Recommended Free Tools
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
There is no single cleanup command for every router, television, camera, thermostat, or connected appliance. Identify the exact model, isolate it if doing so is safe, use the manufacturer’s or internet provider’s official update and recovery instructions, change exposed credentials, disable unnecessary access, and then verify the device. Restarting can clear some memory-only malware, but it is not a guaranteed cure. A router that is out of support or cannot use current Wi-Fi protections should usually be replaced.
What to do first
Treat a suspected infection as a security incident, not as a routine performance problem. The safest order is containment, identification, trusted updates, credential changes, configuration review, and verification. The exact menus and reset process differ by model, firmware edition, region, and internet provider.
1. Identify the device and its support channel
Write down the manufacturer, model number, hardware revision, firmware version, and the internet provider if the equipment was supplied by one. Find support documentation by typing the manufacturer’s address yourself or using a saved official app. Do not install firmware from an attachment, an unsolicited message, a pop-up, or a third-party download page.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →2. Prepare a device you trust
Use a computer or phone that appears clean to access support pages, change passwords, and administer the network. Update that device first. If you suspect that an account password was stolen, change it from the trusted device and enable two-factor authentication where the service offers it.
#1 Best Overall
3. Isolate without creating a safety problem
If the device is actively routing suspicious traffic, disconnect its network cable or turn off its Wi-Fi connection while you investigate. Do not unplug equipment that controls a medical, security, heating, access-control, or other safety-critical function unless you understand the consequences. A router can be isolated by disconnecting its internet/WAN cable while leaving power on for local administration, but follow the provider’s instructions for your service.
How do I know if my router has malware?
The FBI Internet Crime Complaint Center (IC3) listed overheating, connectivity problems, and administrator settings that change without explanation as commonly identified signs in a May 7, 2025 public service announcement. These are warning signals, not proof: a failing power supply, overloaded wireless channel, bad cable, ISP outage, or ordinary configuration error can look similar.
Inspect the administrator interface
- Review the administrator account list and remove accounts you did not create.
- Check DNS servers, WAN settings, port-forwarding rules, firewall rules, VPN profiles, and scheduled tasks for changes you cannot explain.
- Review the connected-device list for unfamiliar clients. Record device names and hardware addresses before removing anything; a guest’s phone or a smart appliance may be unfamiliar but legitimate.
- Look for remote-administration, cloud-management, WPS, and UPnP settings that are enabled without a current need.
If you cannot confidently distinguish a legitimate setting from a malicious one, save screenshots or export the configuration if the official manual permits it, then contact the ISP or manufacturer. Avoid repeatedly changing settings at random; that can destroy evidence and make recovery harder.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesRouter cleanup: a safe sequence
The following sequence reflects guidance from IC3, the Federal Trade Commission (FTC), and a joint FBI, Cyber National Mission Force, and National Security Agency advisory first issued September 18, 2024. Adapt each step to the exact router instructions.
Rank #2
- Disconnect suspicious internet access. Remove the WAN cable or use the provider’s documented isolation procedure. Keep a written note of the time and symptoms.
- Disable remote administration. In the router’s administration page, turn off management from the internet. Leave local management enabled only if you need it for recovery. Some provider-managed routers expose this control in the provider’s app instead of the web interface.
- Update firmware through the official channel. Use the router’s built-in update function, the ISP’s management system, or a firmware file obtained directly from the manufacturer. Confirm the model and hardware revision before applying it, and do not interrupt power during installation.
- Change the administrator password. Create a long, unique password that is not used for Wi-Fi or any other account. Delete unused administrator accounts. Store the new credential in a password manager or another secure location.
- Change the Wi-Fi credentials. Set a new network name if you want to invalidate old references, and use a unique Wi-Fi password. Changing the Wi-Fi password disconnects every client, so reconnect only devices you recognize.
- Use modern wireless security. Select WPA3 Personal when every important client supports it; otherwise use WPA2 Personal with a strong passphrase. Do not use open Wi-Fi or obsolete encryption.
- Turn off features you do not need. Disable WPS, UPnP, internet-facing port forwards, unused VPN servers, and other services unless a documented requirement exists. The FTC specifically advises turning off remote management, WPS, and UPnP when possible.
- Reboot after changes. A restart terminates running processes and may remove malware that exists only in memory. The joint advisory describes this limitation; a reboot does not prove that persistent malware, modified firmware, or a compromised account is gone.
- Reconnect and verify. Restore the WAN connection, confirm that the firmware version and settings remain correct, and reconnect clients gradually. Watch the administrator log and connected-device list for unexplained changes.
When a factory reset is appropriate
A factory reset erases configuration, but its effect depends on the model and infection. It may remove malicious settings while leaving vulnerable firmware unchanged; some devices can also restore settings from an infected backup. Use the manufacturer’s documented reset and reconfiguration procedure, and download the current firmware before resetting if the instructions require it.
After a reset, configure the router from scratch rather than importing an old configuration file unless the manufacturer confirms that the file is safe. Set the administrator password, Wi-Fi security, DNS, and firewall rules manually. If the router still changes settings, shows unknown accounts, or cannot install trusted firmware, stop using it as the gateway and contact the ISP or manufacturer.
Cleaning a smart TV
A smart TV is not cleaned with a normal computer antivirus utility. Its firmware, app store, and account system are controlled by the television manufacturer, so use model-specific support instructions.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Update the TV and its apps
- Open the TV’s settings and locate the software, system, or support section.
- Install the current firmware offered for the exact model and region.
- Open the television’s official app store and update installed apps.
- Update the phone app or account used to control the TV.
- Restart the TV after installation and check the software version again.
Remove access you do not use
- Change the TV’s default PIN or password and any account password that may have been exposed.
- Sign out of streaming and other accounts on the TV if you suspect unauthorized access, then sign in again only after updates.
- Delete unused applications. Fewer installed apps mean fewer components requiring updates.
- Disable remote-control, casting, microphone, camera, advertising, or tracking features that you do not need, using the TV’s privacy controls.
- Review permissions and connected devices in the manufacturer’s account portal.
The FTC’s smart-TV guidance recommends firmware and app updates, changing default credentials, disabling unused features, reviewing tracking settings, and removing unused apps. It does not publish one universal malware-reset procedure for every television.
Reset only with the model’s instructions
If suspicious behavior continues, look up the exact model’s official reset process. A reset may remove apps and local settings but can also delete network credentials, accessibility settings, parental controls, and downloaded content. Record information you need before starting, and do not interrupt a firmware recovery process.
Cameras, thermostats, speakers, and other connected appliances
For each device, identify whether the problem is in the device firmware, its phone application, or the cloud account that controls it. A camera may continue operating normally while its cloud account is compromised; a thermostat may have no local password but still depend on an exposed mobile account.
General procedure
- Disconnect the device from Wi-Fi or Ethernet if isolation will not create a safety issue.
- Update the device firmware and its controlling mobile app from official stores or the manufacturer’s documented channel.
- Change the device password, pairing code, or cloud-account password from a trusted phone or computer.
- Enable two-factor authentication on the account when available.
- Remove unknown users, shared access tokens, automation rules, and integrations.
- Disable remote viewing, voice control, cloud access, or other functions you do not use.
- Apply the model-specific reset or recovery procedure if the manufacturer recommends it.
- Reconnect the device to a separate guest or IoT network when your router supports that arrangement and the device does not need access to computers or storage on the main network.
Do not flash unofficial firmware unless you have the technical expertise and the manufacturer explicitly supports that recovery path. An incorrect image can permanently disable the device or remove safety controls.
Secure the network and accounts around the device
Cleaning one endpoint is not enough if the network password or cloud account remains exposed. The FTC recommends WPA3 Personal or WPA2 Personal encryption, unique administrator and Wi-Fi passwords, current router software, and disabling remote management, WPS, and UPnP when possible.
Rank #4
Change credentials from a clean device
- Change the router administrator password and Wi-Fi password separately.
- Change passwords for email, cloud, streaming, camera, and smart-home accounts that were used on the suspected device or shared the same password.
- Use a different, unique password for every important account.
- Enable two-factor authentication and review active sessions, recovery addresses, and trusted devices.
- Revoke app passwords, API keys, and integrations you do not recognize.
Segment less-trusted equipment
A guest network can separate visitors and some IoT devices from computers and storage on the main network. It is not a cure for compromised firmware, and implementation varies: certain appliances need local discovery or access to a home hub that a guest network blocks. Test each required function after moving a device.
Keep computer malware advice in scope
The FTC’s general malware-removal guidance covers running security-software scans and changing passwords on computers. A scan of a Windows or macOS computer can help determine whether that computer is infected, but it does not scan or clean router firmware, TV firmware, or an appliance. Run computer scans separately when those systems show symptoms, and do not present the scan as an IoT repair.
Will restarting the router remove malware?
Sometimes, but only in a narrow situation. The joint FBI, Cyber National Mission Force, and NSA advisory states that rebooting terminates running processes and may remove specific “fileless” malware that exists in host memory. Malware that persists in firmware, survives configuration restoration, or regains access through a stolen password will not necessarily be removed. A device-specific FBI advisory about an affected EdgeRouter explicitly warns that rebooting alone does not remove the persistent malware it describes; that incident should not be generalized to every consumer router.
When should you replace the device?
Age alone is not a diagnosis. Replacement becomes the responsible option when the device no longer receives security patches, cannot install current firmware, lacks WPA2 or WPA3, or offers no supported way to disable exposed management services and recover the exact model.
| Decision factor | Continued use may be reasonable | Replacement is safer |
|---|---|---|
| Vendor or ISP support | Current security updates are still published for the exact model and hardware revision. | The device is end of life, meaning active support and security patches have ended, or support status cannot be confirmed. |
| Wireless security | WPA3 Personal or WPA2 Personal is available and configurable. | The router cannot use WPA2 or WPA3 after updates. |
| Management controls | Remote administration, WPS, UPnP, and unused services can be disabled. | Exposed services cannot be disabled or the interface keeps re-enabling them. |
| Recovery | Official reset, firmware, and model-specific support instructions exist. | No trusted firmware or recovery method exists, or suspicious settings return after recovery. |
| Compatibility | The supported replacement or repaired device is confirmed compatible with the ISP and required home services. | Compatibility cannot be verified; ask the ISP before purchasing. |
IC3 recommends replacing end-of-life routers with updated models where possible. The FTC likewise advises considering replacement when an older router cannot provide WPA2 or WPA3. Neither source identifies a universal model or guarantees compatibility with a particular internet service.
How to verify that cleanup worked
Verification is a monitoring period, not a single test. After recovery:
- Confirm the firmware version against the manufacturer’s current listing.
- Check that administrator and Wi-Fi passwords are the new values.
- Review DNS, port forwards, firewall rules, remote management, WPS, UPnP, and connected devices.
- Reconnect clients one at a time and remove devices you cannot identify.
- Review cloud-account login history and revoke sessions you do not recognize.
- Watch for renewed overheating, unexplained outages, redirected websites, changed settings, or unknown traffic.
- Keep a record of firmware updates, resets, and support case numbers.
If suspicious behavior returns after a clean configuration and current firmware, disconnect the device and escalate to the manufacturer, ISP, or a qualified technician. Preserve logs and screenshots instead of repeatedly resetting the equipment.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteCommon mistakes and how to avoid them
- Assuming a reboot proves the device is clean: use it only as one step after updates and credential changes.
- Using a computer antivirus scan on embedded firmware: scan computers separately; follow the device maker’s recovery process for IoT equipment.
- Restoring an old configuration immediately: rebuild manually unless the vendor confirms the backup is safe.
- Changing only the Wi-Fi password: change the administrator password and exposed cloud-account credentials too.
- Installing a random firmware file: verify the model, hardware revision, region, checksum instructions, and official source.
- Leaving remote administration enabled for convenience: disable it unless a documented, controlled need remains.
- Replacing a device solely because of one symptom: first check support status, firmware, security capability, and recoverability.
- Resetting safety-critical equipment without a plan: consult the manufacturer or a qualified professional before disconnecting or resetting it.
Getting help
Contact the ISP for provider-managed routers, firmware that fails to install, unexplained DNS or WAN changes, or equipment that remains suspicious after the documented recovery process. Contact the device manufacturer for smart TVs and appliances, especially when the exact reset sequence is unclear or the device is still under support. Provide the model, firmware version, symptoms, dates, screenshots, and steps already completed. If accounts, payment information, cameras, locks, or other sensitive systems may have been accessed, secure those accounts from a clean device and consider reporting the incident through the appropriate service or law-enforcement channel.
Frequently Asked Questions
Can I keep using an infected IoT device while I wait for support?
Disconnect it or place it in the most isolated network segment available when doing so is safe. Do not use it for sensitive accounts, remote viewing, payments, or administration until the manufacturer or ISP provides a documented recovery path.
Should I change passwords before or after a factory reset?
Change important account passwords from a trusted device as soon as compromise is suspected. Change the device administrator and Wi-Fi credentials during the recovery sequence, then sign back into cloud services only after updates or a documented reset.
What information should I collect for technical support?
Record the exact model and hardware revision, firmware version, symptoms, dates, unfamiliar settings or devices, screenshots, and the updates, resets, and password changes you attempted.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
