Run Ransomware remediation tool on an Android device

The Ransomware remediation tool in Mobile Security identifies and provides removal instructions when ransomware threats are detected on your Android device. This tool is available once you enable Real-Time Protection and Ransomware Protection. 

How to run Ransomware remediation on your Android device

To run the tool:

1. From the Tools menu, tap Ransomware remediation.
2. Tap Analyze and Remediate. If you see the Malwarebytes doesn't have permission to show remediation instructions message, grant the required permission to use the tool.

When a ransomware threat is detected:

1. Identify the app that is a potential threat from the remediation screen list. 
2. Start your device in safe mode. Refer to your device's manufacturer for instructions. 
3. Remove the ransomware app using your device's system settings. Refer to your device's manufacturer for instructions. 

How to access the Ransomware remediation screen on a locked device

If a ransomware threat locks your device's screen, use one of the following physical triggers to access the Ransomware remediation screen and remove the threat: 

• Plug and unplug a headphone jack 4 times over a 10-second period.
• Use the following Volume button combination: Up, Up, Down, Down, Up, Down.