After Fixing an Infected Device: Checklist

Once the malware is gone, the job is not quite finished. The National Cyber Security Centre (NCSC) sets out four things to do after fixing an infection: keep your device and programs or apps up to date, back up your data, check your device is encrypted, and on a PC or laptop make sure you have antivirus that is updating regularly¹. If you have logged into any accounts since the malware was installed, you must also change the password for those accounts, because it may have been stolen².

The order matters. Update first, so the device is protected before you put anything back on it. Back up only once the device is clean, because a backup taken while malware is present will carry the infection with it². Then deal with passwords, and finally check the rest of the household's devices.

This checklist is for an ordinary household in England, Scotland, Wales and Northern Ireland alike: the NCSC's advice applies across the UK. It assumes the infection has already been dealt with, either by a factory reset on a phone or tablet or by a scan and clean-up on a computer. If the device is still infected, start with our guide to malware on a computer or phone and, for phones, whether to factory reset an infected phone.

The checklist: what to do once the infection is fixed

Work through this in order. Each step is short, and most take only a few minutes.

1. Update your device and its apps. On a PC or laptop, update your device and programs¹. On any device, apply updates to your apps and software as soon as they are available, because updates include protection from viruses³.
2. Turn on automatic updates in your device's settings if the option is offered, so you do not have to remember to apply them⁴.
3. Run your antivirus and follow its advice, on a PC or laptop¹.
4. Back up your data, now that the device is clean¹. If you are not sure how, the NCSC publishes guidance on backing up⁴.
5. Check your device is encrypted¹. Encryption means that if the device is lost or stolen, the data on it is much harder for someone else to read.
6. Change the passwords for any account you logged into while the malware was on the device, and for any other account that used the same password².
7. Log all devices and apps out of each account you have changed the password for, usually from the Settings menus of the app or website⁵.
8. Check the other devices in the home for the same problems, starting with anything that shares your accounts.
9. Watch for signs of return over the next few weeks, and act quickly if the original symptoms come back.

Keep your device and apps up to date

Updates are the single most useful thing you can do after an infection, because they close the holes that malware uses to get in. The NCSC's advice is to apply updates to your apps and your device's software as soon as they are available, and to turn on automatic updates in your device's settings if the option exists, so you do not have to remember⁴. The same advice appears in the NCSC's guidance on recovering a hacked account, which lists updating your apps and devices as one of its steps⁷.

On a computer, the advice is to update your device and programs, then open your antivirus product, run a scan and follow its advice¹. The NCSC also recommends that PCs and laptops have antivirus that is updating regularly, and that security updates are installed as soon as they are available, ideally by setting them to install automatically⁶. ProtectUK, the police's counter-terrorism site, makes the same point in its IT security guidance: make sure the latest updates to your device's operating system are promptly installed⁸.

For smart devices, the NCSC advises turning on the automatic updates option if available, so you do not need to remember to apply updates⁹. The same principle covers phones, tablets, smart speakers, cameras and baby monitors: if a device offers automatic updates, switch them on. If a device no longer receives updates at all, it is worth thinking about how much you rely on it for banking or email.

Back up your data and check your device is encrypted

Backing up means keeping a copy of your files and photos somewhere other than the device itself, so that a lost, stolen or broken device does not take your data with it. The NCSC lists backing up your data as one of the steps to take after fixing an infection¹, and points to its own guidance on how to do it if you are unsure⁴.

The timing is the part people get wrong. The NCSC is explicit that you should not back up your data before you perform a factory reset, because the backup will also contain the malware². The same warning appears in its advice on scam missed parcel texts¹⁰. In practice this means: clean the device first, then back up. If you have already taken a backup while the device was infected, do not restore it onto the clean device without thinking carefully, because you would be putting the malware back.

Encryption is the second half of this step. The NCSC advises checking that your device is encrypted¹. Most modern phones and tablets are encrypted by default once you set a passcode or password, and computers usually offer encryption in their settings. The point is simple: if the device is lost or stolen, encryption makes the data on it much harder for someone else to read.

Change the passwords that may have been stolen

Malware on a phone or computer can steal the passwords you type into it. The NCSC's advice is direct: if you have logged into any accounts or apps since installing the malware, you must change the password for that account, as it may have been stolen. If you have used that same password for any other accounts, you also need to update those passwords, and make sure they are unique². Its phishing guidance says the same: if you have given out your password, change the passwords on any of your accounts which use the same password, and use a passkey instead if one is available¹¹.

Changing the password is only half the job. The NCSC also advises that once you have changed your passwords, you need to make sure that any devices and apps that may still be logged in are logged out, usually from the Settings menus of the app or website, so that anyone still signed in must supply the new password⁵. This matters because a criminal who was already logged in would otherwise stay logged in.

A short list of what to change, in priority order:

• Your email account, because it is the key to resetting everything else.
• Your bank and any payment apps.
• Any shopping or social media account you were signed into on the infected device.
• Any other account that used the same password as any of the above.

For help choosing new ones, see our guides to creating a strong password and protecting email and bank accounts. If an account itself has been taken over rather than just exposed, our guide to what to do if an online account is hacked walks through recovery.

Set up your devices securely, following NCSC advice

Once the clean-up is done, the aim is to make the device harder to infect next time. The NCSC's advice is to follow its guidance for setting up your devices securely and keeping them safe, and to check your device is encrypted¹². For PCs and laptops, it adds: make sure you have antivirus and install security updates as soon as they are available, ideally by setting them to install automatically⁶.

A few practical points sit alongside that advice:

• Install apps only from official app stores, such as Google Play, the Apple App Store or the Samsung Galaxy Store².
• On Android, make sure Google's Play Protect service is enabled. Some Huawei devices provide a similar tool to scan devices for viruses².
• Set up two-step verification on your main accounts. The NCSC points to ncsc.gov.uk/2sv for how to set it up on popular services, or you can look in the security settings included in antivirus or password manager tools¹³. Our guide to turning on 2-step verification covers the steps.
• Read the recovery guidance in advance, so you know what to do if it happens again¹⁴.

If a factory reset does not fix the problem, you will need expert help⁶. Do not keep using a device that is still behaving oddly for banking or email.

Check the rest of the household's devices

If one device was infected, it is worth a look at the others, especially anything that shares your accounts or your home network. The NCSC's guidance on smart devices notes that continuing to use a device, or attempting to fix it yourself or using an unauthorised repairer, could affect your other smart devices on the network¹⁵. That is a reason to deal with a suspect device properly rather than leaving it running.

For each device in the home, check:

• It is running the latest software, and automatic updates are on where offered⁴.
• Apps came from an official app store, and nothing unfamiliar has been installed².
• On Android, Play Protect is switched on².
• On a phone, no app reports the device as rooted or jailbroken unless you did that yourself. The NCSC says such apps can be a good indication of hacking, though they are not a guarantee¹.
• Any smart plugs, cameras or speakers are still on the manufacturer's current software.

There is a physical side to this too. The Health and Safety Executive advises that users of electrical equipment, including portable appliances, should check the equipment each time they use it and remove it from use immediately if the plug or connector is damaged, the cable has been repaired with tape or is not secure, or there are burn marks or stains suggesting overheating¹⁶. The fire and rescue services give the same message: check all appliances, plugs, sockets and leads for damage such as scorch marks or exposed wiring, always use the correct fuse, always buy approved chargers, and do not charge devices on flammable surfaces such as bedding¹⁷. If a charger or cable is damaged, replace it rather than taping it up.

Signs the infection has come back, and what to do

The signs of a return are much the same as the signs of the first infection. Watch for apps you did not install, a phone that runs hot or drains its battery faster than usual, pop-ups, or accounts behaving in ways you did not expect. On a phone, an app that reports the device has been rooted or jailbroken, when you have not done either yourself, is a good indication of hacking, though the NCSC is careful to say these are not a guarantee¹.

If the symptoms return, do not ignore them. On a phone or tablet, the safest solution to an infection is a factory reset, usually found in Settings¹. On a computer, update your device and programs, run your antivirus scan and follow its advice¹. Then work through this checklist again from the top.

Scam messages are a common way back in. The NCSC warns that official-sounding messages about resetting passwords, receiving compensation, scanning devices or missed deliveries are a sign to be suspicious, especially if you are urged to act immediately or within a limited timeframe¹⁸. Its advice on scam missed parcel texts is specific: do not click the link in the message and do not install any apps if prompted, forward the message to 7726, then delete it². If you have already installed something, do not log into any accounts, because the malware may steal those details, and perform a factory reset as soon as you can². Our guides to spotting a scam text and reporting a scam text message go further.

Where to get help and how to report it

Most households will not need to report a cleaned-up infection, but there are times when it helps.

• If a caller told you your device was infected and you paid them money, hang up and report the call to Report Fraud at www.reportfraud.police.uk, and also report it to your bank or credit card provider¹.
• If you received a scam text, forward it to 7726, then delete it².
• If an account has been accessed, the NCSC advises referring to its guidance on recovering a hacked account¹⁹. Our guide to what to do if an online account is hacked covers the same ground.
• If you are unsure whether a message is genuine, our guides to checking a message from your bank and spotting scam messages after a data breach help you check before you act.

The NCSC publishes guidance for individuals and families whose device has been infected⁶, and its wider advice for staying secure online is a good place to start if you want to go further²¹. For the bigger picture on how these incidents affect households, see our section on cyber attacks and major IT failures.