Has your smartphone suddenly started showing ads in unexpected places? Do pop-up banners appear even on a locked screen, and your browser redirects to dubious sites? Most likely, one of the most common types of malware for adware virus - one of the most common types of malware for Androidhas lodged itself in the system. Such apps not only irritate with constant advertisements, but can steal personal dataload additional threats or even block access to device settings.

Unlike classic viruses, adware is often disguised as legitimate applications: from flashlights and optimizers to games with suspiciously high ratings. It is difficult to detect through standard means Androidas it is integrated into system processes or uses administrator rights. In this article we will analyze all methods of identifying and removing ad viruses from manual checking to using specialized tools, and also tell you how to prevent re-infection.

We warn you right away: some methods require root access or resetting to factory settings. If you are not ready for radical measures, start with safe steps and gradually move on to more serious actions. Now let's start cleaning!

Signs of an adware virus infection

The first step is to confirm that the problem is indeed related to the virus, and not to the phone settings or legitimate applications (for example, Google Ads in free games). Pay attention to the following symptoms:

  • 📱 Advertising outside applications: banners appear on the desktop, in the notification menu, or even on top of system windows (for example, when making a call).
  • 🔗 Redirection in the browser: when you open Chrome or Samsung Internet automatically redirects to sites with gambling, adult content or “winnings”.
  • 📦 Unknown applications: in the list of installed apps (Settings → Applications) there are suspicious utilities with names like System Update, Flash Player or Cleaner Pro.
  • 🔋 Increased battery consumption: the phone is discharged in a few hours without active use - the virus may be running in the background.
  • 📶 Suspicious traffic: mobile data or Wi-Fi is consumed even when you are not you are using a phone (check in Settings → Data transfer → Data usage).

If at least one of the points matches, your device is almost certainly infected. Do not ignore the problem: some ad viruses (for example, Shuanet or HiddenAds) can download Trojans to steal bank card data or spy on the user.

📊 How long ago did you notice an adware virus on your phone?
Less than a week
1-2 weeks
More than a month
I don’t remember

Step 1: Checking installed applications

Most ad viruses penetrate your phone through fake or hacked applications:

  1. Open Settings → Applications → All applications (on some phones the path may be different: Settings → Application Manager).
  2. Sort the list by installation date (latest added often turn out to be viruses).
  3. Check applications with suspicious names:
    • 🚩 Flash Player, Adobe Flash (outdated plugin that has not been needed for a long time).
    • 🚩 System Update, Android Update (fake updates).
    • 🚩 Cleaner, Booster, Optimizer (if you have not installed them).
    • 🚩 Games or utilities with low ratings and a small number of reviews.
  • Click on the suspicious application and select "Delete" or "Disable" (if the uninstall button is inactive, the virus has rights administrator, see the next step).

    • Attention! Some viruses disguise themselves as system processes (for example, com.android.system or google.play.services). Do not delete applications with a package name starting with "com.android" or "com.google" - this may cause the phone to not work. If in doubt, look for the name of the package c Google before deleting.

    ☑️ Checklist for checking applications

    Completed: 0 / 4

    Step 2: Removing administrator rights from the virus

    If the button "Delete" is inactive or when pressed it gives an error, the virus has received rights device administratorThis allows it to block deletion and recover after. reboot. To revoke rights:

    1. Go to Settings → Security → Device administrators (on some phones: Settings → Biometrics and security → Other security settings → Phone administrators).
    2. In the list, look for suspicious applications (often with random names or symbols).
    3. Uncheck the box next to them and click "Deactivate" or "Disable".
    4. Return to the list of applications (Settings → Applications) and try to remove the virus again.

      5. If there are no suspicious apps in the list of administrators, but removal is still impossible, the virus can use special permissions (for example, android.permission.BIND_DEVICE_ADMIN). In this case, only resetting to factory settings or uninstalling via ADB will help (see the section for advanced users).

      What to do if a virus blocks access to settings?

      If a virus redirects you from the administrators screen or blocks access to settings, try:

      1. Enter safe mode (hold down the power button → long tap on "Turn off" → "Safe Mode").

      2. In safe mode, the virus does not start - remove it through the standard settings.

      3. If this does not help, use another phone to install an antivirus (for example, Malwarebytes) via Google Play on the infected one. device.

      Step 3: Clearing the browser and cache

      Advertising viruses are often introduced into browsers through malicious extensions or changed settings. Even after the virus is removed, advertisements may continue to appear due to:

      • 🔍 Spoofed home pages (instead of Google a dubious one opens. search engine).
      • 📁 Malicious extensions (in Chrome or Samsung Internet).
      • 🗑️ Infected cache (temporary files with advertising scripts).

    To clear the browser:

    1. Open Chrome (or another browser) and go to ⋮ → Settings → Reset settings.
    2. Click "Restore default settings" This will remove malicious extensions and reset the home page.
    3. Clear cache and browser data:
      • For Chrome: Settings → Privacy → Clear data → Cached images and files.
      • For Samsung Internet: ⋮ → Settings → Personal data → Delete browsing data.

    If advertising appears in other browsers (for example Opera or Yandex Browser) - repeat the procedure for each of them. Also check the list of installed extensions: viruses are often disguised as “ad blockers” or “download accelerators”.

    💡

    After cleaning the browser, install a reliable ad blocker, for example uBlock Origin (available for Firefox on Android) or AdGuard. This will help prevent re-infection through web pages.

    Step 4: Using antiviruses for deep scanning

    If manual cleaning does not help, it’s time to use specialized tools. Not all antiviruses are equally effective against adware viruses, so we recommend the following apps:

    Antivirus Effectiveness against adware viruses Features
    Malwarebytes ⭐⭐⭐⭐⭐ Specializes in adware and Trojans. The free version allows you to scan and remove threats.
    Kaspersky Internet Security ⭐⭐⭐⭐ Detects hidden adware modules, but requires a subscription for complete cleaning.
    Bitdefender Mobile Security ⭐⭐⭐⭐ Detects well HiddenAds and similar viruses. There is a trial period.
    Dr.Web Light ⭐⭐⭐ Russian-language antivirus with a database of threats relevant to the CIS. Free version with limitations.

    How to scan:

    1. Download the selected antivirus from Google Play (not from third-party sites!).
    2. Run a full system scan (not a quick one!).
    3. If threats are found, follow the app instructions to remove them.
    4. Reboot your phone after cleaning.

    Attention! Some ad viruses block the installation of antivirus software. If you cannot download the app, use another phone or computer to download the APKfile from the official website (for example, Malwarebytes allows you to download the installation file directly). Make sure that the source is reliable!

    Step 5: Removing the virus via ADB (for advanced users)

    If the virus is not removed using standard methods and antiviruses do not detect it, a radical method remains - use Android Debug Bridge (ADB). This method requires connecting your phone to a computer and basic knowledge of the command line.

    Instructions:

    1. Enable USB debugging on your phone:
      • Go to Settings → About phone → Build number and tap on it 7 times to activate developer mode.
      • Return to Settings → System → Developer Mode and enable "USB Debugging".
  • Download ADB Tools to your computer (for example, official package from Google).
  • Connect your phone to the PC and open the command line (Windows) or terminal (macOS/Linux).
  • Enter the commands in order: 
    adb devices

    (the name of your device should appear)

    adb shell pm list packages

    (will show a list of all installed packages)

    adb shell pm uninstall --user 0 package_name

    (replace with a suspicious identifier, for example package_name to a suspicious identifier, for example com.system.update.fake).

    • Critical! Remove only those packages whose names you are sure of. Erroneous removal of system components (for example, com.android.settingswill lead to the phone not working. If you are not sure, it’s better skip this step and proceed to resetting the settings.

    💡

    Use ADB only if other methods have not worked. and is suitable for users with experience working with the command line.

    Step 6: Reset to factory settings (last chance)

    If none of the methods helped, remain hard resetThis will remove all data from the phone, including the virus, but will also erase all photos, contacts and applications. reset:

    • 📱 Make a backup copy of important data (photos, contacts, messages) via Google Account or manually to your computer.
    • 🔐 Make sure you remember your account password Google — after the reset, the phone will require it to unlock (FRP protection).
    • 🔋 Charge the phone at least 50% - the reset may take up to 30 minutes.

    How to reset:

    1. Go to Settings → System → Reset → Delete all data (reset to factory settings).
    2. Confirm the action (you may need to enter a PIN code or pattern).
    3. After reboot, set up the phone like new, but do not restore data from the backup copy —the virus could have been saved in the backup!

    Attention! On some phones (for example, Xiaomi, Huawei), resetting through the settings menu may not remove the virus completely if it is integrated into the firmware. In this case. you will need firmware via Fastboot a procedure for experienced users that requires official firmware from the manufacturer.

    What to do if the virus returns after a reset?

    This means that the virus was built into the firmware (often found on unofficial or custom ROMs). Solution:

    1. Download the official firmware for your model from the manufacturer's website.

    2. Flash the phone via Fastboot or Recovery (instructions). are searched by phone model).

    3. Do not install firmware from dubious sources - they may contain other viruses.

    How to protect your phone from re-infection

    Removing the virus is half the battle. To prevent it from returning, follow the rules of digital hygiene:

    • 🛡️ Install applications only. from Google Play. Avoid third-party stores (APKMirror, Aptoide) and sites with “hacked” versions of games.
    • 🔍 Check the reviews and rating before installation, viruses are often disguised as apps with 4-5 stars, but with suspiciously similar reviews.
    • 📋 Read the requested permissions. If the flashlight asks for access to SMS or contacts, this is a reason to be wary.
    • 🔄 Update regularly Android and applications. Updates close the vulnerabilities that viruses exploit.
    • 🚫 Do not click on advertising in the browser, especially if it promises “winnings”, “free gifts” or “hacked games”.
    • 🔒 Use an antivirus (for example, Malwarebytes) for periodic checks.

    If you often need to install APKfiles (for example, for testing software), use the service VirusTotal to check files before installation. Upload APK to the website - system. will scan it with dozens of antiviruses and show whether the file is safe.

    💡

    Most advertising viruses penetrate the phone through the user’s carelessness. It is enough to install a “hacked” game or a “useful utility” from an unreliable source once - and the virus is already in the system.

    FAQ: Frequently asked questions about advertising viruses on Android

    Can a virus appear on its own, without installing applications?

    Theoretically, yes, but it is extremely unlikely. Advertising viruses usually require user actions (installation APK, clicking on a malicious link, however, there are exceptions:

    • Vulnerabilities in Android (For example, DirtyCow), allowing the virus to penetrate through the browser.
    • Infected SD cards (the virus can be hidden in files and activated when connected).
    • Phishing attacks via SMS or messengers (for example, a "your photo" link from an unknown number).

    To minimize risks, disable installation from unknown sources (Settings → Security → Unknown sources) and do not connect other people's drives.

    Why does the antivirus not find the virus, although there is advertising?

    There are several reasons:

    • The virus is too new, and its signatures have not yet been added to the antivirus database.
    • The virus uses polymorphic code (changes its structure to evade detection).
    • The antivirus has not been updated for a long time.
    • The virus is integrated into system files and masquerades as legitimate processes.

    Try to scan the phone with several antiviruses or use Malwarebytes in deep scanning mode. Also check the phone for root access - some viruses get it without the user's knowledge.

    Is it possible to remove a virus without resetting settings?

    In 80% of cases - yes. Most ad viruses are removed through:

    • Removing suspicious applications (see Step 1).
    • Revoking administrator rights (Step 2).
    • Cleaning the browser (Step 3).
    • Antivirus scan (Step 4).

    Resetting settings is required only if the virus:

    • Built into the firmware (found on phones with unofficial ROMs).
    • Uses bootkit (loaded with the system).
    • Blocks all removal attempts, including ADB.
    How to check if the virus remains after cleaning?

    Perform a comprehensive check:

    1. Reboot the phone and observe for 10-15 minutes — do advertisements appear without launching applications?
    2. Check the list of running processes via Settings → Developer → Running services (or use OS Monitor from Google Play).
    3. Scan your phone with two different antiviruses (for example, Malwarebytes + Kaspersky).
    4. Check traffic in Settings → Data transfer —if the background consumption remained high, the virus could persist.

    If after 2-3 days the advertisements do not appear, the phone is clean. Otherwise, repeat the cleaning or reset the settings.

    Can ad viruses steal? data?

    Yes, some viruses (for example, family Agent Smith or GriftHorse) not only show advertising, but also:

    • Steal browser history and cookies (for display of targeted advertising).
    • Intercept SMS (including confirmation codes from banks).
    • Collected contacts and photos for blackmail or spam mailings.
    • Sign up for paid services via WAP-billing (debits from the account phone).

    If you entered passwords or card data on an infected phone - change them after cleaning. Also check the statement from the operator for unauthorized charges.