The situation when advertising windows suddenly pop up on the smartphone screen on top of running applications or even on the desktop is familiar to many users Android. This is not just an annoying nuisance that distracts from work, but also a serious risk to the security of personal data. Most often, the cause of this behavior is malware disguised as harmless utilities, flashlights or system optimizers.
Aggressive advar (adware) can turn using a gadget into a nightmare: notifications appear with alarming frequency, blocking the interface and interfering with normal navigation. In some cases, such apps can redirect traffic to phishing sites or silently download other dangerous modules. However, there is no need to panic: in most cases, the problem is solved without resetting to factory settings, if you act consistently and competently.
In this article we will look at the basic methods of identifying hidden viruses, setting up system filters and cleaning the device. You will learn how to find the culprit of chaos in the application list, even if it does not have an icon, and how to block ads at the network level. The most common reason is applications with rights to display on top of other windows, received during the first installation. Follow the instructions to regain control of your smartphone.
Searching for and removing hidden ones malicious application
First of all, you need to find the application that generates advertising. The tricky thing about modern viruses is that they often hide their icon in the menu or disguise themselves as system services with names like “Update Service” or “System Helper”. Go to Settings → Applications and carefully scroll through the entire list.
Pay special attention to apps that do not have a name or the icon looks like a white square. Utilities that you don't remember installing are also suspicious. If you notice an app installed around the same time the ad problems started, this is your prime suspect. Click on it and select the button Delete.
- 🔍 Look for applications without icons or with transparent names in the general list.
- 📅 Sort the list by installation date to find recent downloads.
- 🛡️ Check access rights: if a simple flashlight requires access to contacts and SMS, this is a virus.
Sometimes malicious code is embedded in the cache of legitimate applications, such as browsers or launchers. In this case, simple uninstallation may not help. Try clearing the data of the problematic application through the menu Storage → Clear data. This will return the app to the “as after installation” state, deleting all temporary files and settings where the script may be hiding.
☑️ Diagnosis of hidden viruses
Disable the right to display on top of other windows
The mechanism that allows advertising banners to overlap other apps is called “Overlay on top of other applications” or “Display over other apps”. Without this permission, the virus will not be able to show you pop-ups when you use the messenger or read the news. Limiting this right is an effective way to combat annoying advertising.
Go to section Settings → Applications → Accessibility → Overlay on top of other applications. The path may differ slightly depending on your Smartphonemodel, but the essence remains the same. You will see a list of apps that are allowed to display content on top of the system interface. Study it carefully.
⚠️ Attention: Do not disable this right for system applications such as Phone, Messages or your main launcher. This may interfere with incoming calls or pop-up notifications from legitimate services.
Disable the switch for any suspicious apps that you detected in the previous step. If you do not use the floating windows function for instant messengers or video players, feel free to disable this permission for them too. Security in this case, cosmetic amenities are more important. After this, restart the device and check if the advertising has disappeared.
If advertising appeared immediately after installing a specific application (game, QR scanner), remove it immediately, without trying to find the settings inside the app itself.
Setting up a private DNS to block ads
One of the most effective and modern methods of combating advertising at the system-wide level is the use of private DNS with blocking function. This method does not require the installation of third-party applications and works at the network request level. When your device tries to load an advertising banner, the DNS server simply blocks this request.
You do not need root accessto implement this method. Starting from version Android 9, this function is built into the system. Go to Settings → Connections → Other connection settings → Private DNS (path may vary). Select the "ISP Host Name" mode and enter the address of a trusted blocker.
dns.adguard.comSave the setting. Now all traffic passing through your phone will be filtered. Ads in browsers and many free applications will stop loading, which will also save Internet traffic and battery power. If, after enabling this option, some sites no longer open, try temporarily disabling DNS or adding an exception, although for the address dns.adguard.com such cases are rare.
Setting up a private DNS blocks advertising before it is downloaded to the device, saving traffic and increasing speed on the Internet.
Analysis of notifications from browsers
Users often confuse viral activity with legal but intrusive push notifications from websites. While visiting a resource, you may have accidentally clicked “Allow” when asked to show notifications. After this, the site gets the right to send you messages that visually look like pop-up advertisements.
To fix this, open your browser settings (Chrome, Yandex, Samsung Internet). Find the section Site settings → Notifications. You will see a list of all resources that you have consented to display messages to. Ruthlessly delete or block all unfamiliar domains.
| Threat type | Symptoms | Elimination method |
|---|---|---|
| Viral application | Advertising on the desktop, in any applications | Deleting an application, resetting rights |
| Push notifications | Advertising only in the notification curtain | Banning notifications in browser |
| Malicious site | Pop-up windows only inside the browser | Clearing the browser history and cache |
It is also recommended to clear the browsing history and browser cache. The accumulated data may contain scripts that cause redirects to advertising pages. In the browser menu, select History → Clear history and make sure that the checkbox is opposite "Cookies and site data".
What should I do if advertising returns after being deleted?
If the virus returns after a reboot, it may have acquired administrator rights devices. Go to Settings → Security → Device Administrators and uncheck the suspicious app before deleting it.
Checking for device administrator rights
Advanced malware samples protect themselves from removal by gaining rights device administrator. In this state, the "Delete" button in the application menu will be grayed out or grayed out. The virus blocks the ability to uninstall itself in order to continue making money by displaying advertising.
To bypass this protection, you need to go to a special settings section. The path usually looks like this: Settings → Biometrics and security → Other security settings → Device administrator applications. Here you will see a list of apps with elevated privileges.
Find an unknown application or a app with a suspicious name in the list. Uncheck it or click "Deactivate". As soon as the rights are revoked, the app will become a regular application, and you can delete it in the standard way through the settings menu or by dragging it to the trash on the desktop.
⚠️ Attention: The interfaces of different shells (MIUI, OneUI, ColorOS) may differ. If you do not find the "Device Administrators" section, use the search in the settings by entering the word "administrator".
Radical measures: reset to factory settings
If none of the above methods helped, and pop-ups continue to terrorize your Gadget, the last but most reliable option remains - a complete system reset. This procedure will remove absolutely all data, including hidden viruses that could have penetrated deep into the system.
Before starting the procedure, be sure to create a backup copy of important contacts, photos and documents. Remember that after the reset the phone will be the same as when you bought it in the store. All installed applications will be removed. Go to Settings → General settings → Reset → Data reset.
Confirm the action and wait for the process to complete. The phone will reboot and the setup will start from scratch. Recovery operation in this case is 100% guaranteed. After setting up, reinstall applications only from the official store Google Play, avoiding dubious sources.
When restoring data from a backup, do not restore all applications in a batch at once. Install them one at a time, checking the stability of the system after each installation.
Frequently asked questions (FAQ)
Can advertisements appear due to system application updates?
Yes, sometimes after updating standard applications (for example, a launcher or explorer), built-in advertising from the manufacturer can be added to them. In this case, disabling personalized advertising in the manufacturer's account settings or installing a third-party launcher helps.
Is it safe to use ad blocking applications (AdBlock)?
It is safe to use proven applications such as AdGuard. However, avoid downloading unknown "Antivirus" or "Cleaner" applications from unverified sources, as they themselves are often a source of viruses and advertising.
Why do advertisements pop up even in airplane mode?
If advertisements appear without the Internet, it means that a malicious application has already loaded the content into the memory cache or is generating it locally. This is a clear sign of the presence of an installed virus, which must be searched for and removed manually.
How to distinguish a virus from regular advertising in free games?
Advertising in games is shown only within the application, usually between levels. Viral advertising pops up on top of any apps, on the desktop, when you unlock the screen and is not tied to the opening of a specific application.
Do you need to change your Google password after removing the virus?
If the virus required suspicious permissions or you entered card data on the sites to which it redirected, changing your password and checking your bank accounts is necessary. For preventive purposes, this will also not be superfluous.