There seems to be a lot of anti-virus apps for Android. On a desktop or server an anti-virus must run with super-user privileges, however I am pretty sure these mobile anti-viruses are running as an unprivileged user. That being said, real anti-virus companies like AVG and McAfee have released anti-virus apps for Android.

How do these anti-virus apps work? Are they effective?

2 Answers 2


The basic tasks of an antivirus do not require that much of super-user accesses; to see whether a given executable file seems to contain a known virus, then read access to that file is sufficient. This can be done from userland, without modifying the kernel or even obtain root privileges; the system of configurable permissions for apps can handle that. Similarly, interception of network traffic can be done with the relevant permission.

What would require fiddling with the kernel would be launching the antivirus on a file when that file is executed. But Android has a stricter security model than desktop operating systems; application code cannot do everything it wishes, e.g. inspecting the RAM used by other applications. This constraints what an antivirus can do, but also what virus can do. If malware has already gone beyond this system-enforced layer, then things are much worse than what antivirus can fix.

On a rooted device, of course, these things change a lot. A rooted device is much similar to, say, a PC. In that case a PC running a kind of Linux, where both virus and antivirus are scarce.

Apparently, Google is (or was) very much against the mere idea of an antivirus on Android. The permissions model is such that, at least on the paper, malware filtering is better done on the app repository (Google Play); at least so it is claimed. Antivirus software is useful only as long as it detects malware which would otherwise be disruptive for your device or your data, but such disruption would be considered as a bug on either the OS or the app repository, and promptly fixed by Google. Thus, an antivirus is efficient only insofar as the antivirus vendor and its update policy are more reactive than Google themselves.

  • I'm not sure if this should be a separate question, or a comment on your answer, but I'm confused about how Google could claim that malware is being stopped at the app repository, or anywhere for that matter, when all of the articles I read show that the Android platform is by far the most infected platform there is. (Example: zdnet.com/…) Are these articles wrong, or is Google wrong, or am I just misunderstanding something? Commented Mar 8, 2013 at 19:17
  • 2
    Well, I assume that Google would never claim that Android is a scum-ridden hive of malware... note that their claim is from two years ago. A lot of things can change in two years. Possibly, infected Android devices are devices where apps from shady sources were installed. The core idea remains: there is little reason to believe that any given antivirus running on the device will be more efficient at detecting virus than what Google runs on Google Play. So, as long as you only install from Google Play, you have the best possible protection (but "best" does not mean "good" !).
    – Tom Leek
    Commented Mar 8, 2013 at 19:28
  • So are you saying that Antivirus apps mainly check for dangerous combinations of permissions? Not sure I understand the answer to how anti-virus apps work. Assuming a stock, non-rooted device.
    – dudebrobro
    Commented Apr 2, 2013 at 12:52
  • 2
    @TomLeek, So since we already have Google's Antivirus, exactly what value does Mcafee and AVG provide? Or are they just trying to make money with an app that provides no value?
    – Pacerier
    Commented Mar 28, 2015 at 18:14

The anti-virus apps you get from GooglePlay, is most likely made to protect against apps from outside the GooglePlay store (also know as APK packages). We're now writing 2014, and it's starting to get really ugly on the Android platform. There's COUNTLESS "APK" installer packages that just downloads automatically to your phone/tablet if you enter the wrong website. These "APK" packages are like apps from GooglePlay, EXCEPT they're not necessarily safe to use. A common one is "Mobogenie" (I don't trust that one).

A good way to prevent the potentially harmful apps to get onto your device, is to use a browser like Google Chrome for Android (from GooglePlay). It asks you weither you want to stop, or continue file downloads, that occur automatically.

If that's not enough for you, then I suppose you could try out an Antivirus app from GooglePlay.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .