How the antivirus keeps the device safe
The antivirus works in more than one way, catching threats both as they arrive and when a check is run by hand.
- Real-time protection watches for new risks as they appear. New downloads are scanned the moment they are saved, and newly installed or updated apps are scanned as they are added, which means a harmful file or app can be caught right as it lands on the device.
- Scheduled scans run automatically in the background on a regular schedule, checking the device about once a day when it is charging and connected to a network, without anything needing to be started manually.
- Manual scans can be run at any time to check the files and installed apps already on the device.
In addition, the device is scanned after it restarts, and a memory card or USB drive is scanned automatically when it is connected.
While a scan is running, a notification appears in the Android notification area showing that a scan is in progress. This is part of how Android runs background tasks.
The antivirus pays particular attention to apps and files from unknown sources, which carry the most risk. When something harmful is found, it is flagged as a threat and can be removed from within the app.
How threats are detected
The antivirus checks files and apps in two different ways, which is useful to understand when reading a result.
Files are checked on the device itself, and a harmful file can be identified without an internet connection. Installed apps are checked against an online reputation service. A connection is needed to get a verdict for an app. If an app is not yet known to that service, it may be reported as unrecognized rather than clearly safe or harmful.
Research and analysis into new threats is ongoing, and the online information is updated as more is learned. Because of this, results can change over time as the latest findings come through. Keeping the scheduled scan turned on ensures the device is checked continuously against the most up-to-date threat information.
Setting up Device Health
The setup screen is titled "Your device health" and checks two things on the device: the screen lock and the device scan.
- The Device lock card shows an "Enabled" badge when a screen lock is set. If it is not set, it explains that without a lock screen, anyone who picks up the phone has full access to everything on it, and offers a Fix button.
- The Device scan card explains that it automatically scans the device daily for incoming threats and also scans new downloads.
Tap Set up your device health to begin. The antivirus then requests two permissions, each shown as a card with an Allow button:
- File access, described as being needed to scan files and apps and keep the device safe from threats.
- Notifications, described as being needed to reach the user immediately if something is found.
Once both permissions are granted, a Start a scan button is shown to run the first scan. If setup does not complete, a Try again button appears with a short message explaining what went wrong.
The Device health screen
The main screen is titled "Device health" and has a Settings icon in the corner. What it shows depends on whether the antivirus is turned on.
When the antivirus is on, the Device scan card is the center of the screen. It shows either "Tap to scan" or "Scanning your device", and during a scan it displays the progress as a percentage along with three counters: Files checked, Apps checked, and Threats removed. A Start scan button begins a scan, and a Stop scan button appears while one is running.
The Device lock card sits below, showing an "Enabled" or "Disabled" badge with a Check button to re-check the lock status. At the bottom, Recent scans (last 30 days) lists past scans; when there is nothing to show, it reads "No recent threats. Run a scan to check your device."
If the antivirus is turned off, an "Antivirus is off" card appears instead, explaining that real-time protection and scheduled scans are paused, with a Turn on button to switch protection back on.
Running a scan
Tap Start scan on the Device scan card to check the device by hand. The scan looks through the files and installed apps, updating the Files checked and Apps checked counters as it goes. A scan can be stopped at any time with Stop scan. Once finished, the result is added to the Recent scans list, where tapping a scan opens its details, including the scan type, date, start and end times, and the number of files and apps checked.
When a threat is found
If a scan finds something harmful, a Threats found card appears, noting that action is required to keep the device safe, with a Remove threat button (or Remove threats when there is more than one).
Tapping a threat opens its details, headed "Threat detected", showing information such as the app or file name and the type of problem found. An explanation headed "Why is this a threat?" notes that apps and files from unknown sources can be risky because they might steal data or harm the device.
Tapping Remove threat deletes it. How this happens depends on the type of threat. A harmful file is removed directly, though for a file on a memory card a "Permission required" dialog may appear asking for additional file access, which can be granted by tapping Continue. A harmful app is removed through Android's standard uninstall dialog, which must be confirmed to complete the removal. Once removed, the threat detail updates to "Threat removed".
If the antivirus is switched off when a threat is present, the card instead prompts to enable the antivirus feature before threats can be removed.
Fixing the screen lock
If a screen lock is not set up properly, the Fix button opens guidance to set one up. A screen lock is set in the Android system settings:
- Open the Android Settings app.
- Tap Security, or Security & privacy on some devices.
- Tap Screen lock.
- Choose a lock type, such as PIN, pattern, or password, and follow the prompts. Fingerprint or face unlock can be added as an extra option.
The exact names can vary by manufacturer. On Samsung devices, for example, this is found under Lock screen. After setting a lock, return to Kiren and tap Check to confirm it is now enabled.
A screen lock is the first line of defense if a phone is lost or stolen, keeping personal data out of reach.
Testing that the antivirus works
To see the antivirus in action safely, the EICAR test file can be used. This is a small, completely harmless file created by the security industry for exactly this purpose. It contains no actual malware, but antivirus software is designed to recognize it as though it were a threat, which makes it a safe way to confirm that protection is working.
Download the test file from the official source at https://www.eicar.org/download/eicar_com-zip/ and the antivirus should detect it as a threat, appearing on the Device health screen like any other detection. The file can then be removed in the usual way.
A couple of things are worth noting. Because every antivirus is built to flag this file, a web browser or another security tool may block the download before Kiren sees it, which is itself a sign that protection somewhere is working. This test confirms file scanning in particular, which runs on the device without needing a connection.
Device health settings
The Settings icon opens the "Device health settings" screen, which has three switches:
- Protection turns real-time protection and scheduled scans on or off. Turning it off disables the antivirus entirely.
- Scheduled scan controls whether automatic background scans run on a regular schedule.
- Scan on mobile network allows scans to run over mobile data. Turning it off limits scans to Wi-Fi only, which is useful for avoiding mobile data use.