Pop-up windows on Android: reasons for their appearance and how to remove them

Have you ever encountered a situation where an advertisement or warning suddenly appears on your smartphone screen? about viruses or an offer to win an iPhone? This is pop-up windows one of the most common sources of user irritation Android. They not only interfere with work, but can also be dangerous: from theft of personal data to the hidden installation of malware.

In this article we will understand why pop-up windows on Android appear even on new devices with official firmwarewhat types of pop-ups there are and how to distinguish them from system notifications. You will learn which applications most often become a source of annoying advertising, how to check your smartphone for viruses and, most importantly, how to permanently get rid of unwanted windows without losing the functionality of the gadget.

Spoiler: in 90% of cases the problem is solved in 5 minutes if you know where search. And the remaining 10% will require a deeper cleaning of the system - and we will show you how to do it safely.

What are pop-up windows on Android and why they appear

Pop-up windows (or pop-up) are graphic elements that are displayed on top of the current interface without the user asking. They may contain:

• 📢 Advertising (banners, videos, offers to install applications)
• ⚠️ Warnings about “viruses” or “problems with the device”
• 🎁 False notifications about winnings or gifts
• 🔓 Requests for access to confidential data

The main reasons for their appearance:

1. Installed applications - even legitimate apps (especially free ones) can show ads through pop-ups if their privacy policy states the right to “targeted advertising.”
2. Malware —Trojans, adware and spyware are often disguised as useful utilities (optimizers, antiviruses, launchers).
3. Infected sites —some web pages automatically open pop-ups in the browser, even if you did not click on the advertisement.
4. System notifications are mistaken for pop-ups — sometimes standard notifications from Android or Google Play Services.

Interesting fact: according to Kaspersky, in 2023 every fifth The mobile virus was associated specifically with ad impressions through pop-up windows. At the same time, 60% of users do not even suspect that their device is infected, attributing pop-ups to “Android features.”

How to distinguish dangerous pop-ups from harmless notifications

Not all pop-ups are harmful. For example, system notifications about low battery or app updates are a normal part of the experience. Android. How to recognize dangerous pop-ups?

Sign	Safe notification	Dangerous pop-up
Source	Displayed in the notification panel, with the logo of a well-known application (Google Play, Chrome, Settings)	Appears on top of all windows, without being tied to a specific application. Often imitates system messages
Content	Neutral information: “Update available”, “Message received”	Aggressive text: "YOUR PHONE IS INFECTED!", "YOU WON A PRIZE!", "INSTALL ANTI-VIRUS NOW!"
Behavior	Can be closed with a swipe or the "×" button, does not interfere with work	Locks the screen, closes with difficulty, redirects to suspicious sites
Frequency	Appears based on an event (for example, when receiving an SMS)	Constantly pops up, even when the phone is idle

It is especially dangerous if the pop-up:

• 🔴 Asks you to enter a login/password for Google, bank or social networks
• 🔴 Offers you to download an APK file "to fix errors"
• 🔴 Informs about "blocking the device" with a request for payment

Top 5 applications that most often show pop-ups

According to research Malwarebytes, these categories of applications most often become sources of annoying pop-ups:

1. Optimizers and "cleaners" (Clean Master, DU Speed Booster, 360 Security)

   Paradox: apps that promise to "speed up" the phone often slow it down with advertising. Many of them have the right to display notifications on top of other applications (android.permission.SYSTEM_ALERT_WINDOW).

2. Launchers and themes (GO Launcher, APUS Launcher, ZUI Launcher)

   Interface customization often comes complete with aggressive advertising. Some launchers even sell space for them. pop-ups to third parties.

3. Games with a coin system (especially from little-known developers)

   Free games often show ads between levels, but some abuse pop-ups that appear even when the game is minimized.

4. File-based managers and downloaders (ES File Explorer, UC Browser)

   These applications often bundling install additional modules for displaying advertising. For example, ES File Explorer in 2022, I was caught secretly installing adware libraries.

5. Applications for saving battery (Battery Doctor, Avast Battery Saver)

   It’s ironic, but apps promising to extend battery life often drain it faster due to background activity and pop-ups.

How to check which application is showing ads?

1. Open Settings → Applications
2. Tap on the three dots in the upper right corner → Show system ones
3. Sort the list by Last run or Battery usage
4. Look for applications with rights SYSTEM_ALERT_WINDOW or DRAW_OVER_OTHER_APPS

What does the section with application rights look like in new versions of Android?

The Android 12+ path has changed: Settings → Applications → Permissions → Advanced → Show on top of other applicationsThere you will see a complete list of apps that can create. pop-ups.

Step-by-step guide: how to remove pop-ups on Android

If you have determined that pop-ups come from a specific application, follow this instructions:

Method 1: Disable rights to display on top of other windows

This is the fastest method if you do not want to delete the application completely:

1. Go to Settings → Applications
2. Select a suspicious application → Permissions
3. Find item Display on top of other applications (or SYSTEM_ALERT_WINDOW) and disable it
4. Restart the device

Method 2: Delete the application that is the source of pop-ups

If the app is non-system:

1. Long-press its icon on the main screen → Delete (or Uninstall)
2. Or through Settings → Applications → [name] → Delete

For system applications (that cannot be deleted):

1. Go in Settings → Applications
2. Select the application → Disable (this hides it and stops the activity)

Method 3: Clear cache and data browser

If pop-ups appear in Chrome or another browser:

1. Open your browser → ⋮ → History → Clear data
2. Select Cached images and files + Cookies
3. Set period All time and click Delete data

Method 4: Checking for viruses

Use proven antiviruses:

• 🛡️ Malwarebytes (free version scans pop-ups and adware)
• 🛡️ Bitdefender Mobile Security (detects Trojans masquerading as system notifications)
• 🛡️ Kaspersky Internet Security (blocks phishing pop-ups)

Important: do not install antiviruses from third-party sources - only from Google Play!

How to protect yourself from pop-ups in the future

Prevention is always better than cure. Follow these rules to minimize the risk of pop-ups:

1. Install applications only from Google Play

   The APK files are the main source of adware and Trojans. Even if the site looks reliable, the risk of infection is too high.

2. Read reviews before installing

   If in the last 10-20 reviews users complain about advertising, it is better to look for an alternative.

3. Disable auto-updates for dubious applications

   Some apps start showing ads after updating. To avoid this:

   Google Play → ⋮ → Settings → Auto-update applications → Only via Wi-Fi (or Off)

4. Use ad blockers

   Applications like Blokada or AdGuard can block pop-ups at the DNS level. Please note that this will require setting up a VPN.

5. Check application rights regularly

   Once a month, go to Settings → Applications → Permissions and revoke unnecessary rights (especially SYSTEM_ALERT_WINDOW and ACCESSIBILITY_SERVICE).

💡

In Android 13+ the "Anti-Phishing" function has appeared in Google Play Protect. Turn it on in the security settings - it blocks suspicious pop-ups that redirect to fraudulent sites.

If you often install applications from unverified sources, consider using sandboxes (for example, Shelter or Island). These apps create an isolated environment for testing questionable software without risking the main system.

What to do if pop-ups appear in safe mode

If pop-ups continue to appear even after rebooting in safe mode (where all third-party applications are disabled), this means that:

• 🔹 The system firmware is infected (often on unofficial or custom ROMs)
• 🔹 Malicious code is embedded in system applications (for example, Settings or SystemUI)
• 🔹 The device is infected with bootkita virus (loaded with the system)

In this case, only full reset or flashing it will help:

1. Save important data to an external drive or to the cloud
2. Make sure you have access to your account Google (required for recovery after a reset)
3. Download the official firmware for your model from the manufacturer's website (for example, Samsung, Xiaomi, Realme)

Instructions for resetting:

1. Go to Settings → System → Reset settings
2. Select Delete all data (factory reset)
3. Confirm the action and wait for the reboot

How to reflash the phone if the reset did not help?

To do this, you will need to unlock the bootloader (fastboot oem unlock), install custom recovery (TWRP) and flash the official one or custom firmware. This process is risky - if there is an error, the device may turn into a “brick.” If you are not confident in your abilities, contact the service center.

After the reset:

• 🔄 Do not restore data from a backup made after the appearance of pop-ups (the virus could be saved in backup)!
• 🔄 Install applications gradually, checking after each installation to see if pop-ups have appeared again.

Hidden dangers: what pop-ups can do to your phone

Pop-ups are not easy irritation. They can:

Type of threat	How it works	Consequences
Phishing	Pop-up imitates the login window Google, bank or social network, asking you to enter your login/password	Theft of accounts, access to payment data, sending spam on your behalf
Adware	Hidden installation of advertising modules that show pop-ups even when the phone is locked	Slowdown, overheating, fast low battery
Trojans	Pop-up offers to download a “security update”, which is actually a Trojan	SMS theft, access to camera/microphone, sending paid messages
Rootkits	Malicious code is introduced into system processes, masquerading as pop-ups from Android	Full control over the device, impossibility of removal without flashing
Clickjacking	Pop-up contains invisible buttons that “click” for you (for example, subscribe to paid services)	Unauthorized payments, subscriptions to unnecessary services

According to Check Point, in 2023, every third case of mobile fraud began with a pop-up. At the same time, 78% of users ignore warnings about suspicious activity, considering them a “system glitch.”

💡

If a pop-up offers to “optimize” your phone or “speed up the Internet” for a fee, this is 100% scam. Android does not block the speed on purpose, and real optimizers (for example, built into MIUI or One UI) do not require payment.

FAQ: Frequently asked questions about pop-ups on Android

❓ Why do pop-ups appear even on a new phone?

Even on new devices there may be pre-installed applications from the manufacturer or telecom operator that show ads. For example, on smartphones Samsung this can happen. be Samsung Free or Game Launcher, and on Xiaomi — Mi Browser or Cleaner.

Also, pop-ups can appear due to:

• 📱 System application updates via Google Play (sometimes they add advertising modules)
• 📡 Connections to public Wi-Fi networks (some access points redirect to advertising pages)

❓ Is it possible to block pop-ups without root access?

Yes, in most cases root is not needed. what you can do:

1. Disable rights to display on top of other windows (see Method 1 above)
2. Use ad blockers at the DNS level (for example, Blokada or AdGuard)
3. In Android 12+ there is a built-in function for limiting background activity: Settings → Accessibility → Removing unnecessary permissions

Root is only required to remove system applications that cannot be disabled using standard means.

❓ Why did pop-ups remain after deleting the application?

This means that:

• 🔹 The application left behind residual files (cache or service). Try clearing data through Settings → Storage → Other applications.
• 🔹 A virus has infiltrated other application. Check recently installed apps.
• 🔹 Pop-ups shows browser. Clear the history and cache in Chrome/Firefox.
• 🔹 The device is infected at the firmware level (reset or flashing is required).

Try using the utility Malwarebytes —it finds hidden advertising modules.

❓ How to protect a child from pop-ups on his phone?

For children's devices it is recommended:

1. Enable parental controls in Google Play:

   Play Store → ⋮ → Settings → Family → Parental controls

   Set an age limit and block installation of applications without confirmation.

2. Use special launchers for children (for example Kids Place or Family Link), which block pop-ups.
3. Disable installation of applications from unknown sources:

   Settings → Security → Unknown sources (disable)

4. Configure restricted profile (to Android 4.3+):

   Settings → Users → Add user → Restricted profile

   It allows you to deny access to the browser and app store.

It is also useful to disable personalized advertising in your account Google child.

❓ Is it legal to show pop-ups without the user’s consent?

From a legal point of view:

• 📜 In EU (including Russia until 2022) acted GDPR, which required applications to request consent to display targeted advertising. However, many apps bypass this requirement by hiding consent deep in the “User Agreement.”
• 📜 The USA rules regulate FTC, but in practice only the largest companies receive fines for spam advertising (for example, Facebook or Google).
• 📜 In Russia since 2026, amendments to the Law “On Advertising” (Federal Law No. 38) have been in force, which prohibit aggressive advertising in mobile applications. However, control mechanisms have not yet been established.

If the application shows pop-ups without the ability to disable them in the settings, this is a violation of the policy Google PlayYou can complain through the feedback form in the application store.