The situation when an advertising banner suddenly appears on the smartphone screen, blocking the desktop or another application, is familiar to many users. This is not just an annoying factor, but a sign that a malicious script is active on your device or an application with an aggressive monetization policy is installed. This pop-up advertising is often disguised as system notifications or messages from instant messengers, forcing the user to click on a link.
The reasons for the appearance of such windows may be recently installed free utilities, games with a dubious reputation, or visiting sites with dangerous content. In some cases, the culprit is even popular software, which, after an update, began to display advertisements on top of other windows. It is important to act quickly to avoid installing more serious threats or accidentally purchasing a paid subscription.
In this article, we will look at effective methods of dealing with intrusive banners. You'll learn how to find the culprit application through system settings, use special blocking tools, and set up secure DNS. We will also consider cases when deeper intervention in the operation of the operating system is required Android.
Searching for and removing malicious applications
The first step in the fight against advertising is a thorough audit of the installed software. Viruses are often disguised as harmless apps such as Flashlight, QR Code Scanner, or Memory Cleaner. Go to your phone settings and open the Applicationssection. Carefully review the entire list, paying attention to apps without an icon or with an empty name.
If you cannot find a suspicious application in the general list, try sorting them by installation date. Pop-up windows usually appear shortly after installing a particular software. Find the app that was installed around the time the problem started and uninstall it. Sometimes malicious code is hidden in the browser cache, so it is also worth clearing the history and data of the web browser.
For a more in-depth analysis, you can use the built-in service Google Play Protection. It automatically scans your device for threats. Run the scan manually through the app store settings. If standard methods do not help, the application may be hidden in the list of device administrators, which we will discuss below.
☑️ Checking applications
Disable permissions to display on top of other windows
The key mechanism that allows advertising to overlap the interface of other apps is called "Display on top of other applications." Without this permission, the banner would not be able to float on top of your desktop or open game. Disabling this function for suspicious apps is one of the most effective ways to solve the problem.
To manage these rights, go to Settings and find the "Special Access" or "Advanced Settings" item. Inside this menu, select the option Display on top of other applications. You will see a list of all apps that have this right by default or have requested it from the user.
Examine the list carefully. System applications such as instant messengers or launchers can legitimately use this feature to display pop-up chats or video players. However, simple utilities, calculators, or games should not have this access. Found suspicious items must be disabled by switching the corresponding toggle switch to an inactive state.
⚠️ Attention: Do not disable this function for Google system services or your launcher, otherwise the phone may not work correctly. Block access only for third-party apps whose security you are not sure about.
If the ads stop after disabling permissions, then you have found the source of the problem. In this case, it is recommended to completely remove this application, since it violates the security rules of the platform Android. Even if the app seems useful, its behavior indicates the presence of malicious code.
If in the “Display on top of other applications” list you see the “Settings” item with a gear icon, but without the name of the developer, this is almost certainly a virus. Remove it immediately.
Checking device administrator rights
Some types of malware have elevated privileges, receiving device administrator status. This allows them to protect themselves from being deleted: the "Delete" button in the application settings will be inactive or grayed out. Before you try to remove such a virus, you need to deprive it of these rights.
Go to the Security or Privacy section in the settings of your smartphone. Find the "Device Administrator Applications" (or "Device Administrators") subsection. A list of apps that have special control over the system is displayed here.
If you see here an unknown application or a app that you have not granted such rights, immediately uncheck the box next to it. The system will ask you to confirm the action. After the rights are revoked, you can safely remove this application through the standard app management menu.
| Application type | Do you need administrator rights? | Action |
|---|---|---|
| Antivirus | Yes (for protection) | Leave on |
| Search for device | Yes (for blocking) | Leave on |
| Flashlight / Calculator | No | Urgently disable |
| Games | No | Urgently disable |
| Storage & Performance | No | Urgently disable |
What to do if administrator rights are not removed?
If the system does not allow you to uncheck the virus application, try rebooting your phone in safe mode. To do this, you usually need to hold down the power button, and then hold down the “Power off” option on the screen for a long time until you are prompted to enter safe mode. In this mode, third-party applications will not run, and you can safely revoke rights and remove the virus.
Ad blocking via private DNS
Modern versions Android (starting from 9.0) allow you to block ads at the network level without installing third-party applications. This is done through setting up a private DNS (Domain Name System). This method effectively cuts off requests to known ad servers, preventing banners from loading.
To activate this function, go to Settings -> Connections (or "Network and Internet"). Find the item Private DNS (Private DNS). By default it is set to "Auto" or "Disabled". You need to select the "DNS Provider Hostname" mode (manually).
In the address field, enter the following domain: dns.adguard.com. This is a free server that filters traffic and blocks known advertising domains. After saving the settings, restart your phone. Now most pop-ups and banners in the browser and applications will stop loading.
This method does not require root access and works globally for all connections, including mobile data and Wi-Fi. However, it is worth remembering that in rare cases, such blocking can break some applications that rely on ad networks for their functionality, although this happens extremely rarely.
Setting up a private DNS on dns.adguard.com is the most effective way to block ads without installing heavy antiviruses or gaining root access.
Clearing browser notifications
Often users confuse system advertising with spam notifications from sites. You might have accidentally clicked "Allow" on some portal and now it's sending push notifications that look like pop-up messages. These windows are not viruses, but require manual browser settings.
Go to the settings of your main browser (Chrome, Yandex, Samsung Internet). Find the section Notifications or "Site Settings". There will be a list of resources to which you have given consent to display messages. Study this list carefully.
Delete or block all suspicious sites with names like “News-update”, “Win-prize” or a set of random characters. After clearing the list, notifications will stop appearing in the curtain and on top of the screen. It is also recommended to enable the built-in "Safe Browsing" feature in your browser settings.
- 🔍 Check the "Notifications" section in the Chrome and Yandex Browser settings.
- 🚫 Block access to all sites with unclear names.
- 🧹 Clear your history views and cookies to completely reset permissions.
Resetting settings as a last resort
If none of the above methods helped get rid of the intrusive problem pop-up advertising, the virus has probably penetrated deeply into the system or changed system files. In such a situation, the most reliable solution is to completely reset the device to factory settings.
This procedure will delete all data from the phone, including contacts, photos and installed applications, returning it to the “as from the store” state. Before you begin, be sure to back up your important data to cloud storage or your computer. Make sure you remember the password for your Google account, as it will be required after the reset.
To perform the reset, go to Settings -> System -> Resetting settings. Select "Erase all data (factory reset)". The process will take a few minutes, after which the phone will reboot. The virus will be completely destroyed along with all user data.
⚠️ Attention: Before resetting the settings, be sure to remove the memory card (SD card), if installed. The virus may be on it, and if the card is reinstalled, the infection will occur again. Format the memory card separately via a computer.
Preventing the appearance of advertising in the future
To prevent the problem from returning, it is important to maintain digital hygiene. Install applications only from official sources, such as Google Play Market or Galaxy Store. Avoid downloading APK files from dubious forums and file hosting services, as this is where modified versions of apps with virus code are most often distributed.
Regularly update the operating system and installed applications. Developers are constantly closing security vulnerabilities that hackers use to inject advertising. It is also not recommended to grant applications unnecessary permissions: a flashlight does not need access to contacts, and a calculator does not need access to a location.
Periodically audit installed apps. If you stop using an application, delete it. The less third-party software on the phone, the lower the risk of contracting an infection. Use built-in protection tools and do not ignore security warnings.
Install a lightweight antivirus, such as Malwarebytes or Dr.Web Light, and run a full scan once a month. This will help identify hidden threats before they start showing ads.
Why do ads appear even after uninstalling the application?
This may be due to the fact that the virus has left behind hidden files or scripts on the system. It is also possible that you have several infected applications installed and you only deleted one of them. In this case, it is recommended to check your administrator rights and reset your settings.
Is it safe to use DNS to block ads?
Yes, using public DNS servers such as AdGuard DNS is completely safe. They only filter requests to advertising domains without changing your personal data or slowing down the Internet. This is a standard feature of modern operating systems.
Can advertising be a sign of a Google account being hacked?
Pop-up advertising itself more often indicates a virus on the phone, rather than an account being hacked. However, if you notice suspicious activity in your mail or purchases, immediately change your password and enable two-factor authentication.
How to distinguish a system notification from an adware virus?
System notifications usually have a clear application icon in the status bar and disappear after a swipe. Advertising viruses often do not have an icon, appear suddenly on the entire screen, and are difficult to close. In addition, they can even appear on the lock screen.