Suddenly appearing advertising on the locked screen of a smartphone is not just an annoying factor, but a sure sign that something has settled in the operating system adware virus. Instead of the usual slider or weather widgets, the user sees intrusive banners that block the interface and interfere with the normal operation of the device. Most often, the source of the problem is free applications downloaded from unverified sources or even from the official store that have received excessive access rights.
Removing such malware requires care, since virus developers disguise their apps as system processes or useful utilities. You will have to analyze installed applications, check permissions and, possibly, use special protection measures. Ignoring the problem can lead to the theft of personal data, since advertising modules often collect information about user actions.
In this article we will look at effective ways to remove ads on Android when unlocking, starting from manually searching for the culprit and ending with a deep scan of the system. It is important to act consistently so as not to delete important system files, but to ensure that you get rid of annoying junk. It is critically important to find an application that has the “On top of other windows” permission; it is the one that is most often responsible for displaying content on the locked screen.
Analysis of installed applications and searching for hidden threats
The first step in the fight against intrusive advertising should be a thorough audit of all installed apps. Viruses are often disguised as harmless utilities: flashlights, calculators, QR code scanners or memory cleaners. Go to the menu Settings → Applications and carefully look through the entire list. Pay special attention to apps without an icon or with a name consisting of a set of characters.
Often, malware is hidden at the end of the list or hidden under the name of the system process. If you see an app that you didn't install, or one that was installed around the time the ad appeared, this is a prime suspect. Uninstall such an app should be executed immediately.
- 🔍 Look for apps with a blank "Developer" field or no description.
- 📅 Sort the list by installation date to find recently added apps.
- 🚫 Pay attention to applications that require access to contacts and microphone without obvious need.
⚠️ Attention: Some viruses block the uninstall button or are immediately restored after uninstallation. In this case, it is necessary to move on to more advanced cleaning methods described below.
Do not rely only on visual inspection. Many modern Trojans are able to hide from the standard list of applications, remaining active in the background. If the standard application manager does not show suspicious objects, but advertisements continue to appear, the problem may lie deeper in the system.
Using Safe Boot Mode for Diagnostics
If you cannot remove a suspicious application in the usual way, or it constantly returns, you need to start the smartphone in Safe Mode (Safe Mode). In this state, the operating system Android loads only with basic system services, disabling all third-party apps. This allows you to gain complete control over the device.
To enter safe mode, you usually need to hold down the power button on the screen, and then hold your finger on the “Power” or “Reboot” button for a long time until the corresponding prompt appears. On different models, such as Samsung, Xiaomi or Honor, the combinations may differ. After the reboot, “Safe Mode” will appear in the corner of the screen.
While in safe mode, go to application settings again. Now you can remove the virus that previously resisted. Find the culprit app and click Uninstall. If the button is active and the process was successful, then you have neutralized the threat.
☑️ Actions in Safe Mode
After successfully removing the malware, you need to reboot the phone normally. If the advertisement disappears, the problem is solved. If it remains even in safe mode, this may indicate a more serious infection of the system partition or the presence of advertising from the telecom operator.
Checking permissions and the “On top of other windows” function
The key function that ad viruses use to display banners on the locked screen is the “Display over other apps” permission. Without this right, the application cannot display content on top of system windows or the lock screen. Checking this setting is one of the most effective ways to find the culprit.
To check permissions, follow the path Settings → Applications → Special access → On top of other windows (the path may vary slightly depending on the version Android). The list that opens will display all applications that have this right.
Examine the list carefully. System apps like Phone, Messages or instant messengers can legitimately use this feature for pop-up calls. However, if you see an unknown “File Manager”, “Battery” or a game that did not require such permission, disable it immediately.
| Application type | Do I need permission | Advertising risk | Action |
|---|---|---|---|
| Messengers (Telegram, WhatsApp) | Yes (for calls) | Low | Leave |
| Flashlight / Calculator | No | High | Prohibit |
| Games | No | High | Prohibit |
| Storage & Performance | No | Medium | Deny |
Disabling this right does not remove the application, but deprives it of the ability to display ads on top of other windows. This is a temporary measure that helps identify the app, after which it is still better to remove it completely.
What to do if the application is not uninstalled?
If the delete button is inactive, the application may have device administrator rights. Go to Settings → Security → Device Administrators and uncheck the suspicious app. After this, it can be removed in the standard way.
Scanning the system with antivirus utilities
When manual methods do not produce results, specialized antivirus scanners come to the rescue. Unlike a PC, it doesn't require constant background protection, which drains the battery. All you need to do is run a deep scan on demand. Popular solutions, such as Android No constant background protection is required, which drains the battery. All you need to do is run a deep scan on demand. Popular solutions such as Malwarebytes, Kaspersky or Dr.Web, have signature databases of well-known advertising Trojans.
Install an antivirus from the official store Google Play, update the databases and run a full scan. The app will analyze installed APK files, comparing their hashes with a database of known threats. This allows you to find even those viruses that have changed their name or icon.
- 🛡️ Malwarebytes specializes in searching for adware and potentially unwanted apps.
- 🔍 Dr.Web Light is effective against Trojans that infiltrate system processes.
- 🚀 Kaspersky provides high scanning speed and heuristic analysis.
⚠️ Attention: Avoid installing “antiviruses” with dubious names like “Super Clean Virus Removal”, which themselves may be a source of advertising. Use only trusted brands.
After detecting threats, follow the antivirus instructions to neutralize them. In some cases, a reboot may be required to completely remove files. If the antivirus finds a threat, but cannot remove it, it will offer to switch to safe mode for cleaning.
Use the “Scan through Google Play Protect” function in the Play Store settings as an additional layer of security, although it does not always cope with new ad viruses.
Cleaning the browser and resetting notification settings
Sometimes The source of “unblocking advertising” is not a virus in the system, but intrusive notifications from sites that you accidentally subscribed to in your browser. This often happens when visiting sites with pirated content or file hosting services, where a window pops up asking you to “Confirm that you are not a robot,” which actually gives permission to display notifications.
To remove such advertising, you need to clear your browser data. Log in Settings → Applications, find your browser (Chrome, Opera, Yandex) and select “Storage”. Click the "Clear all data" or "Erase data" button. This will delete the cache, cookies and, most importantly, permissions for notifications.
It is also worth checking the list of sites that have rights to notifications. In your browser settings, find the “Notifications” or “Sites” section and disable all suspicious addresses. Often you can find strange domains there that you did not visit deliberately.
If you use several browsers, the procedure must be repeated for each of them. Malicious scripts are often written into all available browsers on the device to guarantee the display of advertising.
Radical measures: Reset to factory settings
If none of the above methods helped get rid of advertising, the last but most reliable option remains - a full reset to factory settings (Hard Reset). This procedure completely deletes all data from the internal drive, including viruses that may have embedded themselves deep into the system.
Before performing a reset, be sure to back up your important data: contacts, photos and documents. After the reset, it will be impossible to recover the deleted virus, but you will also lose your files if you do not make a backup. The reset process is usually located in the menu Settings → System → Reset settings.
Factory Reset is guaranteed to remove 99% of viruses, as it overwrites the system partition with a clean copy of the firmware.
After the reset, the phone will turn on like new. Be careful when restoring applications: do not use automatic recovery from an old backup of all apps at once, as you may also return a virus. Reinstall applications manually from trusted sources.
Is it possible to remove ads without root access?
Yes, in 95% of cases root access is not required to remove an ad virus. It is enough to find a malicious application in the settings and remove it, or use anti-virus scanners that work in user mode.
Why do advertisements appear immediately after turning on the phone?
This means that the virus has registered itself in startup. It is activated immediately after system startup. You need to check the list of applications with autorun rights or use safe mode to remove it.
Is it safe to use ad blocking applications?
Applications like AdGuard can block ads in browsers and some applications, but they cannot always remove system ads from a virus. In addition, the blockers themselves require careful selection so as not to become a source of problems.
What to do if the phone is blocked and requires money?
This is not just an advertisement, but a blocking virus. In this case, only flashing the device through a computer using official utilities from the manufacturer (Mi Flash, Odin, SP Flash Tool) often helps.