Fix Compromised Accounts After a Malware Infection

Malware on a home device can spill into your online life fast. This guide walks you through locking down compromised accounts, cutting off intruders, and recovering safely. You will use a clean device, reset passwords, turn on extra security (MFA: a one-time code when you sign in), and check your router (the box that creates your home Wi‑Fi) so attackers stay out.

Table of Contents

• Before You Start
• Quick Fix Steps
• Deeper Diagnosis
• Preventive Care
• When to Seek Help
• Conclusion
• Frequently Asked Questions

Before You Start

Goal: stop ongoing theft, secure your accounts, and remove hidden backdoors. You will do the urgent steps first, then deeper checks.

• Prerequisites: at least one clean device (a phone, tablet, or computer you believe is not infected), access to your recovery email or phone for codes, and your list of important accounts.
• Time estimate: 45–90 minutes for the quick fixes, longer if many accounts are affected.
• Difficulty: Medium. Steps are guided with plain language.
• What can go wrong: you might lock yourself out, or change passwords on an infected device (unsafe). Read each step before doing it.

Warning: Avoid downloading random “cleaner” tools or editing low-level settings (like the Windows registry or system files). These can make things worse.

Quick Fix Steps

1. Disconnect suspected devices

   Unplug Ethernet cables and turn off Wi‑Fi on any device that might be infected. This stops ongoing account theft.

   Windows

   Select the network icon, then choose Airplane mode. Or go to Settings > Network & Internet and toggle Wi‑Fi Off.

   macOS

   Click the Wi‑Fi icon and turn Wi‑Fi Off. If needed, unplug Ethernet.

   iOS

   Open Control Center and tap Airplane Mode. Or go to Settings > Wi‑Fi and turn it Off.

   Android

   Swipe down and tap Airplane Mode. Or go to Settings > Network & Internet and turn off Wi‑Fi and Mobile data.

2. Move to a known-clean device

   Use a device that shows no malware signs: no strange pop-ups, no redirects, and it’s up to date. If unsure, use your smartphone with the latest updates installed.

   Tip: On a PC or Mac you believe is clean, run a built-in security scan and install any pending system updates before you sign in to accounts.

3. Secure your primary email account first

   Your email is the key to resetting other accounts. Change its password from the clean device. Use a long, unique passphrase (for example, four or more random words with spaces).

   Then update recovery methods (backup email and phone number). Remove any recovery options you do not recognize.

4. Turn on MFA (two-step sign-in) wherever possible

   MFA means you enter an extra one-time code when you log in. Use an authenticator app or a hardware security key if you can. SMS text codes are better than nothing.

   In each account’s Security settings, find “Two-step verification,” “Two-factor,” or “MFA,” and follow the setup. Save backup codes in a safe place (offline if possible).

5. Change passwords for high‑risk accounts next

   Do banks and payments first, then social media, cloud storage, and shopping accounts. Use unique passwords for each site.

   Note: A password manager (a tool that stores and creates strong passwords) helps you avoid reuse. Pick one that works on your devices and supports MFA.

6. Sign out everywhere and revoke access

   In each account’s Security or Devices page, choose “Sign out of all sessions” or remove unknown devices. Review “Connected apps,” “App passwords,” and “Third‑party access,” and revoke anything you don’t recognize.

7. Fix email rules and forwarding

   Attackers often add auto‑forward or filter rules to hide messages. In your email settings, review Filters/Rules and Forwarding. Delete anything you did not create.

8. Watch your money

   Turn on transaction alerts for your bank and cards. If you see charges you didn’t make, contact your bank’s fraud line immediately. Consider a temporary card lock or a credit freeze with credit bureaus if identity theft is likely.

Deeper Diagnosis

These checks help ensure attackers no longer have a path back into your accounts or network.

Check your router (home Wi‑Fi box)

• Log in to the router admin page. This is usually at http://192.168.0.1 or http://192.168.1.1. The address may be printed on the router label.
• Change the router admin password if it’s default or weak. Store it in your password manager.
• Review DNS settings. If DNS servers look unusual or unknown, set them back to your internet provider’s default or to a well‑known, trusted option.
• Update the router firmware if an update is available in the admin page.

Warning: A factory reset of your router erases custom settings (Wi‑Fi name, password, and any special rules). Only do this if you suspect the router is compromised or you cannot change unwanted settings. Follow the manual’s instructions carefully.

Review devices logged into your accounts

• In each major account, open Security > Devices or Sessions. Remove anything unfamiliar or from odd locations.
• After removal, change the password again if you see re‑logins.

Check saved passwords on your devices

• Windows: Open Control Panel > User Accounts > Credential Manager. Review Web Credentials and remove ones you don’t trust.
• macOS: Open Spotlight and search for “Keychain Access.” Review Saved Passwords and delete suspicious entries.
• iOS: Settings > Passwords. Remove logins you don’t recognize and enable “Security Recommendations.”
• Android: Settings > Passwords & accounts (wording varies). Review saved passwords in your chosen password service and remove suspicious entries.

Note: Removing a saved password does not change it on the website. Be sure you have already changed the real account password first.

Run updates and a security scan

• Windows: Settings > Windows Update > Check for updates. Then open Windows Security > Virus & threat protection > Quick scan.
• macOS: System Settings > General > Software Update. Keep Gatekeeper on and avoid running unknown apps.
• iOS: Settings > General > Software Update. Install the latest version.
• Android: Settings > System > System update. Install the latest security update.

Warning: Avoid “registry cleaners” or unofficial antivirus downloads. Use built‑in tools or reputable, well‑known options from official app stores or the vendor’s official site.

Remove suspicious apps and extensions

• Uninstall programs you do not recognize from your computer or phone.
• In your browser, remove unknown extensions/add‑ons. Then restart the browser.

Add a carrier PIN (SIM protection)

• Contact your mobile carrier and ask to add a “port‑out” or “account” PIN. This helps block attackers from moving your phone number (SIM swap), which could bypass MFA.

Preventive Care

• Updates: Turn on automatic updates for your operating system, browsers, and apps. Update your router firmware a few times a year.
• Backups: Keep at least one offline or cloud backup of important files. A simple rule is “3‑2‑1”: three copies, two types of storage, one off‑site.
• Password hygiene: Use a password manager, unique passwords, and long passphrases. Never reuse a bank password anywhere else.
• MFA by default: Enable MFA on email, financial, social, and cloud storage accounts. Store backup codes safely.
• Safe downloads: Only install software from official stores or the maker’s official website. Decline extra “bundled” offers.
• Phishing awareness: If a message urges fast action, verify through another channel. Hover over links to preview the real address before clicking.
• Account housekeeping: Every few months, review connected devices, third‑party app access, and email forwarding rules.
• Separate accounts on shared devices: Use separate logins for family members. Avoid running as an admin for everyday use.

When to Seek Help

• You cannot access your primary email, or recovery options were changed without you.
• You see unauthorized bank or card transactions. Call your bank’s fraud department immediately.
• Passwords keep changing or MFA prompts appear that you did not start.
• Multiple devices show pop‑ups, redirects, or new toolbars even after removal attempts.
• You suspect your router is compromised and settings revert after changes.
• You handle sensitive work or personal data and need certified help.

Who to contact: your bank or card issuer, your account provider’s official support, your mobile carrier (for SIM PIN), your internet provider (for router/network issues), a trusted local computer repair professional, and your country’s identity theft resources if needed.

Conclusion

You cut off attackers, secured your key accounts with fresh passwords and MFA, and checked your router and devices for backdoors. Keep watch on financial activity, review devices that stay signed in, and maintain updates and backups. A little routine care now prevents bigger headaches later.

Frequently Asked Questions

Do I need to factory reset all my devices?

Not always. Start with account locks, MFA, and scans. If problems persist or you cannot remove malware, consider a factory reset after backing up files. A reset erases all data and apps.

Is SMS MFA safe enough?

It is better than no MFA. If possible, use an authenticator app or a hardware key for stronger protection. Always store backup codes safely.

How do I know a device is clean enough to log in?

It should be fully updated, pass a security scan, and show no odd behavior (pop‑ups, redirects, or unknown apps). When in doubt, use a different device to change passwords.

What if I changed passwords but still see suspicious logins?

Enable MFA, sign out of all sessions, revoke unknown apps, and change the password again from a clean device. Then check your router and email forwarding rules for tampering.