How To Remove GodFather Trojan [Virus Removal Guide]

GodFather is a banking Trojan that disguises itself as a legitimate app, tricking users into downloading it on their Android device, then it infects the device, steals sensitive financial information and personal information, sends text messages, takes control of the device, downloads other malicious software, and participates in other malicious activities such as DDoS attacks.

Advertisements

What is GodFather Trojan?

GodFather is a Trojan horse that it disguises itself as a legitimate app, tricking users into downloading and installing it on their devices. Once installed, the GodFather malware begins to infect the device and perform various malicious actions, such as spying on the user, stealing personal information, and sending text messages.

Advertisements

One of the primary goals of GodFather malware is to steal sensitive financial information, such as banking login credentials and crypto exchange passwords.

When a device is infected with the GodFather Trojan, the malware will gain access to the device’s system and start to collect personal information. This can include login credentials for banking and crypto exchange accounts, credit card information, and other sensitive data. The malware may also take control of the device and use it to download and install other malicious software, further compromising the security of the device.

Advertisements

In addition to stealing personal information, GodFather malware can also send text messages from the infected device, which can lead to additional costs for the user. The malware may also use the infected device to perform other malicious actions, such as sending spam messages or participating in DDoS attacks.

How was GodFather Trojan installed on my device?

GodFather malware is typically distributed through third-party app stores, phishing emails, or malicious links. Therefore, one of the best ways to protect your device from GodFather malware is to only download apps from the official Google Play Store and to be cautious when clicking on links in emails or text messages.

If you suspect your device might be infected with this type of malware, we recommend that you reset your device to factory settings and change all of your login credentials for any accounts that may have been compromised by this Trojan. This includes banking and crypto exchange accounts, as well as any other accounts that may have been accessed by the malware.

Advertisements

To check your device for malware and remove it for free, please use the guide below.

Removal Instructions for GodFather Trojan

This malware removal guide may appear overwhelming due to the number of steps and numerous programs that are being used. We have only written it this way to provide clear, detailed, and easy-to-understand instructions that anyone can use to remove malware for free.
Please perform all the steps in the correct order. If you have any questions or doubt at any point, stop and ask for our assistance.

To remove GodFather Trojan from your device, follow these steps:

STEP 1: Uninstall malicious apps
STEP 2: Stop spam notifications and redirects in your browser
STEP 3: Use Malwarebytes for Android to remove malicious apps

STEP 1: Uninstall malicious apps

In this first step, we will check if any malicious apps are installed on your phone. Sometimes browser hijackers or adware apps can have usable Uninstall entries that can be used to remove these apps.

Advertisements

Open the “Settings” menu.

Tap on the “Settings” app from your phone menu or home screen.
Tap on “Apps”.

When the “Settings” menu opens, tap on “Apps” to see all the installed applications on your phone. On Pixel and some other phones, tap “See all apps” next.
Find the malicious app.

The “Apps” screen will be displayed with a list of all the applications that are installed on your phone. Scroll through the list and look out for any suspicious app that could be behind all the drama – anything you don’t remember downloading or that doesn’t sound like a genuine program.
Most often, cyber criminals hide malware inside video or photo editing apps, weather apps, and camera apps.
Uninstall the malicious app

When you find a suspicious or malicious app, tap on it to uninstall it. This won’t start the app but will open up the app details screen. If the app is currently running press the “Force stop” button, then tap on “Uninstall”.

A confirmation dialog should be displayed to confirm you want to uninstall the app, tap on “OK” to remove the malicious app from your phone.

Can’t uninstall an app? It may have device admin rights. Open Settings, search for Device admin apps, turn off the app there, and then uninstall it. Don’t remove an app that your work or school uses to manage the phone. Google Play Protect also checks your apps: in the Play Store, tap your profile icon, then tap Play Protect to see whether it found anything harmful.

Advertisements

STEP 2: Stop spam notifications and redirects in your browser

In this second step, we will stop spam notifications in your browser. If unwanted pages or redirects still appear after that, we will reset the browser by clearing its app storage. That is a last resort, because it can delete data that isn’t synced.

Android browsers don’t have a single “reset settings” button like browsers on a computer, but they do let you control what each website is allowed to do. Start with the least disruptive fix: block the spam site’s notifications in the browser’s settings. In Chrome, you can also delete cookies and site data: tap More (three dots) > Delete browsing data.

Clear the browser’s app storage only if unwanted pages or redirects keep coming back. It works like a full reset, but it also deletes data that isn’t synced, so treat it as a last resort.

Remove malware from Chrome for Android

First, block the spam site’s notifications:

Open Chrome, tap the More button (three dots) in the top-right corner, and tap Settings.
Tap Site settings, then tap Notifications.
Find the spam site in the list and turn off the switch next to it, or tap the site and block its notifications. To stop other sites from asking, you can also turn off the switch at the top.

If unwanted pages or redirects keep appearing, clear Chrome’s storage (last resort):

Before you clear storage: this deletes everything Chrome has stored on your phone, including open tabs, website sign-ins, and settings. Bookmarks and passwords that are synced to your account come back when you sign in again, but anything that isn’t synced is lost. Skip this part if blocking the notifications fixed the problem.

Open the “Settings” menu.

Tap on the “Settings” app from your phone menu or home screen.
Tap on “Apps”.

When the “Settings” menu opens, tap on “Apps” to see all the installed applications on your phone.
Find and tap on Chrome.

The “Apps” screen will be displayed with a list of all the apps installed on your phone. Scroll through the list until you find the Chrome app, then tap on it to open the app’s details.
Tap “Storage”.

When Chrome’s app info menu is displayed, tap on “Storage” (on Pixel phones, “Storage & cache“).
Tap “Manage Space”.

Under the storage settings, tap “Manage space” (called “Manage storage” on some phones). Don’t tap “Clear cache”, because it doesn’t reset Chrome.
Tap “Clear all data”.

Tap “Clear all data” to delete all Chrome’s data including accounts, bookmarks, and your settings to reset the default settings.
Confirm by tapping “Ok”.

A confirmation dialog should now be displayed, detailing the components that will be restored to their default state should you continue with the reset process. To complete the restoration process, tap “Ok“.

Remove malware from Firefox for Android

First, block the spam site’s notifications:

Open Firefox, tap the menu button (three dots), and tap Settings.
Tap Site permissions, then tap Exceptions.
Tap the spam site, then set Notification to Blocked.
Optional: to stop other sites from asking, go back to Site permissions, tap Notification, and choose Blocked.

If unwanted pages or redirects keep appearing, clear Firefox’s storage (last resort):

Before you clear storage: this deletes everything Firefox has stored on your phone, including open tabs, website sign-ins, and settings. Bookmarks and passwords that are synced to your account come back when you sign in again, but anything that isn’t synced is lost. Skip this part if blocking the notifications fixed the problem.

Open the “Settings” menu.

Tap on the “Settings” app from your phone menu or home screen.
Tap on “Apps”.

When the “Settings” menu opens, tap on “Apps” to see all the installed applications on your phone.
Find and tap on Firefox.

The “Apps” screen will be displayed with a list of all the apps installed on your phone. Scroll through the list until you find the Firefox app, then tap on it to open the app’s details.
Tap “Storage”.

When Firefox’s app info menu is displayed, tap on “Storage” (on Pixel phones, “Storage & cache“).
Tap “Clear storage” or “Clear data”.

Tap “Clear storage” (called “Clear data” on Samsung phones). If you see “Manage space” or “Manage storage” instead, tap it, then tap “Clear all data“. Don’t use “Clear cache” for this step, because it doesn’t reset the browser.
Confirm by tapping “OK”.

A confirmation dialog will appear. Tap “OK” or “Delete” to finish. When you open Firefox again, sign back in and turn sync back on if you use it.

Remove malware from the Opera browser

First, block the spam site’s notifications:

Open Opera, open the Opera menu, and tap Settings.
Tap Site settings, then tap Notifications.
Find the spam site and block it. Don’t just remove it from the list, because a removed site can ask again.

If unwanted pages or redirects keep appearing, clear Opera’s storage (last resort):

Before you clear storage: this deletes everything Opera has stored on your phone, including open tabs, website sign-ins, and settings. Bookmarks and passwords that are synced to your account come back when you sign in again, but anything that isn’t synced is lost. Skip this part if blocking the notifications fixed the problem.

Open the “Settings” menu.

Tap on the “Settings” app from your phone menu or home screen.
Tap on “Apps”.

When the “Settings” menu opens, tap on “Apps” to see all the installed applications on your phone.
Find and tap on Opera.

The “Apps” screen will be displayed with a list of all the apps installed on your phone. Scroll through the list until you find the Opera app, then tap on it to open the app’s details.
Tap “Storage”.

When Opera’s app info menu is displayed, tap on “Storage” (on Pixel phones, “Storage & cache“).
Tap “Clear storage” or “Clear data”.

Tap “Clear storage” (called “Clear data” on Samsung phones). If you see “Manage space” or “Manage storage” instead, tap it, then tap “Clear all data“. Don’t use “Clear cache” for this step, because it doesn’t reset the browser.
Confirm by tapping “OK”.

A confirmation dialog will appear. Tap “OK” or “Delete” to finish. When you open Opera again, sign back in and turn sync back on if you use it.

Remove malware from Samsung Internet

First, block the spam site’s notifications:

Open your phone’s Settings app and tap Notifications.
Tap App notifications, then tap Samsung Internet.
Under Sites, turn off the switch for the spam website.

If unwanted pages or redirects keep appearing, clear Samsung Internet’s storage (last resort):

Before you clear storage: this deletes everything Samsung Internet has stored on your phone, including open tabs, website sign-ins, and settings. Bookmarks and passwords that are synced to your account come back when you sign in again, but anything that isn’t synced is lost. Skip this part if blocking the notifications fixed the problem.

Open the “Settings” menu.

Tap on the “Settings” app from your phone menu or home screen.
Tap on “Apps”.

When the “Settings” menu opens, tap on “Apps” to see all the installed applications on your phone.
Find and tap on Samsung Internet.

The “Apps” screen will be displayed with a list of all the apps installed on your phone. Scroll through the list until you find the Samsung Internet app, then tap on it to open the app’s details.
Tap “Storage”.

When Samsung Internet’s app info menu is displayed, tap on “Storage” (on Pixel phones, “Storage & cache“).
Tap “Clear storage” or “Clear data”.

Tap “Clear storage” (called “Clear data” on Samsung phones). If you see “Manage space” or “Manage storage” instead, tap it, then tap “Clear all data“. Don’t use “Clear cache” for this step, because it doesn’t reset the browser.
Confirm by tapping “OK”.

A confirmation dialog will appear. Tap “OK” or “Delete” to finish. When you open Samsung Internet again, sign back in and turn sync back on if you use it.

Remove malware from Microsoft Edge for Android

First, block the spam site’s notifications:

Open Microsoft Edge, tap the menu button (three dots) at the bottom of the screen, and tap Settings.
Tap Site permissions, then tap Notifications. In some versions, Site permissions is inside Privacy and security.
Find the spam site in the list of allowed sites and switch it to Block.

If unwanted pages or redirects keep appearing, clear Microsoft Edge’s storage (last resort):

Before you clear storage: this deletes everything Microsoft Edge has stored on your phone, including open tabs, website sign-ins, and settings. Bookmarks and passwords that are synced to your account come back when you sign in again, but anything that isn’t synced is lost. Skip this part if blocking the notifications fixed the problem.

Open the “Settings” menu.

Tap on the “Settings” app from your phone menu or home screen.
Tap on “Apps”.

When the “Settings” menu opens, tap on “Apps” to see all the installed applications on your phone.
Find and tap on Microsoft Edge.

The “Apps” screen will be displayed with a list of all the apps installed on your phone. Scroll through the list until you find the Microsoft Edge app, then tap on it to open the app’s details.
Tap “Storage”.

When the Microsoft Edge’s app info menu is displayed, tap on “Storage” (on Pixel phones, “Storage & cache“).
Tap “Clear storage” or “Clear data”.

Tap “Clear storage” (called “Clear data” on Samsung phones). If you see “Manage space” or “Manage storage” instead, tap it, then tap “Clear all data“. Don’t use “Clear cache” for this step, because it doesn’t reset the browser.
Confirm by tapping “OK”.

A confirmation dialog will appear. Tap “OK” or “Delete” to finish. When you open Microsoft Edge again, sign back in and turn sync back on if you use it.

Can’t find the setting? Use your phone’s own notification controls. When the next spam notification appears, swipe it slightly to the side or press and hold it, then tap the settings icon and turn off notifications for that website. You can also open Settings > Notifications, choose your browser, and turn off the spam site under Sites if it’s listed there.

STEP 3: Use Malwarebytes for Android to remove malicious apps

In this final step, we will install Malwarebytes for Android to scan and remove malicious apps from your phone or tablet.

Malwarebytes for Android scans your phone or tablet for malware, adware, and potentially unwanted apps. The free version scans only when you start a scan. Real-time protection, which checks apps automatically, is part of the paid Premium version.

Download Malwarebytes for Android.

You can download Malwarebytes for Android by clicking the link below.

Malwarebytes for AndroidScans your phone and removes malware at no cost
Get Malwarebytes for AndroidOpens Google Play in a new tab.Want real-time protection? See Malwarebytes Premium for Android
Install Malwarebytes for Android on your phone.

In the Google Play Store, tap “Install” to install Malwarebytes for Android on your device.

When the installation process has finished, tap “Open” to begin using Malwarebytes for Android. You can also open Malwarebytes by tapping on its icon in your phone menu or home screen.
Follow the on-screen prompts to complete the setup process

When Malwarebytes opens, it walks you through a short setup. Tap Get started and follow the prompts. If you see an offer for a trial or a paid plan, read it before you accept. You can skip it and keep using the free scanner.

Malwarebytes will ask for permission to access the files on your phone so it can scan them. Tap Allow, or turn on the permission in the Android screen that opens, then return to Malwarebytes.
Run a scan with Malwarebytes for Android

On the main screen, tap Scan now. In some versions, you open the menu, tap Scanner, and then tap Run a scan.
Wait for the Malwarebytes scan to complete.

Malwarebytes will now start scanning your phone for adware and other malicious apps. This process can take a few minutes, so we suggest you do something else and periodically check on the status of the scan to see when it is finished.
Remove the detected apps.

When the scan has been completed, you will see a list of the threats that Malwarebytes for Android has detected. Next to each detected item, tap the menu icon (three dots), then choose to uninstall the app or delete the file. Android then asks you to confirm. Tap OK or Uninstall to remove the app.
Restart your phone.

When the detected apps are removed, restart your phone if Malwarebytes asks you to. Then check whether the problems you noticed have stopped.

Your computer should now be free of the GodFather Trojan Trojan and other malicious programs.

Keep your phone protectedStop the next infection before it starts

Malwarebytes for Android Premium adds real-time protection that blocks malicious apps and scam links before they can harm your phone.See Malwarebytes for Android

If you are still having problems with your phone after completing these instructions, then please follow one of the steps:

Ask for help in our Mobile Malware Removal Help & Support forum.
Only as a last resort, reset your phone to factory settings. Read the warning below first.

A factory reset erases everything on your phone. Your apps, photos, files, and settings are deleted, so use it only if the problem continues after the steps above and after you’ve asked for help. Before you reset:

Back up your photos, videos, files, and messages, for example to your Google account or a computer.
Make sure you know your Google account email and password. The phone asks for them after the reset. If you changed the password recently, Google recommends waiting 24 hours before you reset.
On a Samsung phone, also make sure you know your Samsung account password.
If you use an authenticator app for two-step verification, move your accounts to another device or save your backup codes first.

On a Google Pixel, go to Settings > System > Reset options > Erase all data (factory reset). On a Samsung Galaxy phone, go to Settings > General management > Reset > Factory data reset. Menu names differ on other phones, so check your manufacturer’s support site.

Advertisements

What is GodFather Trojan?

How was GodFather Trojan installed on my device?