How to Check Android for Preinstalled Malware

This guide shows you how to inspect a new or used Android phone for malware that came preinstalled—either from the factory or added by a previous owner. You’ll learn what to look for, which built-in tools to use, and how to remove suspicious apps safely. First, make sure your phone is charged above 50% and you have a Wi-Fi connection for any downloads.

What You’ll Need

Your Android phone (any version from Android 8 or newer)
A computer or another device to cross-reference app names (optional but helpful)
Patience—the process takes about 15–20 minutes

Step-by-Step

Open Settings and go to Apps. On most phones, this is Settings > Apps or Settings > Applications. You’ll see a list of all installed apps.
Tap the three-dot menu (top right) and select “Show system apps.” This reveals apps that came with the phone, not just the ones you installed. The list will grow significantly.
Scroll through the entire list slowly. Look for anything you don’t recognize: odd names, random letters, or apps you never installed. Pay special attention to apps with generic names like “System Update,” “Settings,” or “Bluetooth” that might be impersonating real system components.
Tap on each suspicious app to see its details. Check the “App info” page for the following red flags:
- Storage usage: A malware app often uses more storage than a legitimate system app of similar size.
- Permissions: If an app asks for SMS, call logs, location, or camera access but has no reason to, that’s a warning sign.
- Battery usage: Malware that runs in the background will show high battery consumption.
- Data usage: Check “Mobile data & Wi-Fi” to see if it’s sending or receiving data in the background.
- Version and update date: Legitimate system apps are updated by the manufacturer; a recently updated app with a strange version might be suspicious.
Look up the app name online. If you’re unsure about an app, search for its exact name plus “Android malware” on your computer or another device. If it’s known malware, you’ll see warnings. If it’s a legitimate system app, you’ll find official documentation.
Check the default app list. Go to Settings > Apps > Default apps (or “Advanced” > “Default apps”). See if any unfamiliar app is set as the default for web browsing, SMS, or phone calls. Malware often hijacks these roles.
Use Google Play Protect. Open the Play Store app, tap your profile picture, and select “Play Protect.” Tap “Scan” to run a security check. It will flag known malicious apps, but note that it may not catch all preinstalled malware.
Check for device admin apps. Go to Settings > Security > Device admin apps (or “Additional settings” > “Device admin apps”). If you see an app you didn’t set up as an admin, that’s a serious red flag—malware often requests admin privileges to prevent removal.
Review accessibility services. Go to Settings > Accessibility (or “Additional settings” > “Accessibility”). Any app with accessibility turned on can read your screen and control your phone. Only trusted apps like screen readers should have this.
Check the app list for duplicates. Some malware hides by using the same icon and name as a legitimate app. If you see two “Settings” or two “Chrome” apps, one is likely fake.
If you find a suspicious app, try to uninstall it. Tap the app in the list and select “Uninstall.” If the button is grayed out, it’s a system app. You can try disabling it: tap “Disable” instead. This stops it from running.
If you cannot disable it, note the package name. On the app info page, tap the three-dot menu and select “Uninstall updates” (if available). Then look for the “Package name” (often shown as something like com.example.malware). Write it down for further research.
Factory reset (last resort). If you find malware that you cannot remove, back up your important data (photos, contacts) to a cloud service or computer, then go to Settings > System > Reset options > Erase all data (factory reset). This will remove most malware, but note that some deeply embedded malware can survive a reset—especially if it’s in the firmware.

Common Mistakes

Ignoring system apps: Many people only check apps they’ve installed, missing preinstalled malware that hides among system apps.
Assuming all system apps are safe: Malware can be preinstalled by a manufacturer or added by a reseller. Just because an app is in the system list doesn’t mean it’s trustworthy.
Not checking permissions: An app that asks for SMS and location access but has no obvious use for them is a red flag you should investigate.
Relying solely on antivirus apps: Antivirus apps can miss preinstalled malware, especially if it’s embedded in the system partition. Manual inspection is essential.
Forgetting to check default apps: Malware that sets itself as the default browser or SMS app can intercept your data without you noticing.

Tips

Buy from trusted sources: The best defense is to purchase phones from official retailers or directly from the manufacturer. Avoid heavily discounted phones from unknown sellers.
Keep your phone updated: Manufacturers push security patches that fix vulnerabilities. Go to Settings > System > System update to check for updates.
Use a package name checker: Apps like “Package Name Viewer” (on the Play Store) can show you the package name of any app, making it easier to search online.
Check the app’s digital signature: If you’re tech-savvy, you can use ADB (Android Debug Bridge) to check the signature of a suspicious app. Legitimate system apps are signed by the manufacturer.
Be wary of “free” phones: If someone gives you a phone, assume it might have malware until you’ve checked it thoroughly.

Troubleshooting

You can’t find the “Show system apps” option: On some phones (especially Samsung), you may need to tap the three-dot menu and select “Show system apps” or “Show all apps.” If you don’t see it, try searching for the app name in the Settings search bar.
Play Protect says “No issues” but you still suspect malware: Play Protect only detects known threats. Continue with manual checks. You can also try a second opinion from a reputable antivirus app like Malwarebytes or Bitdefender (free versions are fine).
You found a suspicious app but can’t uninstall or disable it: This is common with deeply embedded malware. Try the “Uninstall updates” option first. If that fails, you may need to use ADB to remove it—search for “ADB remove system app” for your specific phone model. If that’s too technical, a factory reset is the next step.
After a factory reset, the suspicious app is still there: This indicates the malware is in the firmware itself. In that case, you need to flash the original stock firmware using tools like Odin (Samsung) or Fastboot (Google/Pixel). This is advanced and varies by phone—search for your exact model. If you’re not comfortable, take the phone to a professional repair shop.
You’re not sure if an app is legitimate: Search the exact app name and package name online. If you find nothing, or if the app appears on lists of known malware (like those from security firms), treat it as suspicious.

Frequently Asked Questions

Q: Can malware be preinstalled on a new phone from the factory?
A: Yes, it’s rare but it happens. Some budget manufacturers or resellers have been caught preinstalling adware or spyware on new devices to generate revenue.

Q: Will a factory reset remove preinstalled malware?
A: It will remove most malware, but if the malware is embedded in the system partition or firmware, it can survive a reset. That’s why it’s important to check after resetting.

Q: How can I tell if an app is a system app or a user app?
A: In the app info page, look for the “Uninstall” button. If it’s grayed out or says “Disable” instead, it’s a system app. User apps have a normal “Uninstall” button.

Q: Is it safe to disable a system app I don’t recognize?
A: Disabling a system app is generally safe—it just stops it from running. If it’s a core component, some features might stop working, but you can re-enable it anytime. If it’s malware, disabling it neutralizes it.

Q: Can antivirus apps detect preinstalled malware?
A: Some can, but not always. Preinstalled malware often has system-level privileges that hide it from antivirus scanners. Manual inspection is more reliable.

Q: What should I do if I find malware on my phone?
A: First, try to uninstall or disable it. If you can’t, do a factory reset. If it survives the reset, flash the stock firmware or get professional help. Also, change all your passwords (email, banking, social media) as a precaution.

General steps for current mainstream versions; menus can differ by device and version. See the disclaimer or report an error.

More in this bed

The whole Tech How-To bed →