Android App Security · Spotting Bad Apps · Lesson 4 of 5

Cleaning Up a Phone

Find a bad app, remove it, and lock your accounts back down.

Finding what doesn't belong

If a phone starts acting strangely, or you've installed something you now regret, start with a calm inventory. Menu names vary between phone makers, so on Pixel and many other phones the paths below are close, and the Settings search bar can find each one by name.

• Installed apps. In Settings, Apps, open the full list. Look for names you don't recognize, apps with no icon on your home screen, and anything installed around the time trouble began. Tapping an app shows its permissions and when it was installed or last updated on many phones.
• Special app access. Usually under Apps, this lists the powerful extras that sit outside normal permissions: Display over other apps, Install unknown apps, Notification access, Usage access and more. Each one should make sense for the app that has it.
• Accessibility. Under Settings, Accessibility, check the list of installed services. Anything that isn't a tool you chose for accessibility needs is suspicious.
• Device admin apps. Usually found under Security or Security and privacy. A device admin app holds an older, powerful kind of access used by work and anti-theft tools. While it's active, Android won't let you simply uninstall it. You first deactivate it here, then uninstall it normally.

Next, run Google Play Protect. Open the Play Store, tap your profile picture, then Play Protect. You can check that scanning is on and start a scan. If it flags an app, follow its advice to uninstall it.

When you find the culprit, uninstall it from its App info page. If the Uninstall button is grayed out, look for it in the device admin list first. If the app keeps bouncing you out of Settings, safe mode, coming up next, usually stops it.

One caution: don't install a random "cleaner" or "antivirus" from an ad to fix the problem. Fake security apps are a lure of their own.

Safe mode, resets and your accounts

Some bad apps fight back. They pop up over Settings, close the app list, or relaunch as soon as you stop them. Safe mode is the answer. It restarts the phone with only the built-in software running, so apps you downloaded can't start. On Pixel and many other phones you open the power menu, then touch and hold Power off or Restart until a safe mode prompt appears. Other phones use a button combination, so check the maker's help pages. While in safe mode, uninstall the suspicious app from Settings, then restart normally to leave.

A factory reset erases everything on the phone and returns it to how it left the factory. It's the last resort, for when you can't find or remove the problem, or you simply can't trust the phone anymore. Back up photos and files you need first, but be careful about restoring app backups. The UK's National Cyber Security Centre advised FluBot victims not to restore from backups made after the infection, since that could bring the problem back. Reinstall apps fresh from the Play Store instead.

Removing the app doesn't undo what it already took. If it might have seen your logins or codes, change your passwords, starting with your email, because email resets everything else, then your bank. Do this from a clean device, one you trust, not the phone you just cleaned. Turn on two-step verification, and use your Google account's Security Checkup to sign out devices you don't recognize.

Know when to get help:

• Money left your account, or you see payments you didn't make: call your bank on the number on your card
• It's a work phone: tell your IT team before touching it
• You think someone close to you installed it: see the stalkerware module and plan safely first