Detection and management methods and apparatus for wireless devices may include an executable instruction authorization module operable to scan executable instructions on a wireless device, generate a log indicative of a virus or otherwise unauthorized executable instructions based on a received authorization configuration, and forward the log to a user manager. The user manager may be operable to analyze the log and generate an authorization report which may be viewable by an operator to determine the disposition of unauthorized executable instructions. At least one of the executable instruction authorization module, the user manager, and the operator may be operable to generate a control command operable to delete, or otherwise disable, unauthorized executable instructions on the wireless device, or to restore the executable instructions on the wireless device.