accessibility services in the same pass, and turn off unknown services at once. These checks close the doors that spyware uses to survive a simple uninstall.
Review notification access as well. Some adware uses notification access to push spam, and a simple game has no reason to need it. A messaging app may need it, but a flashlight app does not. Turn off notification access for apps that do not need it, and this small review cuts a major spam channel at its source.
Clean the browser and reset hijacked settings
Adware often lives in the browser as well as in apps. Check your browser home page and search engine, and reset them to your preferred choices. Remove unknown extensions if your browser supports them, and clear site data for sites that pushed spam notifications. This step stops popups that survive app removal.
Open site settings and review notification permissions. Block notifications from any site you do not trust. Many spam campaigns start with one accidental tap on Allow, and that single tap grants a site the right to push ads at any time. Revoking that right ends the spam at its source.
Check for unknown search engines or proxy settings too. A hijack can reroute searches through a spam site. Reset network settings only if redirects persist after a browser reset, and write down your saved Wi-Fi passwords before you reset, because a network reset clears them. Use this step only when simpler steps fail.
Scan and verify the phone is truly clean
Run a built-in scan after manual removal, such as Google Play Protect, and let it check all installed apps. A clean scan supports your manual work, but it does not prove perfection on its own. Combine it with a day of normal use and watch for repeat symptoms. Popups should stop at once. Battery and data use should return to normal within a day or two.
Watch the app list for a full week after cleanup. Some threats wait before they reactivate. Check for new apps each morning and battery use each evening. Early detection in that week prevents a full reinfection. If a threat returns, note the exact app name and the time, because that detail helps you find its installer source.
Reinstall only trusted apps after the check period, one app at a time, testing each for a day. This slow reinstall method finds a bad app fast. If symptoms return after one install, you found the source. Remove that app and look for a safer alternative.
When removal is not enough: the factory reset decision
Some infections survive every step above. They hide in system partitions or reinstall from a helper app you cannot see. When symptoms persist after a careful safe mode cleanup, a factory reset is the honest next step. Before you take it, read whether a factory reset erases advanced malware, because a reset wipes the phone and the answer is not always yes. A reset removes almost everything, but deeply embedded threats can survive even that, and knowing the limits helps you decide whether to reset, seek professional help, or replace the device.
Check hidden persistence tricks before you reset
Before a reset, check accounts the suspect app may have added. Open account settings and look for unknown accounts, and remove any you do not recognise. Check VPN profiles and device admin apps in the same review. A rogue VPN profile can reroute traffic even after the app is gone, and a rogue admin app can block uninstall attempts. Clearing these three areas closes most back doors, and it is worth doing even if you do reset afterwards.
Prevent reinfection after cleanup
Reinfection often comes from the same source as the first infection. Think back to how the threat arrived. Did it come from a link in a message? Did it come from an app outside a trusted store? Did it come from a free tool that promised a miracle? Naming the source helps you avoid it next time. Block that source and warn others who may use it.
Review your message habits after cleanup. Do not tap links from unknown senders, and do not tap shortened links even from known senders without a check. Ask the sender if the link is real before you open it. A short message can save a long cleanup, and this habit blocks a major delivery route for spyware.
Set a rule for new apps after cleanup. Wait a day before you install a new tool app, and use that day to read reviews and check permissions. Install only one new app at a time, and test it for a day before you add another. This slow pace makes a bad app easy to spot, and it keeps your phone list small and clean.
Keep security settings on their strictest useful level. Keep scanning turned on, and keep installs from unknown sources turned off. Turn it on only for a single trusted install, and turn it off again at once. These defaults block most drive-by installs, they cost nothing in daily use, and they pay off every time a bad link tries to push an install.
Frequently asked questions about removing spyware and adware
Can I remove spyware without a factory reset?
Yes, most spyware and adware can be removed with the safe mode method in this guide, as long as the threat lives in a normal app. Remove admin rights first, delete the suspect and its partner app in the same session, then clean permissions and browser settings. A factory reset is only needed when symptoms survive a careful cleanup.
Why does the deleted app keep coming back?
A partner app is reinstalling it, or a backup tool is restoring it automatically. Remove both apps in the same safe mode session, turn off automatic app restore in your backup settings, and check your download folder for leftover installer files. If the app still returns, check device admin apps and unknown accounts for a hidden helper.
Is a free antivirus app enough to clean my phone?
No. A scan is a useful check after manual removal, but it rarely removes a stubborn threat on its own, because the threat often holds admin rights that block the scanner. Manual removal in safe mode, permission cleanup, and browser reset do the real work. A scanner confirms the result, it does not create it.
How do I know the phone is really clean?
Watch it for a full week. Popups should stop at once, battery and data use should return to normal within a day or two, and no new unknown apps should appear. If a whole week passes with no symptom, the cleanup held. If anything returns, note the exact time and app name, then repeat the safe mode pass with fresh eyes.
Your next step: run the safe mode check today
Open your app list now and write down three apps you do not remember installing. Then restart into safe mode, test for five minutes, and see whether the symptoms stop. That single test tells you whether a third-party app is the cause, and it costs you less time than one more day of popups. Clean phones stay clean when their owners install fewer apps, check each permission, and remove what they no longer use.
