There is no universal cleanup button for a router, smart TV, camera, thermostat, or other connected appliance. Identify the exact model, contain it if that is safe, follow the manufacturer’s or ISP’s recovery instructions, install current firmware, replace exposed credentials, and disable services you do not use. Restarting can stop some memory-only malware, but it is not proof that an infection is gone. A router that is past end of support or cannot use current security protections should generally be replaced.
What “malware on an IoT device” can mean
IoT malware is malicious software running on an internet-connected device or its embedded firmware. It may alter router settings, redirect traffic, join a botnet, expose camera feeds, create unwanted accounts, or abuse the device to attack other systems. The remediation method depends on the device, operating system, firmware, infection, and the manufacturer’s recovery design.
As an Amazon Associate I earn from qualifying purchases.
Routers deserve particular attention because every device on the home network may rely on them for DNS, Wi-Fi authentication, and internet access. A compromised router can therefore affect phones and computers even when those devices appear normal. A television, camera, speaker, thermostat, or appliance usually has a narrower impact, but it can still expose accounts, recordings, location data, or other personal information.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Symptoms are clues, not a diagnosis
The FBI Internet Crime Complaint Center (IC3) said in a May 7, 2025 public service announcement that commonly identified router-malware signs include overheating, connectivity problems, and settings the administrator does not recognize. None of those symptoms proves malware: a failing power adapter, interference, an ISP outage, a firmware bug, or a misconfigured setting can look similar.
#1 Best Overall
Investigate by checking the router’s administrator interface for unfamiliar DNS servers, port-forwarding rules, administrator accounts, remote-access settings, Wi-Fi names, and connected devices. On a TV or appliance, look for apps you did not install, unexpected accounts, unexplained network traffic, changed privacy settings, or a device that continues to behave strangely after legitimate updates. If you cannot tell whether a setting is expected, ask the manufacturer or ISP rather than guessing.
Before cleanup: contain the device safely
Containment limits what a suspected device can do while you investigate. Do not disconnect equipment if doing so could create a safety problem, disable a medical or security function, or interrupt a process that must remain online.
- Identify the exact device. Record the manufacturer, model number, hardware revision, serial number, firmware version, ISP, and the date you noticed the problem. These details determine which recovery instructions apply.
- Isolate when practical. For a TV, camera, speaker, or appliance, unplug its Ethernet cable or turn off its Wi-Fi connection through the official settings. For a router suspected of acting as a gateway, unplug the internet/WAN connection if you can do so safely, or ask the ISP how to place the service in a safe temporary state. Keep a separate, trusted device available for contacting support.
- Do not trust unexpected update messages. Install firmware only through the device’s built-in updater, the manufacturer’s official support portal, or your ISP’s documented process. Do not open update attachments or links sent in unsolicited messages.
- Use a device believed to be clean for account changes. If a router or IoT device may have exposed credentials, do not change those passwords from the suspected device itself.
How to remove malware from a router
Router menus differ by model and ISP. Use the labels in the official manual even when they differ from the examples below.
1. Preserve evidence and inspect the configuration
Photograph or export important settings before changing them, but do not automatically restore a saved configuration later. A backup can contain the malicious setting you are trying to remove. In the local router interface, review:
- Administrator accounts and recovery email addresses.
- WAN and DNS settings.
- Port forwarding, virtual servers, firewall rules, and exposed services.
- Remote administration or “management from the internet.”
- UPnP mappings and WPS status.
- Wi-Fi network names, encryption mode, and connected-device lists.
Record unfamiliar entries and contact the ISP or manufacturer if you cannot determine whether they are legitimate. Do not delete a setting whose purpose you do not understand if doing so could interrupt a safety, accessibility, or ISP service.
2. Update the router through a trusted channel
Open the router’s Firmware Update, System Update, or similarly named page, or use the ISP’s documented update mechanism. Confirm that the download is for the exact hardware revision. Leave the router powered during the update and wait for it to finish; interrupting power can make the device unusable.
Rank #2
If no update is offered, check the manufacturer’s support page for an end-of-support notice and verify with the ISP whether it controls the firmware. Do not install unofficial firmware merely because it has a newer version number unless you understand the model-specific risks and the manufacturer explicitly supports that procedure.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →3. Change both router passwords
A router has at least two separate secrets: the administrator password that controls settings and the Wi-Fi password that authenticates devices. Change both to long, unique values. Changing the Wi-Fi password alone does not remove an attacker who can still sign in to the administrator interface, and changing only the administrator password leaves previously shared Wi-Fi credentials in circulation.
After changing the Wi-Fi password, reconnect only devices you recognize. Remove unknown clients from the connected-device list where the router supports that action. Also change passwords for email, cloud, camera, streaming, or other accounts that may have been exposed, and enable two-factor authentication where available.
4. Disable unnecessary exposure
In the router’s administration pages, turn off remote management from the internet unless you have a specific, documented need for it. Disable WPS and UPnP when the official instructions allow it and you do not rely on them. Remove unused port forwards and services. Keep the router’s firewall enabled unless the ISP directs otherwise for a documented configuration.
Use WPA3 Personal when all important clients support it; otherwise use WPA2 Personal. Do not use an open network or obsolete encryption. A guest network can separate visitors and untrusted devices from computers, storage, and other systems on the main network.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minute5. Restart as a limited remediation step
Once the firmware and credentials are updated, restart using the router’s normal reboot control or the manufacturer’s documented procedure. The FBI, Cyber National Mission Force, and NSA stated in a joint advisory first issued September 18, 2024: “Rebooting a device terminates all running processes, which may remove specific types of malware, such as ‘fileless’ malware that runs in the host’s memory.” That describes a limited effect, not a guarantee of cleanup.
A device-specific FBI advisory about an affected EdgeRouter warned that rebooting did not remove the persistent malware in that incident. Do not copy that incident’s commands to a different router. If suspicious settings return after a reboot and update, stop using the device as your gateway and obtain model-specific support.
6. Reset only with an official procedure
A factory reset erases configuration and can remove some malicious changes, but it is not automatically a firmware reinstallation and is not guaranteed to remove every persistent infection. Use the exact reset and recovery instructions for the model. Before resetting, confirm that you have the ISP connection details and a way to download the correct firmware and manual.
After the reset completes, install current firmware before reconnecting other devices, set a new administrator password, configure WPA2 or WPA3, create a new Wi-Fi password, disable remote management/WPS/UPnP where appropriate, and review the configuration again. Do not restore an old configuration file unless the manufacturer or ISP confirms it is safe.
How to clean a smart TV, camera, thermostat, or appliance
Most embedded devices cannot be scanned by a computer antivirus program in the way a Windows or macOS computer can. A computer security scan may be appropriate for the computer itself, but it does not prove that another device’s firmware is clean.
Use the model-specific update path
- Open the device’s Settings, then look for Support, System, About, or Software Update. Menu names and locations vary by model and region.
- Install the newest firmware offered by the manufacturer or service provider. Update the controlling phone or tablet app from its normal app store as well.
- Check the model’s support page for security notices, recovery instructions, and whether the device remains supported.
- Restart only after the update has completed and the device reports success.
Remove access an attacker could reuse
Change the device’s default password and any cloud-account password associated with it. Use a clean phone or computer for the change. Sign out unknown sessions, remove unrecognized users, and enable two-factor authentication when offered. Disable remote viewing, remote control, voice features, file sharing, or other network services you do not need.
Review apps and privacy settings on smart TVs
Delete unused TV apps and remove apps you do not recognize. Review advertising, tracking, microphone, camera, and voice-assistant settings; turn off data collection or sensors that are not needed for the way you use the TV. These steps reduce exposure but are not a substitute for current firmware or the manufacturer’s recovery process.
Rank #4
Reset only when the documentation supports it
If the device remains suspicious, follow the official factory-reset or recovery instructions. A reset may erase accounts, downloaded apps, recordings, calibration, and network settings. Write down information you need before resetting, and reinstall apps only from the normal store after the device is updated. If the manufacturer provides no supported reset or firmware recovery for a device that appears compromised, disconnect it and seek support rather than experimenting with random files or commands.
Free tools Windows power users keep installed
One-click scans. No signup required.
Secure the rest of the network and accounts
Remediating one device does not undo credentials that may already have been exposed. From a device believed to be clean:
- Change passwords for the router, Wi-Fi, device accounts, email, cloud storage, cameras, and other services that shared credentials or were accessible through the device.
- Use a different unique password for every important account and enable two-factor authentication where available.
- Review account sign-in history, active sessions, recovery addresses, forwarding rules, and newly created users. Revoke sessions you do not recognize.
- Reconnect devices one at a time after the router is updated. Check the router’s client list so an unfamiliar device is easier to identify.
- Keep computers and phones updated as well. If a computer shows pop-ups, unauthorized changes, or other malware symptoms, use reputable computer security software and follow computer-specific removal guidance; that scan does not clean IoT firmware.
Will restarting the router remove malware?
Sometimes it removes malware that exists only in volatile memory by terminating running processes. It does not reliably remove persistent firmware, altered settings, unauthorized accounts, or malicious files stored on the device. Restarting should therefore follow containment, trusted updates, password changes, and removal of unnecessary services—not replace them.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.When to keep using a device and when to replace it
Age alone does not prove that a device is unsafe. The decision should be based on support and security capability.
| Question | Continued use may be reasonable when… | Replacement is the safer choice when… |
|---|---|---|
| Security updates | The manufacturer or ISP still supplies firmware and publishes a supported recovery process. | The device is end of life, receives no security patches, or support cannot confirm a clean recovery path. |
| Wi-Fi protection | The router supports WPA3 Personal or WPA2 Personal after updating. | It cannot use WPA2 or WPA3, or it requires obsolete open or weak encryption. |
| Exposure controls | Remote management, WPS, UPnP, and unused services can be disabled as needed. | Exposed services cannot be disabled or settings repeatedly return after remediation. |
| Recovery support | Official reset and firmware-recovery instructions exist for the exact model. | No supported recovery exists, or the device remains suspicious after following it. |
| Compatibility | The ISP confirms that the updated configuration is supported. | The replacement decision can be made only after checking ISP compatibility, required connection type, and any voice or television service dependencies. |
IC3 defines an end-of-life device as one that is no longer actively supported and no longer receives software updates or security patches, and recommends replacing end-of-life routers where possible. The Federal Trade Commission likewise advises updating older routers and considering replacement when WPA2 or WPA3 is unavailable. Replacement is a security decision, not a recommendation for a particular brand or model.
Troubleshooting common outcomes
The suspicious setting comes back
Disconnect the router from the internet, change the administrator password from a clean device, verify the firmware source and hardware revision, and contact the ISP or manufacturer. Repeated changes can indicate persistent malware, an untrusted backup being restored, or another administrator account.
The router still overheats or drops connections
Check ventilation, power equipment, cabling, and ISP outage information. If those explanations do not fit and the problem began with unexplained configuration changes, keep the router offline while support investigates. Overheating and connectivity problems are warning signs, not a diagnosis by themselves.
No firmware update is available
Confirm the exact model and hardware revision, then ask the manufacturer or ISP whether the device is still supported. If it is end of life or cannot meet current encryption requirements, replace it instead of relying on repeated resets.
The TV or appliance cannot be updated
Check whether the service requires a particular region, account, storage device, or minimum firmware version. Do not download firmware from an unofficial forum or install a file for a similar model. If official support cannot provide a recovery path, disconnect the device from the network and evaluate replacement.
The ISP or a service provider reports suspicious traffic
Ask which device, timestamp, destination, and traffic pattern were observed. Preserve that information, isolate the named device, and follow the provider’s incident instructions. Change credentials from a clean device and do not reconnect the equipment until the provider or manufacturer confirms the next step.
Prevention checklist
- Enable automatic updates when the manufacturer supports them, then periodically verify that updates are actually installing.
- Use unique administrator and Wi-Fi passwords; never leave factory credentials in place.
- Prefer WPA3 Personal, or WPA2 Personal when WPA3 is not supported.
- Turn off remote administration, WPS, UPnP, and other services you do not use.
- Place visitors and less-trusted devices on a guest network when practical.
- Remove unused TV apps and disable unneeded microphones, cameras, voice control, and remote-access features.
- Keep a list of device models, firmware versions, support pages, and ISP requirements so an emergency reset does not become guesswork.
- Replace equipment when it reaches end of support or cannot receive current security protections.
When to get professional help
Contact the manufacturer or ISP when you cannot identify a setting, cannot verify the firmware, the device is managed by the provider, the infection may involve a business or security system, or suspicious behavior persists after the documented update and reset process. A professional can confirm whether a device is supported, preserve relevant logs, and determine whether replacement is required. If accounts, payment data, recordings, or other sensitive information may have been exposed, secure those accounts and follow the provider’s incident-reporting process as well.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
