Advertising that suddenly starts appearing on the lock screen or on top of other applications is not just an annoying nuisance, but a clear sign of malware on your smartphone’s system. Many users are faced with a situation where intrusive banners they block the desktop, interfere with reading messages, or even block access to settings. Most often, the cause of this behavior is not a “classic” virus, but so-called adware - adware that penetrates the device under the guise of useful utilities.
There is no need to panic, since in 90% of cases the problem can be solved independently without contacting a service center. However, you need to act quickly: the longer a malicious application remains on the system, the more data it can collect and the more difficult it will be to get rid of it. In this article, we will look at effective diagnostic methods, ways to remove hidden threats, and tools to prevent similar situations in the future.
Primary diagnosis and finding the source of the problem
Before embarking on radical cleaning methods, you need to determine exactly which application is causing the pop-ups. Often, malicious code is disguised as system services or does not have an icon in the menu, which makes it difficult to detect. The easiest way to identify the culprit is to remember what you installed shortly before the ad appeared. These could be memory boosters, flashlights, QR code scanners, or games from unverified sources.
Open the settings of your device and go to the Applications or All applicationssection. Carefully scroll through the list, paying attention to apps without a name or with a blank icon. Such “ghost” applications are often carriers of advertising code. If you see a app you're using, but it doesn't have a logo, this is almost guaranteed to be the source of the problem.
It's also worth checking the list of recently installed apps. Even if the application appears legitimate and has a name, its behavior may be suspicious. Pay attention to permissions: if a simple calculator asks for access to contacts, SMS or an overlay (on top of other windows), this is a red flag.
⚠️ Warning: If ads appear immediately after turning on the screen, without unlocking the phone, then the malware has gained device administrator rights or has embedded itself deep into the system. In this case, normal deletion may not be available.
For deeper diagnostics, you can use the safe operation mode. In this mode, only system applications are launched, which allows you to confirm the viral nature of the advertisement. If the banners disappear in safe mode, then the problem is definitely in third-party software. To enter this mode, you usually need to hold down the power button on the screen, and then long-press "Shut down" or "Reboot" until the corresponding request appears.
Removing malicious applications through settings
After you have identified a suspicious application, the next step is to uninstall it. The standard deletion procedure is simple: go to Settings → Applications, find the desired item in the list and click the Deletebutton. However, viruses often block this feature by making the button inactive or hiding the application itself from the list of visible ones.
If the delete button is inactive, most likely the application has received device administrator rights. To revoke these rights, go to the Security or Biometrics and securitysection, then find the item Device administrator applications (the path may differ depending on the model Samsung, Xiaomi or Huawei). Uncheck the suspicious application, then return to the applications menu and delete it in the standard way.
In cases where the application cannot be found in the general list, try sorting apps by installation time or size. Sometimes malicious code hides in the browser cache. Clearing browser data can help: go to the settings of a specific browser (Chrome, Yandex, etc.), select History and click Clear history, making sure that "Cookies" and "Cached Images" are selected.
☑️ Checklist for virus removal
Do not forget that some advertising modules can be built into legal applications that you downloaded from the official store. If the problem started after installing a specific game or utility, try removing it. Even if the application seems useful, its update could contain malicious code.
Use anti-virus scanners for cleaning
Manual search is not always effective, especially if the virus uses complex camouflage methods. In such cases, specialized antivirus solutions come to the rescue. There are many free and paid utilities for Android that can detect hidden threats. The market leaders are Dr.Web Light, Kaspersky Internet Security i Malwarebytes.
Install the selected antivirus from the official store Google Play and run a full system scan. Modern scanners can detect not only known virus signatures, but also suspicious behavior of applications. If your antivirus detects a threat, follow its quarantine or removal recommendations. It is important not to ignore warnings, even if the system reports that the risk is “low.”
It is worth noting that some viruses can block the installation of antiviruses or close them immediately after launch. In such a situation, try downloading the installation file (.apk) of the antivirus from the official website of the developer through a browser on your computer, transfer it to your phone and install it manually. Before installation, make sure that your security settings allow installation from unknown sources.
| Antivirus name | License type | Main function | Impact on the battery |
|---|---|---|---|
| Dr.Web Light | Free | Treatment and removal | Low |
| Kaspersky | Freemium | Real-time protection | Medium |
| Malwarebytes | Free | On-demand threat search | Low |
| Avast | Freemium | Analysis of Wi-Fi and applications | High |
Why may an antivirus not find a virus?
Some types of adware (adware) are technically not viruses in the classical sense. They use legal system permissions to display ads, so antivirus apps may flag them as "potentially unwanted apps" (PUPs) rather than as critical threats. In such cases, only manual removal helps.
Blocking ads at the network and DNS level
If deleting applications did not help completely get rid of pop-up windows, the advertisement may be loaded via an Internet connection. This often happens when visiting infected sites or using free Wi-Fi networks with embedded advertising. An effective solution in this case is to set up a private DNS.
Starting with Android version 9, the system has a built-in private DNS function that allows you to filter traffic at the domain name level. To do this, go to Settings → Connections → Other connection settings → Private DNS. Select the "ISP Hostname" mode and enter the address of a reliable ad blocker, for example: dns.adguard.com. This method blocks known ad servers, preventing them from downloading content to your device.
An alternative method is to use browsers with built-in protection, such as Brave or DuckDuckGo. They automatically block trackers and advertising scripts on web pages. However, this method will not protect against advertising inside other applications, so setting DNS is a more universal solution.
⚠️ Attention: After changing DNS, some sites or applications may not work correctly or stop loading content. If you encounter access problems, return the DNS setting to "Auto" or "Disabled" mode.
Remember that the DNS setting does not remove the virus from the phone, but only blocks the advertising delivery channel. Therefore, this method should be used in conjunction with cleaning the system from malicious applications.
Use the code dns.adguard.com to quickly block most advertising networks without installing additional applications. This works at the level of the entire system, and not just in the browser.
Reset to factory settings as a last resort
In situations where a virus has deeply embedded itself in the system, blocks access to settings, or constantly returns after removal, the only reliable way is to completely reset the device. This procedure will return the phone to its out-of-the-box state, removing all user data, applications and, unfortunately, malware.
Before performing a reset, it is critical to back up your important data: photos, contacts and documents. You can use cloud services Google Drive or transfer files to your computer. Make sure you remember the password for your Google account, since after resetting the system will require it to confirm ownership of the device (FRP protection).
The reset procedure is performed through the settings menu: System → Reset settings → Delete all data (reset to factory settings). If the menu is unavailable due to a virus, you can use Recovery mode. To do this, turn off the phone, then hold down the combination of buttons (usually Volume up + Power or Volume down + Power, depending on the model). In the menu that appears, select the item Wipe data/factory reset and confirm the action.
A full reset is a guarantee of removing 99% of viruses, but you will lose all data. Make backups regularly so as not to lose important information at a critical moment.
After the reboot, the phone will be clean. Don't rush to restore all applications from a backup at once. First, install an antivirus and check the system, then return apps selectively, observing the behavior of the device.
Prevention: how to avoid infection in the future
The best protection against viruses is prevention. Most users infect their devices themselves by downloading dubious software or clicking on dangerous links. Following simple rules of digital hygiene will help you avoid problems with advertising in the future.
First, download applications only from official stores such as Google Play. Although malware occasionally slips through there, Google's security system (Play Protect) checks them much more thoroughly than third-party resources. Secondly, carefully read reviews and permissions before installing. If a simple flashlight asks for access to the microphone and contacts, this is a reason to refuse installation.
- 🛡️ Regularly update the Android operating system and installed applications, as updates often contain security patches.
- 🚫 Disable the installation of applications from unknown sources in the security settings if you do not plan to install APK files manually.
- 🔍 Periodically scan your device with an antivirus, even if nothing bothers you.
- 🌐 Do not follow links from SMS messages from unknown numbers promising winnings or bonuses.
You should also be careful with so-called “cleaners” and "accelerators". Often these apps that promise incredible phone speeds turn out to be data collectors and advertising sources. In modern versions of Android, built-in optimization tools work quite effectively, and third-party utilities are often not needed.
Why do ads appear even after uninstalling the application?
This may be due to the fact that a virus has installed additional modules or changed system settings. It is also possible that you did not delete the main application, but only its shortcut. In such cases, you need to re-check the list of applications and, possibly, reset the browser settings.
Can advertising be a sign of a Google account being hacked?
Pop-up advertising itself more often indicates a virus on the device, rather than a hacked account. However, if you see strange activity in your mail or purchase history, immediately change your password and enable two-factor authentication.
Is it safe to use root privileges to remove viruses?
Getting root privileges allows access to system files, which theoretically allows you to remove any virus manually. However, this will void the device's warranty, reduce overall system security, and may cause banking applications to stop working. This is not recommended for the average user.
How to distinguish a virus from legal advertising in free games?
Legal advertising is shown only within the application, usually between levels or in the menu. Viral advertising pops up on the desktop, when you unlock the screen, or on top of other applications when the game is not even running.
What to do if the "Delete" button is inactive and administrator rights are not removed?
Try entering Safe Mode. In this mode, third-party applications will not launch, and you will be able to revoke administrator rights and remove the virus without resistance. If this does not help, the only option left is to reset to factory settings via Recovery.