A phone that suddenly shows pop-ups, drains its battery, or opens unfamiliar websites can make you wonder how to remove a virus from your phone before it reaches your banking apps or photos. The good news is that many “virus” problems are actually aggressive browser notifications, a bad app, or a scam alert. Those problems still deserve attention, but they usually do not require panic or a factory reset as your first move.

Start by noticing what changed. Did the issue begin after installing a flashlight, wallpaper, game, cleaner, or keyboard app? Are pop-ups appearing only in Chrome or Safari? Is the phone hot while sitting unused? These clues help separate a nuisance from a more serious compromise.

How to remove a virus from your phone: the minimum-effort path

First, stop interacting with suspicious messages. Do not call a number in a pop-up, install a “security” app offered by an advertisement, or enter your Apple ID, Google Account, email, or banking password. Scammers often use a fake infection warning to persuade you to hand over the information they could not steal through malware alone.

Next, disconnect briefly from the internet. Turn on Airplane Mode, then close open browser tabs and unfamiliar apps. This does not disinfect the phone, but it can stop a suspicious app from contacting a server while you investigate. Take a screenshot of the warning if you need to remember what happened, but avoid clicking its buttons.

On an iPhone, review recently installed apps and delete anything you do not recognize or no longer need. Then open Settings and check General, VPN & Device Management. Remove an unfamiliar configuration profile only if you know it was not installed by your employer or school. Also inspect Settings, Safari, and Clear History and Website Data. On current iOS versions, the exact menu names can differ slightly.

On Android, open Settings, Apps, and sort through recently installed applications. Uninstall anything suspicious. If an app refuses to uninstall, check whether it has device administrator access under the phone’s security settings, remove that access, and try again. Google Play Protect can scan installed apps from the Play Store’s profile menu. Keep the scan result in context: no tool catches every problem, and a clean result does not excuse an app that behaves dishonestly.

Remove the source instead of chasing every pop-up

A common example is a website notification subscription. You visit a sketchy streaming or coupon page, tap “Allow” when the browser asks to send notifications, and then receive alarming messages that look like system warnings. In that case, how to remove a virus from your phone is really a matter of removing the site’s notification permission.

In Chrome for Android, open Settings, Site settings, Notifications, and remove unfamiliar sites. You can also clear browsing data, including cookies and cached files. In Safari, clearing website data and reviewing notification permissions can stop similar interruptions. Avoid clearing passwords unless you have another way to retrieve them; deleting saved credentials can create a second problem.

If the trouble began after a specific app installation, delete that app and restart the phone. Then update the operating system and remaining apps through the official App Store or Google Play. Updates fix known security weaknesses, while random “phone cleaner” downloads often add more advertising and tracking than they remove.

Battery drain alone is not proof of malware. Poor cellular reception, an aging battery, navigation, video calls, and a recent system update can all make a phone warm or short-lived. Look for a pattern: an unknown app using substantial battery or mobile data, settings changing without your action, or repeated account alerts deserves more attention than one afternoon of low battery.

Protect accounts after a suspicious app

If you entered a password into a suspicious page, treat the account as exposed even if the phone now looks normal. Change that password from a device you trust, starting with your primary email account. Email often controls password resets for banking, shopping, social media, and cloud storage. Use a unique password, and turn on multifactor authentication where available.

Review recent sign-ins and active sessions for Google, Apple, Microsoft, your email provider, and financial services. Sign out unfamiliar devices. Check recovery email addresses, phone numbers, forwarding rules, and newly added authentication methods. These changes can persist even after an app is removed.

If a banking password or card number was entered, contact the bank through its official app or the number printed on the card. Watch transactions and consider replacing a compromised card. Do not rely on a pop-up’s support number; legitimate support teams do not need remote access to “clean” your phone through an unsolicited call.

For many people, this account step is more important than proving whether the phone had a virus. A malicious app can be removed, but a reused password can continue exposing accounts for months.

When a factory reset is reasonable

A factory reset is a powerful last step, not a routine response to every advertisement. Consider it when serious symptoms continue after removing suspicious apps and profiles, when the phone has been controlled by someone else, or when a trusted repair professional finds persistent unwanted software. Before resetting, confirm that photos, contacts, messages, and authenticator backups are available. Make sure you know your Apple Account or Google Account password, because activation protection can require it afterward.

Do not restore every app automatically if you suspect one caused the issue. Reinstall only what you need from the official store, one app at a time. Avoid restoring an unknown configuration profile or downloading an old package from a website. Keep the operating system current and use a screen lock.

If the phone belongs to your employer, pause before resetting it. A work profile, mobile-device-management setting, or corporate VPN may look unfamiliar but be legitimate. Contact the organization’s IT team instead of deleting business controls.

When to ask for expert help

Search for professional help if the phone is used for work with sensitive data, if someone may have targeted you personally, or if the device remains compromised after a reset. Choose a reputable manufacturer store, carrier support channel, or established repair shop. Ask what they will inspect, whether your data will be erased, and what the service costs before handing over the phone.

Be especially cautious if someone contacts you first claiming to be Apple, Google, your carrier, or “phone security.” Caller ID can be spoofed, and a real support representative will not demand gift cards, cryptocurrency, or remote access through an unexpected warning.

The practical answer to how to remove a virus from your phone is usually simple: stop clicking, remove the suspicious source, update the device, and secure any account that may have been exposed. You do not have to do everything. Just do the next thing.