Android itself downloads applications: 7 reasons and step-by-step solution

Have you noticed that unknown applications appear on your Android smartphone that you did not install? Or do Google Play Market apps appear in the "Installed" section, although you have not downloaded them? This is a common problem faced by users of devices based on Android 10–14. In most cases, it is associated with system settings, malware, or the activity of third-party services.

Automatic installation of applications is not only annoying, but can also pose a security risk: some “spontaneously” downloaded apps contain adware, spyware, or even Trojans. In this article we will analyze such behavior of a smartphone - from harmless functions to hidden viruses, and also provide advice on diagnosing and fixing the problem. We will pay special attention to models all possible reasons such smartphone behavior is due to harmless functions Google Play to hidden viruses, and we will also give step-by-step guide to diagnose and fix the problem. We will pay special attention to models Samsung, Xiaomi, Realme and other brands with proprietary shells, where automatic installation is often disguised as “useful services”.

1. Checking automatic updates in Google Play

The first thing to exclude is legitimate auto-update function in Google Play Store. By default, the system can update applications in the background, and some users confuse this with a “spontaneous” installation. To check the settings:

1. Open Google Play Store.
2. Tap on your profile avatar in the upper right corner.
3. Select Settings → Network settings → Auto-update applications.
4. Set value Do not update automatically or Only after Wi-Fi.

If it is set here Always or At any time, the system can download updates for already installed apps, which creates the illusion of “independent” downloads. However, this does not explain the appearance of completely new applications —in this case, the reason needs to be sought deeper.

2. Malware and ad viruses

One ​​of the most dangerous reasons is infection by adware or trojanthat downloads applications to display advertising, collect data or distribute other viruses. Such software often penetrates through: Infection with adware or Trojan prize.apk").

• 📱 Pirated APK files (downloaded from third party sites instead Google Play).
• 🔗 Phishing links in SMS or instant messengers (for example, “You won prize.apk”).
• 📦 Malicious "optimizers" or "cache cleaners" that actually install advertising modules.

To check the system for viruses:

1. Install an antivirus with a good reputation (for example, Malwarebytes, Bitdefender or Kaspersky).
2. Run Deep scan (not fast!).
3. Pay attention to applications with suspicious permissions, for example:
   • 🚨 Access to SMS or Calls (for sending spam).
   • 🚨 Permission ADMIN_DEVICE (may block deletion).
   • 🚨 Unknown services in the section Settings → Applications → Special access.

Critical sign of a virus: if after removing a suspicious application it appears again after a few hours - this is definitely malware with a self-healing function. In this case, you will need to reset to factory settings (more on that below).

3. Branded services of manufacturers (Bloatware)

Many brands (Samsung, Xiaomi, Huawei, Realme) pre-install their application stores, which can automatically install "recommended" software. For example:

• 📱 Samsung — Galaxy Store with auto-updating of branded applications.
• 📱 Xiaomi/Redmi/POCO — GetApps or Mi Videothat download games and utilities.
• 📱 Huawei — AppGallery with the function "Recommendations".

How to disable auto-installation:

If there is no explicit item in the settings about auto-installation, try disable notifications from the company store or remove its updates via Settings → Applications → [Store name] → Three dots → Uninstall updates.

adb shell pm uninstall --user 0 com.xiaomi.mipicks

4. Third-party accounts with installation rights

Android allows other accounts (such as Google Workspace, corporate profiles, or family groups) to install applications on your device remotely. This can happen if:

• 🔑 You are logged into corporate account (for example, through work or study).
• 👨‍👩‍👧‍👦 You are a member in Google Play Family Library, where other family members can share applications.
• 📱 You used services like AirDroid or TeamViewerthat provide remote access.

To check and disable this function:

1. Go to Settings → Accounts (or Users and accounts).
2. Select a suspicious account (for example, Work or an unfamiliar email).
3. Click Delete account or Synchronization → Disable installation of applications.

For Google Play Family Library:

1. Open Google Play Market → Menu → Family library.
2. Click Manage family group.
3. Disable the option Automatic installation of recommended applications.

5. Reset to factory settings (last resort)

If none of the previous methods helped, and the smartphone continues to download unknown applications, you will have to do hard reset. This will remove all data, including viruses and settings, but will return the device to a “clean” state.

Before resetting:

Back up photos and videos (via Google Photos or PC)|Export contacts to a VCF file|Write down passwords from Wi-Fi (in Settings → Wi-Fi → Saved networks|Make sure you know the login/password for your Google account (will be required after resetting)-->

Reset instructions:

1. Go to Settings → System → Reset (on some models: Advanced → Reset settings).
2. Select Delete all data (reset to factory settings).
3. Confirm the action (you may need to enter a PIN code or pattern).
4. After reboot, set up the device as new without restoring data from backup (it may contain a virus!).

Important: on devices with MIUI (Xiaomi) or ColorOS (Oppo/Realme) after the reset, you may need to link to your previous account Mi/Xiaomi or Oppo. If you don’t remember the data, unlink the device in advance in the brand’s personal account.

6. Additional protection measures

To prevent the problem from recurring, follow these recommendations:

• 🔒 Disable installation from unknown sources:
  1. Settings → Applications → Accessibility → Installation of unknown applications.
  2. Disable permission for all browsers and file managers.

For advanced users:

• 🔧 Block advertising domains via hostsfile (requires root or ADB).
• 📊 Monitor the traffic using NetGuard or PCAPdroidto identify suspicious connections.

If the problem occurs after updating the firmware, check the forums (for example, 4PDA or XDA Developers) Sometimes auto-installation is associated with a bug in a specific OS version.

💡

Even after fixing the problem, regularly check the list of installed applications (Settings → Applications → All applications) and remove suspicious ones.

7. Frequently asked questions (FAQ)

Can a virus download applications if I have an antivirus installed?

Yes. Many malicious apps are disguised as system processes (for example, com.android.system) and remain undetected by antivirus apps. In addition, some viruses block the operation of security software. If the antivirus does not find threats, but applications continue to appear, try scanning the device using Malwarebytes in safe mode (press the power button and select "Safe Mode").

After resetting the settings, the problem returned a week later. What to do?

This means that:

1. You have restored data from infected backup copy (don't do this!).
2. The virus is saved on memory card (format it on a PC).
3. Device hacked (for example, through a vulnerability in the firmware). In this case, only flashing via Odin (for Samsung) or Fastboot (for other brands) will help.

Also check if you have connected to public Wi-Fi (for example, in cafes or hotels) - some networks automatically redirect to phishing pages.

How to distinguish a system application from a virus?

Compare a suspicious application using these criteria:

Sign	System application	Malware
Package name	Contains the brand name (for example, com.samsung.android.app.camera)	Random character set (for example, com.data.save.12345)
Permissions	Corresponds to the functionality (for example, a camera for the "Camera" application)	Requests access to SMS, calls, device administrator
Installation date	Coincides with the date the phone was first turned on	Appeared recently, although you did not install anything

Check the name of the package c Google — system applications are usually documented on the official websites of manufacturers.

Is it possible to get a refund if the virus has paid for subscriptions?

Yes, but you need to act quickly:

1. Go to Google Play Market → Menu → Subscriptions and cancel everything unknown.
2. Write to support Google Play via the form refund, indicating that the subscription was issued without your consent.
3. If the payment was made through a bank card, block it and dispute the transaction with the bank (you have 30-60 days from the date of debiting).

Save screenshots of unknown applications and transactions - they will be needed for proof.

Does turning off mobile data or Wi-Fi help?

Partially. If applications are downloaded via mobile network, their installation will stop when data transfer is turned off. However:

• Viruses can wait for a Wi-Fi connection to download new components.
• Some malware uses background processes to download even without an active Internet (via cache or Push notifications).

Disconnecting the network is a temporary measure. To completely solve the problem, follow the instructions from the section about malware.

If after all the manipulations the smartphone continues to behave suspiciously, this may indicate hardware problem (for example, a reflashed motherboard with pre-installed spyware) or vulnerability in the firmware. In this case, contact the service center or consider switching to custom firmware (for example, LineageOS).

⚠️ Attention: Menu settings and paths to sections may differ depending on the version Android and the manufacturer's shell. Current For instructions for your model, see the official documentation of the brand.