The fastest way to check for viruses on Android
Open Google Play Protect, which is built into every Android phone and runs scans automatically in the background. Tap your profile icon in the top right of the Google Play Store app, then select Play Protect. If you see a green checkmark and "No issues found," your phone has been scanned recently. If you want to run a scan right now, tap the refresh icon at the top of the screen — it takes two to five minutes.
Google Play Protect checks apps you have installed against a database of known malware. It will not catch every threat, but it catches most of what actually reaches Android phones. If it finds something, it will tell you the app name and offer to remove it immediately.
If Play Protect shows a warning, tap Remove or Uninstall and follow the prompts. The app will be deleted from your phone. You do not need to do anything else — removing the app stops the threat.
Key Takeaways
- Google Play Protect is the main tool Android provides to scan for malware, and it runs automatically on every phone.
- You can force a manual scan by opening the Google Play Store, tapping your profile icon, selecting Play Protect, and hitting the refresh button.
- If Play Protect finds a threat, remove the app immediately by tapping the removal option in the warning message.
- Third-party antivirus apps add another layer of scanning but are not necessary if you only install apps from the Google Play Store.
- The most common way Android phones get infected is by installing apps from outside the Play Store, so avoiding that prevents most problems.
What to do if Play Protect finds a threat
When Play Protect detects malware, it shows the app name and a description of what it does. Read the description to understand what the threat is — some malware steals passwords, some displays ads, some sends text messages to premium numbers without your knowledge.
Tap Remove and confirm. Google Play Protect will uninstall the app from your phone. Once it is gone, the threat stops. You do not need to restart your phone or take any other action.
After removal, think about where you got the app. If you installed it from the Google Play Store, report it to Google by tapping the three-dot menu in the Play Protect warning and selecting Report. If you sideloaded it (installed it from a website or file, not the Play Store), do not install apps that way again — that is how most Android malware spreads.
Running a manual scan with third-party antivirus apps
If you want a second opinion beyond Play Protect, you can install a third-party antivirus app. Reputable options include Bitdefender, Norton, and Kaspersky — all are free and available in the Google Play Store. Download one, open it, and tap the button to start a full scan. The scan takes five to fifteen minutes depending on how many apps you have.
These apps use different malware databases than Google Play Protect, so they sometimes catch threats that Play Protect misses. However, they are not necessary for most people. If you only install apps from the Google Play Store and do not click suspicious links in emails or texts, Play Protect alone is usually enough.
Be cautious with antivirus apps that promise to speed up your phone or clean junk files — those claims are usually exaggerated. Stick to apps that focus only on malware scanning.
Why sideloading apps is the biggest risk
The most common way Android phones get infected is by installing apps from outside the Google Play Store. This is called sideloading. When you download an APK file from a website and install it directly, you bypass Google Play Protect's checks entirely.
Malware creators often disguise their code as popular apps — a fake version of WhatsApp, Instagram, or a game. They host these files on third-party app stores or file-sharing websites. When you install them, the malware runs immediately.
The safest rule is simple: only install apps from the Google Play Store. If an app is not available there, it is probably not safe. If you absolutely must sideload an app, scan the APK file with a tool like VirusTotal (virustotal.com) before installing it — upload the file and wait for the scan results.
Signs your Android phone might be infected
Even if Play Protect shows no issues, watch for these warning signs that something might be wrong. Your phone is slower than usual, apps crash frequently, your battery drains much faster than it used to, or you see ads popping up on your home screen or in apps that never showed ads before.
You might also notice unfamiliar apps you do not remember installing, or your data usage spikes without explanation. Some malware runs in the background and uses your internet connection to send stolen data or mine cryptocurrency.
If you notice any of these signs, run a manual Play Protect scan first. If that finds nothing, restart your phone — sometimes this stops malware temporarily. If the problem continues, uninstall recently installed apps one at a time and see if the issue stops. Start with apps you do not recognize or do not use often.
Keeping your phone safe going forward
The best protection is prevention. Keep your Android operating system updated by going to Settings > About phone > System update and checking for updates. Google releases security patches regularly, and installing them closes holes that malware could use.
Update your apps regularly too. Open the Google Play Store, tap your profile icon, and select Manage apps and device. Tap the Updates available tab to see which apps have updates waiting. Tap Update all to install them all at once.
Be skeptical of links in text messages and emails, especially from numbers or addresses you do not recognize. Do not click links that ask you to confirm your password or update payment information. Do not download files from emails unless you were expecting them and you recognize the sender.
What to do if your phone is seriously infected
If your phone is running very slowly, you cannot remove an app, or malware keeps coming back after you delete it, a factory reset may be necessary. This erases everything on your phone and reinstalls Android from scratch, removing any malware that is hiding deep in the system.
Before you reset, back up your important data. Open Settings > Google > Manage your Google Account > Data & privacy and make sure your photos, contacts, and messages are synced to your Google account. Then go to Settings > System > Reset options > Erase all data (factory reset). Your phone will restart and return to its original state.
After the reset, sign back into your Google account and reinstall only the apps you actually use, downloading them from the Google Play Store. Do not restore apps from a backup if you are not sure which one was infected — start fresh instead.
Frequently Asked Questions
Can I get a virus just by visiting a website on Android?
It is unlikely if you use the Chrome browser, which has built-in protections against malicious websites. However, if you click a link in a text message or email that takes you to a fake login page, you could enter your password into a scammer's site. The safer approach is to never click links in unsolicited messages — instead, open the app directly and log in there.
Does Android get viruses the same way Windows does?
No. Android is built differently and does not get infected the same way Windows computers do. Most Android malware comes through apps, not through files or email attachments. This is why sideloading is so risky — you are installing code directly instead of letting Google check it first.
Is it safe to use free antivirus apps from the Play Store?
Yes, if you choose a well-known brand like Bitdefender, Norton, or Kaspersky. These companies have reputations to protect and are regularly reviewed by security researchers. Avoid unknown antivirus apps with few reviews or suspiciously high ratings — some fake antivirus apps are malware themselves.
What should I do if I think someone hacked my phone?
Run a Play Protect scan first. If that finds nothing but you still suspect a problem, change your passwords for email, banking, and social media from a different device (like a computer). Then consider a factory reset if the suspicious behavior continues. If you think someone has access to your bank account or email, contact your bank and email provider immediately.
Will a factory reset remove all malware?
A factory reset removes malware that lives in apps and files, which is almost all Android malware. However, if someone has physical access to your phone or knows your Google account password, they could reinstall malware after the reset. Change your Google password before resetting, and do not use the same password on multiple accounts.