Suddenly appearing advertising on the entire screen can piss off even the calmest user. Banners that pop up on top of your desktop or when you unlock your device are not just annoying, but can also hide a real threat to the security of your data. Most often, the problem lies in the installation of free applications that use aggressive monetization, or in the activity of malware that has entered the system through third-party sources.
Understanding the nature of these pop-up windows is the first step to successfully eliminating them. In most cases, the culprits are not system processes, but specific apps that have been given permission to display notifications or appear on top of other windows. Without panic and chaotic deletion of files, you can effectively clean your smartphone, returning it to its former speed and clean interface.
In this article we will analyze in detail all the possible reasons for the appearance of advertising and offer proven methods of dealing with it. You will learn how to find the hidden culprit through system settings, how to block spam in your browser, and what drastic measures should be taken if standard methods do not help. Follow the instructions carefully so as not to delete important data along with garbage.
Identifying the source through notification settings
The most common type of banners are advertising push notifications that come from sites or applications. They may appear even when the browser is closed. To stop this flow, you need to go to the notification settings and check the list of allowed senders. Often, users accidentally click “Allow” on sites with dubious content, after which they begin to receive tons of spam.
Go to the section Settings → Applications → Notifications (the path may vary slightly depending on the model Samsung or Xiaomi). Carefully study the list of apps. Look for names that don't mean anything to you, or icons without captions. Often, malware disguises itself as system services, using names like “System Update”, “Wi-Fi Service” or just a bunch of random characters.
⚠️ Attention: If you see an application without an icon or with a transparent icon in the list of installed apps, this is almost guaranteed virus. Proceed immediately to remove it.
For each suspicious item, turn off the notification slider. If an app seems critical to you but is spammy, try first simply stopping it from showing notifications without uninstalling the app itself. This will help you understand whether the source of the problem has actually been found. If the banners disappeared after disabling a specific item, you win.
It is also worth checking the permissions for specific sites in the browser Chrome. Go to Settings → Site settings → Notifications. This displays a list of all web resources to which you have given consent to send messages. Ruthlessly remove all unknown domains from this list. Often they are the source of intrusive banners that imitate system messages.
Periodically go to the notification settings and revise the list. Many applications are updated and start spamming only some time after installation.
Searching for hidden applications in the installed list
Some malware is designed to be invisible to the user. They do not appear in the general list of applications on the desktop and may not be in the standard settings menu. However, deep in the system they continue to work, generating advertising traffic. You can detect such “invisible” users through the extended application management menu.
Open Settings → Applications → All applications. Scroll to the very end of the list. Look for applications that do not have a title (empty field) or icon. On some firmware, such an application is displayed as a white square or does not have a graphic symbol next to the name at all. Clicking on such an application usually opens a page with information where an uninstall button is available.
☑️ Search for hidden malware
If the standard list does not show anything suspicious, try sorting applications by installation time. Remember when exactly banners started appearing. Uninstall all apps installed during this period, especially if they were “optimizers”, “flashlights” or dubious games. Often, an adware module is embedded in legal but free utilities.
In advanced cases, the virus can masquerade as a system process with the name android.system or similar. Be careful not to remove real system components such as Google Play Services or System interface. Focus on the application size and installation date. System processes are usually large in size and dated to coincide with the date of purchase of the phone or the last major OS update.
What to do if the “Delete” button is inactive?
If the delete button is gray, then the application has device administrator rights. You need to go to Settings → Security → Device Administrators and uncheck the suspicious application. After that, it can be deleted in the usual way.
Disabling the “On top of other windows” function
The mechanism for displaying banners on top of active content is regulated by a special permission in Android. If an app has the "draw on top" permission, it can cover your screen with ads at any time, blocking access to essential features. Disabling this right for unverified apps is an effective prevention method.
Find the section in your phone settings that is responsible for special features or additional permissions. In pure Android this can be called Special. capabilities → Access to notifications or Applications → Special. access → Over other applications. In shells MIUI or OneUI the path may differ, so use the search in the settings by entering the query “over”.
In the list that opens, you will see all applications that have the technical ability to overlap the screen. Leave only those that really need it enabled: instant messengers (for pop-up chats), browsers (for video mode) or launchers. All others, especially games, calculators and simple utilities, should be deprived of this right.
| Application type | Do you need permission? | Risk of banners |
|---|---|---|
| Messengers (Telegram, WhatsApp) | Yes (for chats) | Low |
| Flashlight / Calculator | No | High |
| Memory cleaning / Antivirus | No (often fake) | Critical |
| Browser | Optional | Average |
| Games | No | High |
By disabling this resolution for suspicious software, you deprive it of the ability to display full-screen banners. The app can continue to run in the background, but will no longer intrusively interrupt your work. This is one of the most effective ways to combat advertising that appears randomly.
Banning the “On top of other windows” right for simple utilities blocks the mechanism for displaying full-screen advertising banners without deleting the application itself.
Cleaning the browser from advertising spam
A significant part of the banners originates not from installed applications, but from the web browser. When visiting sites with pirated content or questionable files, users often encounter aggressive scripts that require notification permission or automatically redirect to advertising pages. Clearing browser data solves this problem.
Go to the settings of your main browser (most often it is Google Chrome). Go to section Settings → Privacy and Security → Clear history. Select the "All time" time range and be sure to check the "Cookies" and "Images and other cached files" checkboxes. This will remove traces of your presence on advertising sites.
⚠️ Attention: Clearing cookies will lead to logging out of accounts on sites. You will have to re-enter logins and passwords on your favorite resources.
After clearing the history, it is important to check the site settings. In the same browser settings menu, find the item Site settings. Check the “Pop-Ups” and “Redirections” sections - they should be blocked. Also go to the “Notifications” section and remove all sites from the allowed list, except those that you trust 100% (for example, email services).
For enhanced protection, it is recommended to install an extension or use a browser with a built-in ad blocker, for example Brave or DuckDuckGo. They automatically cut off most advertising scripts at the page loading stage, preventing the appearance of banners and slowing down the phone due to loading heavy content.
Enable the “Traffic Saver” or “Light Mode” mode in the browser. This often blocks the loading of heavy advertising banners and speeds up the opening of pages.
Using anti-virus scanners and a traffic analyzer
If manual methods did not help find the source of the problem, you should use specialized software. Antivirus apps are capable of detecting hidden miners and Trojans that masquerade as system processes. However, it is important to choose proven solutions, since many “antiviruses” in the Play Market themselves are a source of advertising.
It is recommended to use solutions such as Malwarebytes, Dr.Web Light or Kaspersky. Download the application only from the official store Google Play. After installation, run a full system scan. These apps have signature databases of known ad viruses and can find what is hidden from the user's eyes in the standard menu.
An alternative method is to use a traffic analyzer, for example, an application NetGuard (requires skills) or a built-in traffic monitor. Go to Settings → Connections → Data Usage. See which app is consuming traffic in the background when you're not using your phone. If Flashlight or Calendar consumes hundreds of megabytes in the background, this is a clear sign that the application is loading ads.
Why may an antivirus not find a virus?
Modern advertising modules often use legal developer certificates or disguised as system component updates. In such cases, only resetting the settings or manually calculating traffic consumption helps.
Remember that installing several antiviruses at the same time is not recommended, as they can conflict with each other, slowing down the device. Choose one reliable product, scan, remove threats and, if desired, remove the antivirus itself so as not to take up memory space if you no longer need it for ongoing protection.
Radical measures: reset and safe mode
When none of the above methods help get rid of intrusive banners, you have to resort to extreme measures. This may mean that the virus has deeply embedded itself in the system or has acquired superuser rights (Root), which makes it impossible to remove it using standard methods. In such cases, safe mode or a hard reset helps.
Safe mode allows you to boot Android only with system applications, disabling all third-party software. To enter it, you usually need to hold down the power button on the screen, and then in the menu that appears, hold down the “Shut down” or “Reboot” item with your finger for a long time until you are prompted to boot into safe mode (depending on the model Samsung, Xiaomi etc.).
If the banners disappear in safe mode, then one of the applications you installed is to blame. While in this mode, you can safely go into settings and remove recently installed apps one at a time, rebooting into normal mode after each removal to check the result. This is a time-consuming but surefire way to find the culprit.
☑️ Actions in Safe Mode
The most radical, but guaranteed method is a full reset to factory settings (Hard Reset). This procedure completely destroys all data on the phone, including viruses, settings and personal files. Before doing this, be sure to back up your contacts and photos.
To perform a reset, go to Settings → System → Reset settings → Delete all data. Confirm the action and wait for the reboot. The phone will return to the “as from the store” state. After setting up, do not restore all applications from a backup copy at once, but install them manually so as not to return the virus back.
⚠️ Attention: Resetting settings will delete all photos, messages and files from the internal memory. Be sure to copy important data to your computer or to the cloud before starting the procedure.
Full reset to factory settings is the only 100% guarantee of removing any, even the most complex viruses, but requires first saving personal data.
Frequently asked questions
Why do advertisements appear even after deleting the application?
Perhaps the application left behind shell files or you did not remove the main virus, but only its manifestation. Also check your browser notification settings - often the source is there and not in installed apps. In rare cases, the virus could install an additional hidden application.
Is it possible to remove a system application that displays advertising?
Without root access, deleting system applications is dangerous - this can lead to system failure (bootloop). It is better to revoke all permissions from it, prohibit work in the background and access to the Internet through the settings. If the application is critical to the system, a hard reset may be the only solution if a virus has entered the system partition.
Is it safe to use ad cleaners?
Most free "cleaners" and "boosters" are themselves a source of advertising and data collection. Use only proven antiviruses from reputable vendors. The best way to protect yourself is not to install dubious software and carefully read the permissions during installation.
How to distinguish a virus from legal advertising in an application?
Legal advertising is shown only inside the application interface. If a banner appears on the desktop, when the screen is unlocked, or when the application is closed, it is a virus or an aggressive push notification. System windows asking you to “update Flash Player” or “clean up the virus” are always a scam.
Will changing the DNS help remove advertising?
Yes, using a private DNS (for example, dns.adguard.com) in the connection settings can block the loading of advertising banners at the network level. This will not remove the virus, but will render it useless as it will not be able to download advertising content. Found in: Settings → Connections → Private DNS data-i="164">Cleaning the browser from advertising spam Settings → Connections → Private DNS.