Malware Incident Recovery Checklist: Accounts, Devices, and Files to Secure After an Infection

Overview

A device can appear normal after an antivirus scan or reinstall while stolen passwords, active login sessions, browser data, or exposed payment details remain at risk. Treat recovery as a separate phase from cleanup. The aim is to restore a trustworthy device, reduce the chance of account takeover, and preserve enough evidence to explain what happened.

This malware incident recovery checklist applies to Windows PCs, Macs, Android phones, and iPhones, although the menus and available controls differ by platform. If the device belongs to a business, stop before deleting logs or resetting it and follow the organization’s incident-response process. A work device may need forensic review, notification of an administrator, or preservation of evidence.

If malware is still active, symptoms return after removal, or the device handles sensitive business or financial information, disconnect it from networks and obtain qualified technical help. Do not repeatedly sign in to important accounts on a device you do not yet trust.

What to track

1. Containment status

• Disconnect the affected device from Wi-Fi, wired networks, Bluetooth, and removable storage when practical.
• Record when the suspicious activity began, what was observed, and which accounts or files were in use.
• Note the detection name, scan date, quarantine action, and whether the security tool reported unresolved items. Our guide to antivirus scan results explains how to distinguish quarantine, potentially unwanted programs, and uncertain detections.
• Do not restore quarantined files simply because an application stops working. Confirm the file’s source and need first.

2. Account and session security

Use a separate, trusted device to change passwords. Start with the email account that can reset other passwords, then protect password managers, cloud storage, financial services, work accounts, social networks, and shopping accounts. Use unique passwords rather than variations of the compromised one.

Changing a password may not end existing sessions. Open each account’s security page and choose the option to sign out of other devices, revoke active sessions, remove unfamiliar recovery methods, and review connected applications. Check recent sign-in history for locations, devices, and times you do not recognize. Treat an unexpected login or password-reset message as a reason to investigate, not as proof that the issue is resolved.

Turn on multifactor authentication wherever available. An authenticator app or hardware security key can provide stronger protection than text messages, but any supported second factor is generally better than leaving an important account protected only by a password. Save recovery codes in a secure location that is not the affected device.

3. Device trust by platform

• Windows: Install pending operating-system and browser updates, review startup applications and installed programs, and check for unfamiliar local accounts or remote-access tools. If malware returns, use the operating system’s recovery options or perform a clean reinstall after confirming that important files are safely backed up.
• Mac: Apply system and browser updates, inspect Login Items and unfamiliar applications, and review privacy permissions for camera, microphone, files, accessibility, and full disk access. Remove permissions only when you understand what the application does.
• Android: Update the operating system and apps, remove unfamiliar applications, review accessibility and device-administrator access, and check whether an app can install unknown applications or read notifications. Use the official app store where possible. Our Android antivirus guide covers scanning and privacy controls.
• iPhone: Update iOS, remove unknown configuration profiles or device-management entries, inspect installed apps, and review Apple Account devices and trusted numbers. If the device remains suspicious, back up essential data and consider erasing it and setting it up again.

4. Browser, files, and backup checks

Remove unfamiliar browser extensions, search providers, notification permissions, and saved payment details. Sign out of browser sync before changing credentials, then re-enable it only after checking that unwanted extensions and settings are gone. For browser hijacker symptoms, compare the browser’s home page, default search engine, and installed extensions with your intended configuration.

Review recent downloads and modified files. Do not open suspicious documents to determine whether they are safe. Scan backups before restoring them, and keep at least one backup disconnected from the device when it is not being updated. Test that important documents open and that the backup contains recent, usable versions. For ransomware concerns, use the ransomware protection checklist to review recovery settings and backup testing.

5. Financial and identity monitoring

If payment information, identity documents, email, or password-manager data may have been exposed, contact the relevant provider through an official website or statement rather than a message link. Review transactions, password-reset emails, new-account notices, and changes to contact details. Keep records of dates, reference numbers, and conversations. The appropriate response depends on what data was exposed and the rules or support options available in your region.

Cadence and checkpoints

Use a staged recovery schedule rather than trying to fix everything at once:

1. Immediately: Isolate the device, stop suspicious activity, preserve key evidence, and identify whether work accounts or sensitive information were involved.
2. Within the first day: From a clean device, change priority passwords, revoke sessions, enable multifactor authentication, and notify the appropriate bank, employer, or service provider if exposure is plausible.
3. During the next several days: Patch the operating system and applications, remove unwanted software and browser changes, complete a second security scan, and validate backups before restoring files.
4. For the following weeks: Watch sign-in alerts, account recovery messages, financial activity, and recurring device symptoms. Keep a simple incident log instead of relying on memory.
5. Monthly or quarterly: Review account sessions, recovery methods, multifactor authentication, installed applications, backup status, and update settings. The exact interval should reflect the device’s importance and the sensitivity of its data.

Before returning a device to normal use, confirm that updates are installed, security protection is active, disk encryption is enabled where appropriate, screen-lock settings are configured, and unnecessary remote-access tools are removed. For platform-specific protection choices, compare our guides to Mac antivirus and Windows security options rather than installing multiple products that may conflict.

How to interpret changes

One isolated warning does not always mean reinfection. A legitimate application can trigger a false positive, an old password can produce a delayed login attempt, and a browser extension may return through synchronization. Investigate patterns instead of dismissing every alert or assuming every alert is proof of compromise.

Escalate when the same detection returns after removal, security settings change without permission, new administrator accounts appear, the device becomes encrypted unexpectedly, or unfamiliar logins continue after passwords and sessions are reset. Repeated browser redirects, disabled security tools, unexplained battery or network use, and files changing without an obvious cause also deserve attention.

Preserve useful evidence before wiping a device: screenshots, detection names, timestamps, suspicious email headers, URLs, file hashes when available, affected filenames, and account-alert messages. Avoid uploading private files to public analysis services. If you need to report phishing, use the service’s official reporting channel; our phishing checklist can help document suspicious messages safely.

When to revisit

Return to this checklist after every malware incident, suspicious-login alert, unexpected password-reset message, device replacement, or major operating-system change. Revisit it on a monthly or quarterly schedule for accounts and backups, and refresh your household or business recovery plan at least when your devices, password manager, identity provider, or backup method changes.

Use each review as a short practical exercise:

• Confirm that important accounts still use unique passwords and multifactor authentication.
• Remove old sessions, devices, recovery methods, and third-party connections.
• Install pending updates and review unfamiliar applications, extensions, profiles, and permissions.
• Run a trusted security scan and investigate repeated detections rather than repeatedly dismissing them.
• Open a test file from a backup and confirm that the backup is recent, complete, and protected from accidental deletion.
• Check payment accounts and security alerts, then record any unresolved issue and its next action.

A successful recovery is not simply a clean scan. It is a documented return to trustworthy devices, controlled accounts, usable backups, and monitored activity. Keeping this checklist accessible makes the next incident—or the next routine security review—faster and less error-prone.