How to Tell If Your Android TV Box Is Infected With Malware

First: why "I didn't notice anything weird" isn't enough

The malware affecting TV boxes and generic Android devices — like BADBOX 2.0 or Triada — is designed to operate silently, with system-level privileges, without an icon on screen or a visible notification. The absence of obvious symptoms doesn't confirm the device is clean. So instead of "waiting to see something weird," it's worth actively checking concrete signs.

TV boxes are the most common and best-documented case, but the same problem can affect Android TVs (televisions with Android built in) and generic Android tablets too. The risk depends on the manufacturer and whether the device passed Google's certification, not on the device category itself — the signs in this guide apply equally to any of the three.

1. Check whether your TV box is certified by Google

This is the most direct, least-known check. Google requires manufacturers to pass "hundreds of tests" for a device to earn Play Protect certification — among other things, it forces them to ship the device without preinstalled malware and keep it on recent security updates¹. Most generic TV boxes skip this certification entirely, which means none of those guarantees apply.

How to check: go to Settings → Google → Play Protect (on some devices it appears as "Security" or "Google Play Protect" directly) and see whether the device shows as certified. Google also publishes a certified-model lookup at android.com/certified².

2. Google Play Protect shows disabled and won't turn back on

If trying to enable Play Protect keeps reverting to "disabled" on its own, or the option doesn't exist at all, that's a strong signal: part of several preinstalled-malware families' strategy is to actively disable Google's protections in order to operate without interference.

3. There are app stores or apps you never installed

Check the full app drawer, not just the home screen. Unknown alternative marketplaces, or apps with generic names ("System Update," "Device Health") you don't recall installing, are a typical pattern of factory-level infection.

4. Internet is slow even when you're not using the device

As explained in detail in this note on residential proxies, a compromised device may be reselling your upload bandwidth in the background, all the time — not just while you're actively using it. If your connection feels bad even with the TV box "doing nothing" (no streaming open, no apps running), that's worth investigating.

5. The device was sold with promises that don't quite add up

"Unlocked," free unlimited paid streaming, or premium channels with no subscription are, in practice, commercial red flags: that kind of offer usually depends on the device shipping preconfigured with software that isn't there for your benefit.

6. You don't recognize some devices connected to your wifi

Log into your router's admin panel (usually reachable at an address like 192.168.0.1 or 192.168.1.1) and review the list of connected devices. While this alone doesn't diagnose malware, it gives you real visibility into what's actually using your network — a simple step most people never take.

Why a Play Store antivirus won't tell you this

Traditional antivirus apps scan the apps you installed, looking for known malware signatures at that level. Factory-preinstalled malware — the kind behind BADBOX 2.0 or Triada — lives in system components, with privileges a Play Store antivirus never gets to inspect, the same as other documented Android malware. That's why it takes comparing the device's actual system against a threat catalog built from field research specific to this kind of infection, not a generic scan.

What to do if you confirm a sign

AMK scans your device for free and compares it against that real threat catalog. If it finds nothing, you pay nothing. If it finds a confirmed threat, it tells you exactly what it is and applies the correct removal method for your specific brand and model — without you needing to know anything about technology.