Users of Android smartphones often encounter the sudden appearance of unwanted content on the lock screen or in the browser. Pop-up windows, advertisements and notifications that cannot be closed usually indicate the presence of a malicious extension or intrusive application, often hiding under a name associated with the service OKO or similar aggregators.
The problem is not only aesthetic discomfort. Such apps can consume a significant amount of mobile traffic, drain the battery and, most importantly, offer paid services, money for which is debited from the mobile operator’s account without the explicit consent of the gadget owner.
In order to return the phone to its previous speed and security, it is necessary to carry out a comprehensive cleaning of the system. We'll look at several methods, from simply uninstalling apps to deep cleaning your browser settings, so you can completely get rid of the intrusive subscription.
Finding and removing a malicious application
The first and most obvious step is to find the installed software that triggers the display of ads. Often such apps are disguised as system utilities, for example, "Memory Cleaner", "Flashlight" or "System Update", or have an empty name in the list of applications.
You need to go to the main settings of your device. Find the section Applications or Managing applications. In the list that opens, carefully review all installed apps. Pay special attention to those that are missing an icon or the name looks suspiciously abstract.
If you find an application with the name OKO or any other installed around the time the problems started, uninstall it immediately. To do this, click on the name of the app, select the item Delete and confirm the action.
⚠️ Attention: If the "Delete" button is inactive (gray), then the application has been granted device administrator rights. You need to first revoke these rights in the "Security" or "Device Administrators" section, and only then will removal be possible.
In some cases, malware may hide its icon from the general menu, but remain in the list of installed apps. If the standard search does not produce results, try sorting the list by installation date. This will help identify recent downloads that you might not have noticed.
☑️ Checking applications
Clearing cache and browser data
Often the source of the problem is not the individual application, but the permission granted to the website to send notifications. Browsers Chrome, Yandex or Samsung Internet can retain these permissions even after closing the tab.
Go to the settings of your main browser. Find the section responsible for notifications or sites. In the list of allowed resources, look for domains containing the word oko or strange character sets. For each suspicious site, select the option Block or Delete.
If a manual search for sites did not help, it is recommended to completely clear your browser data. This will reset it to factory settings, clearing all cache, history, and saved permissions. Go to Settings phone, select Applications, find your browser and click Storage.
In the menu that opens, click button Clear cache, and then Erase data or Clear all data. Don't be afraid, your bookmarks and passwords (if they are synchronized with your account) will be saved, but the browser interface settings will be reset.
Before completely clearing your browser data, make sure you remember the password for your Google account or browser account to restore synchronization of bookmarks and history.
Prohibition of installation from unknown sources
The main attack vector for such subscriptions is the installation of APK files downloaded from third-party resources. To prevent re-infection, you need to strictly limit the ability to install applications not from the official store Google Play.
In the security settings of your smartphone, find the item Installing unknown applications or Unknown sources. Here you will see a list of apps that have the right to install other applications (for example, browsers, file managers, instant messengers).
Go through this list and make sure that the switches opposite all applications are in position Off. Permission should be given only temporarily if you are 100% sure of the security of the file being installed, and immediately disable it after completing the procedure.
| Source type | Risk level | Recommendation |
|---|---|---|
| Google Play Market | Low | Main source, keep on |
| Browsers (Chrome, Yandex) | High | Strictly prohibit installation |
| File managers | High | Strictly prohibit installation |
| Messengers (Telegram, WhatsApp) | Medium | Prohibit if not used for working with files |
Compliance with this rule is the foundation of the security of the Androidsmartphone. Most viruses and intrusive subscriptions penetrate the system precisely through a vulnerability associated with permission to install from external sources.
Checking subscriptions on Google Play
Sometimes the problem lies not in malware, but in a paid subscription that the user might have forgotten about or that was issued accidentally when clicking on an advertising banner. The service Google Play provides a convenient tool for managing such services.
Open the application Play Market on your phone. Click on the profile icon in the upper right corner of the screen. In the drop-down menu, select the item Payments and subscriptions, and then go to the section Subscriptions.
A list of all active paid services linked to to your account. Study the list carefully. If you see a service with the name OKO or any other unfamiliar name, click on it.
On the subscription management page, find the button Cancel subscription. The system may try to deter you by offering a break or discounts, but you need to strictly follow the instructions to cancel completely. Once confirmed, the subscription will no longer be renewed in the next billing cycle.
⚠️ Attention: Canceling a subscription on Google Play does not always automatically refund money for the current period. If the charge has already occurred, you may need to request a refund through the Google support form within 48 hours.
Using anti-virus scanners
If manual methods do not help identify the source of the problem, specialized utilities will come to the rescue. The modern market offers many effective solutions for searching for hidden threats that are not visible to the user in the standard interface.
It is recommended to use proven solutions such as Kaspersky, Dr.Web or Malwarebytes. Download one of these apps exclusively from the official store Google Playto avoid running into a fake.
Run a full system scan. The antivirus will check not only installed applications, but also system files, as well as browser history for the presence of malicious scripts. Follow the app's recommendations for removing or neutralizing detected threats.
Why may an antivirus not find a virus?
Some modern threats use code obfuscation methods or disguise themselves as system processes. In such cases, only resetting the settings to factory settings or manual removal through safe mode helps.
It is important to understand that an antivirus is a treatment tool, not a panacea. After cleaning, be sure to change passwords for important accounts if you suspect that malware could intercept data input.
Reset settings to factory settings
In the most difficult cases, when the virus has deeply penetrated the system or constantly returns after removal, the only effective solution is a complete reset of the device. This procedure will delete absolutely all data, returning the phone to the “as from the store” state.
Before starting the procedure, it is critical to create a backup copy of all important data: photos, contacts, documents. Use cloud services Google Drive or copy files to your computer.
Go to Settings phone, find the section System or General settings. Select item Reset or Recovery and reset. Click on the option Reset settings or Delete all data.
Settings → System → Reset → Delete all data (reset to factory settings)The phone will reboot and begin the long cleaning process. After turning it on, you will need to set up your device again and sign in to your Google account. This is guaranteed to remove any subscription OKO and accompanying malware.
A complete reset is a radical, but the most reliable measure. It removes 100% of malicious code, but requires first saving the user’s personal data.
Prevention of re-infection
After successful removal of the problem, it is important to consolidate the result so that the situation does not repeat in the future. The main principle of security in the mobile environment is to be critical of everything that appears on the screen.
Never click on pop-up windows with messages like “Your phone is infected” or “You have won a prize,” especially if they appear in your browser while browsing websites. These are classic tricks for installing viruses.
Regularly update your operating system Android and all installed applications. Developers are constantly closing security vulnerabilities through which attackers can gain access to your device.
⚠️ Attention: Menu interfaces and item names may vary slightly depending on your smartphone model (Samsung, Xiaomi, Honor) and Android version. If you cannot find the item you need, use the search inside your phone settings.
Be careful when installing new games and apps. Read reviews from other users before downloading. If the application requires strange permissions (for example, access to SMS for a calculator game), it is better to refrain from installing.
Frequently asked questions (FAQ)
Is it possible to get a refund if the OKO subscription has already debited the funds?
Yes, this is possible. You need to contact the support service of your mobile operator or Google Play support (if payment was made via card). The sooner you apply for a refund, the higher the chances of success.
Why is the application delete button inactive?
This means that the application has received device administrator rights. Go to Settings → Security → Device Administrators, uncheck the suspicious application, and only then try to remove it again.
Will resetting the settings delete my photos and contacts?
Yes, a Hard Reset deletes ALL data from the internal memory of the phone. Be sure to make a backup copy to your computer or to the cloud before starting the procedure.
How to understand that the subscription is definitely disabled?
Check the "Subscriptions" section in Google Play - there should be no active services there. You will also stop receiving SMS from your operator with information about charges for third-party services.