Phone virus vs a bad app: which signs actually confirm it
Battery drain and pop-ups usually are not malware. Learn which signs actually point to infection and the one check that confirms it on Android or iPhone.
Some links in this guide are affiliate links: if you buy, TechForLive may earn a commission at no extra cost to you. Details.
- Battery drain, heat and slowdowns are almost never proof of malware on their own
- The confirm check: open Settings and list every app and every permission you did not knowingly grant
- Notification spam in Chrome or Safari is a browser setting, not a virus
- iPhones only realistically get infected through jailbreaking or sketchy 'enterprise' app installs
- Factory reset is the reliable fix; back up photos first, restore apps selectively
How to tell if your phone has a virus: the test that actually works
The honest answer is that there is no single symptom proving a phone is infected. Websites list eight or ten 'warning signs', but nearly all of them are things a healthy phone does too. What actually separates malware from an ordinary problem is a specific test. You check whether there is an app on the phone you did not install. Or you check whether an app holds permissions making no sense for what it does.
That check takes about ten minutes. It is the only one that can confirm an infection, because malware on a phone has to be installed by something. On a current iPhone or a stock Android that only installs from official stores, malware has to arrive through an app install. It cannot materialise on its own. If your Settings app shows only apps you recognise, with permissions matching what those apps do, you almost certainly do not have malware, whatever the symptoms feel like.
Everything else in this guide helps you read the symptoms correctly first. You do not wipe a healthy phone. Then the guide walks through the check and what to do if it finds something. Start with the signs blamed wrongly, because they cause most of the panic.
| At a glance | Answer |
|---|---|
| Diagnostic sign | Unrecognised app or permission |
| Battery drain alone | Not evidence of malware |
| Pop-ups in a browser | Usually notification spam |
| iPhone infection route | Jailbreaking, mostly |
| Android infection route | Sideloaded APKs |
| Reliable fix | Factory reset |
Why battery drain, slowdowns and pop-ups usually are not malware
Battery drain has more ordinary explanations than you can count. An ageing battery loses capacity. A weak mobile signal makes the radio work harder. A single app that updated badly can chew through charge for a week before settling down. Your phone's own battery screen shows exactly which app used what. On iPhone, go to Settings > Battery. On Android, go to Settings > Battery (path varies by manufacturer). That screen is more useful than a third-party virus scanner for figuring out what is draining the battery.
Slow performance follows the same pattern. When your storage is nearly full, both Android and iOS slow down noticeably. The system has no room to work. Major OS updates also make phones feel sluggish for a few days while background tasks reindex everything. Neither of those is an infection. Neither is fixed by deleting a 'virus'.
Pop-ups deserve their own mention because they scare people most. If pop-ups appear only while you are in a web browser, that is almost always a website behaving badly or a notification permission you granted by accident. If pop-ups appear on the home screen, over other apps, that is different and worth investigating.
| Symptom | Most likely cause | Worry level |
|---|---|---|
| Battery drains fast | Ageing battery, weak signal, one misbehaving app | Low |
| Phone feels slow | Storage nearly full, recent OS update | Low |
| Pop-ups inside the browser | Website ads or notification permission | Low |
| Pop-ups on the home screen | A recently installed app | Medium |
| Apps you never installed | Possibly malware | High |
Which signs do point to infection on Android and on iPhone
A few signs carry real weight. Data usage climbing with no change in your habits can mean something is sending information in the background. Apps appearing that you never installed, especially ones you cannot uninstall normally, are the strongest signal there is. So is an app asking for permissions that do not fit it, like a simple torch app demanding access to your contacts and messages.
On Android, the realistic infection route is a sideloaded app. That means something installed from outside the Play Store as an APK file. It can also mean an app that slipped through review on a third-party store or even the Play Store itself. On iPhone, consumer malware targeting non-jailbroken iPhones is extremely rare. Apple only allows apps from its own App Store and reviews them. An infected iPhone almost always means it was jailbroken, or an unauthorised 'enterprise certificate' app was installed on it. Sophisticated targeted spyware exists for iPhones but is not seen in ordinary consumer use.
The table below separates the signs worth acting on from the ones worth ignoring. If you tick more than one row in the top group, go straight to the app-and-permissions check in the next section.
| Sign | Android | iPhone |
|---|---|---|
| App you never installed | Strong indicator | Strong indicator |
| Permission that does not fit the app | Strong indicator | Strong indicator |
| Data use spikes with no cause | Worth checking | Worth checking |
| Pop-ups outside the browser | Worth checking | Rare, worth checking |
| Battery drain or heat alone | Weak, check per-app usage | Weak, check battery health |
| Slow performance alone | Weak | Weak |
Notification spam is not a virus, and how to check apps and permissions
Before you panic, rule out the most common false alarm: browser notification spam. Sites like sketchy streaming or download pages show a fake 'Click Allow to continue' prompt. Allow it, and their messages start arriving as notifications looking like system alerts, complete with 'Your phone is infected!' text. It feels exactly like malware but lives entirely in the browser's notification settings. It takes a minute to remove.
To clear it in Chrome: open the menu (three dots) > Settings > Notifications > Sites, and remove anything you do not recognise. In Safari on iPhone: Settings > Safari > Notifications, or Settings > Notifications > Safari, depending on iOS version. Switch off the offending sites. The pop-ups stop immediately, because there was never an infection to begin with.
Now the confirming check. On Android: Settings > Apps > See all apps, and scroll the whole list looking for anything you did not install. Include apps with generic names or no name at all. Then check Settings > Privacy > Permission manager for apps holding camera, contacts, SMS or accessibility permissions they have no reason to have. Accessibility access is especially powerful and is a favourite of Android banking malware. Treat any unexplained accessibility grant as serious.
On iPhone: Settings > General > iPhone Storage lists every installed app. Settings > Privacy & Security shows permission grants. Also look under Settings > General > VPN & Device Management for any configuration profile or enterprise app you did not put there. On a normal, non-jailbroken iPhone that screen should be empty or contain only your work profile.
If data use is what triggered your check, you need to see per-app data. On iPhone, go to Settings > Mobile Data and scroll down to see which apps used cellular data. On Android, go to Settings > Network & internet > Mobile network > App data usage (exact path varies by manufacturer). Both screens show which app is sending or receiving the most.
- Open Settings > Apps (Android) or Settings > General > iPhone Storage (iPhone) and read every entry
- Open the permission manager and look for grants that do not match what the app does
- Check browser notification settings and clear any site you do not recognise
- On iPhone, check Settings > General > VPN & Device Management for unknown profiles
- Note anything suspicious, then follow the removal steps in the last section
What a phone antivirus app can and cannot detect
Here is the part the ranking pages do not tell you: a phone antivirus app cannot verify very much. On Android, Google Play Protect already scans installed apps continuously. Third-party scanners largely repeat that same signature matching. They can flag known malware already present in your app list. They cannot see into what an app does at runtime. They cannot certify a phone clean. A green 'No threats found' screen is marketing comfort, not proof.
Play Protect runs automatically on Android. To check it is on, open the Play Store app, tap your profile icon, then Play Protect. You should see 'App scanning is on.' If it is off, turn it back on. Some malware tries to disable Play Protect, so verifying it is active is a real diagnostic step.
On iPhone, antivirus apps cannot scan other apps at all. iOS sandboxing means no app is allowed to inspect another. What they actually scan is web links and phishing, which is useful but is not virus detection. Any iPhone antivirus promising to 'remove viruses' is promising something the operating system does not permit it to do.
This does not mean security apps are useless. Play Protect plus Play Store review catches most consumer malware. The practical defences are behavioural: install nothing outside official stores, refuse permissions making no sense, and keep the OS updated. Those three habits prevent more infections than any scanner will ever detect after the fact.
If the app check looks clean but symptoms persist
Sometimes you have done the app check and found nothing wrong, but the phone still acts strangely. On Android, safe mode isolates the problem. Safe mode starts the phone with only the pre-installed system apps running. If the symptoms disappear in safe mode, you know a downloaded app is the cause, even if you could not identify it in the app list.
To boot into safe mode on most Android phones: press and hold the power button until the power-off menu appears. Press and hold 'Power off' until you see 'Reboot to safe mode', then tap OK. The phone restarts with 'Safe mode' displayed in the corner. If the symptoms are gone, restart normally and uninstall apps one by one, testing after each removal, until you find the culprit.
iPhones do not have a safe mode, so the diagnostic path is different. If Settings shows nothing suspicious but problems continue, back up your data and try a factory reset. It is the only way to rule out something you missed.
If the check confirms malware: remove, back up, reset in that order
If you found an app you did not install or a permission that should not exist, act in this order. First, remove the app. On Android: Settings > Apps, select the app, tap Uninstall. If Uninstall is greyed out, first remove its device admin rights under Settings > Security > Device admin apps, then uninstall. On iPhone, delete the app normally. Under Settings > General > VPN & Device Management remove any profile you do not recognise.
Second, revoke permissions. Even if the app is gone, open the permission manager and revoke anything odd. Change your passwords for banking and email from a different, trusted device rather than the phone itself. Log out of sessions you do not recognise in those accounts' security settings.
Third, decide on a factory reset. If the app uninstalled cleanly and nothing else looks wrong, a reset may be unnecessary. If you had banking malware, an unremovable admin app, or a jailbroken iPhone, reset. On iPhone: Settings > General > Reset. On Android: Settings > System > Reset options > Erase all data. Back up photos and contacts first, but do not restore a full app backup afterwards. Restoring it can bring the malware back. Reinstall apps one by one from the official stores instead.
Afterwards, the prevention list is short. Keep the OS current. Install apps only from the Play Store or App Store. Say no to permissions a genuine app would not need. Never jailbreak a phone you rely on. Do all that and the confirming check should stay clean for the life of the phone.
- Remove admin rights, then uninstall the suspicious app (Settings > Apps)
- Revoke leftover permissions in the permission manager
- Change banking and email passwords from another trusted device
- Back up photos and contacts, then factory reset if malware was confirmed
- Reinstall apps selectively from official stores; skip full-restore of app data
Quick answers
Can iPhones get viruses at all?
Not in practice unless the phone is jailbroken or an unauthorised enterprise app was installed. Apple's app review and sandboxing keep ordinary iPhones free of the malware that circulates for Android. Strange behaviour on a stock iPhone almost always has a non-malware cause.
My phone says it has a virus, should I tap the button?
No. A genuine operating system never shows a 'your phone is infected' alert with a fix button. Those pop-ups are scams or browser notification spam, and tapping them can lead to payments or installing actual malware. Close the page and clear the site's notification permission.
Do I need to install an antivirus on my Android phone?
Google Play Protect already scans your installed apps in the background. A third-party scanner adds little on a phone that only installs from official stores. The better protection is refusing odd permissions and never sideloading APKs.
How do I remove notification spam that looks like virus warnings?
In Chrome, go to the three-dot menu > Settings > Notifications > Sites and block the offending site. In Safari, go to Settings > Safari > Notifications or Settings > Notifications > Safari depending on your iOS version. The fake warnings stop immediately.
Will a factory reset remove malware completely?
Yes, for essentially all phone malware, because it erases everything including the malicious app. Reinstall your apps fresh from the official store afterwards rather than restoring a full app backup, which could bring the malware back.