Provider says a device is infected? What to do

Malware is harmful software that, as BT puts it, can damage your device, steal personal information or give criminals access. Virgin Media says it usually gets installed by accident, hidden in harmless-looking downloads such as torrents, apps or screensavers.

Malware can make a device part of a botnet: a network of remotely controlled, hijacked gadgets. ISPreview, the UK broadband news site, says they're used for attacks and spam, usually without any obvious sign. Its examples are older smartphones, laptops, Wi-Fi cameras, Android TV boxes and routers.

How a provider can tell

No provider page we found explains in detail how it spots infections. BT's Acceptable Use Policy says only that it might run network and computing systems to find and fix problems, for example if it thinks your device is vulnerable to malware. ISPreview's April 2026 report says major providers typically run traffic analysis and DNS monitoring (DNS is the internet's address book) that can often link a customer's traffic to a known botnet or infection; the signals are limited, but can be enough to warn the customer. So a warning may name the problem without saying which device it came from.

How common is it?

There's no official count of infected homes. A one-day Spamhaus snapshot for 4 March 2026, reported by ISPreview, put Virgin Media 6th (53,016 detections) and Sky 10th (39,248) in its table of internet providers. Spamhaus said it counts IP addresses showing signs of compromise; BT told ISPreview the data didn't match its own insights. Treat it as a sign this is routine on big networks, not a measure of any provider.

Virgin Media publishes the alert names it uses, a handy shortcut to which gadget to check first (from its malware help page, October 2026):

A NAS (network-attached storage) drive is a box that stores files on your home network so several devices can reach them. A Trojan is malware disguised as something you'd want to install.

For Network Attacks, Virgin Media says the traffic breaks its Acceptable Use Policy and, if the abuse continues, it might have to suspend or cancel your broadband. BT's malware page doesn't list alert names, so if a BT letter doesn't say what was detected, ask.

No provider page we found shows what a genuine malware letter or email looks like, so don't judge one by its logo or wording: check it independently.

• Don't use anything in the message. BT says don't click links, open attachments or reply to suspicious emails, and warns that even real-looking emails may be spoofed (faked to appear to come from a trusted sender).
• Go to the provider yourself. The NCSC says use contact details from the organisation's official website, not the message. Sign in through its app or a web address you type, or ring the number on its website, and ask whether a security alert is on your line.
• Watch for pressure. The NCSC lists a short deadline and language designed to cause panic or fear as tell-tale signs of a scam.
• Be wary of messages that borrow real news. A genuine security story about your provider, such as a reported data breach, is exactly what scammers copy. Our guide on what to do after a broadband provider data breach covers checking that kind of notice too.
• Never give remote access. The NCSC says a call claiming your device is infected and offering to fix it is a common scam, often posing as Microsoft or your internet provider: hang up.

Fake? Forward BT-branded emails as an attachment to phishing@bt.com, others to report@phishing.gov.uk, and texts to 7726. Our guide to spotting and reporting broadband scams has the full reporting routes.

Don't miss the real thing

Virgin Media sends alerts by letter or email; BT says its team may write by letter. Virgin Media asks you to keep your email up to date in My Virgin Media (My Profile), and its usage policy recommends checking your mailbox at least every three days, as it normally warns before suspending or disconnecting. If you've stopped reading an old provider address, fix that now.

Start with a list of everything connected, from your provider's app or router settings page:

• BT: Hub Manager opens at 192.168.1.254 or http://bthomehub.home. BT's business help pages describe a My Devices tile in Smart Hub Hub Manager that shows each connected device's name, connection, MAC address (its hardware identifier), IP address and data usage; your home Hub Manager may look a little different.
• Virgin Media: the Virgin Media Connect app (Hub 3, 4 or 5) shows all your connected devices and can pause Wi-Fi to individual ones. Virgin Media says to be connected to your Virgin Media Wi-Fi to make the most of its features.

Our guide on how to see what's using your broadband explains these screens for other providers too.

Then narrow it down:

1. Use the alert type from the table above, if you have one.
2. Think about forgotten gadgets: an old phone still on the Wi-Fi, a camera, a streaming box, a smart plug, a NAS drive or the router itself.
3. Look for signs on computers. The NCSC lists running slowly, rebooting by itself, programs opening or closing unexpectedly, unrecognised pop-ups and contacts getting odd emails from you. ISPreview adds unusually high processor, fan or router activity at normally quiet times.
4. Unplug anything you can't identify or no longer use.

Botnet devices usually show no obvious sign, so work through every device rather than stopping at the first suspect.

The NCSC breaks recovery into three stages: confirm the device is infected, try to fix it, then secure it afterwards. How you do that depends on the kind of device.

• Change passwords from a clean device. Virgin Media says change the passwords for all your online and email accounts, using different strong passwords, because stolen passwords are likely to be tried on as many services as possible.
• Check your email settings. If you still use Virgin Media Mail, Virgin Media advises checking its Auto Forward rules and deleting any forwarding address you don't recognise. Its email service is moving to Junara, and it says forwarding set up in Virgin Media Mail won't work once a mailbox moves. The NCSC gives the same advice for any hacked account: look at filters and forwarding rules. Our guide on what to do if your provider email account is hacked goes through the rest.
• If money is involved, act fast. BT says that if a scammer has your bank details or has had remote access to your computer, call your bank right away. Report money lost to Report Fraud (reportfraud.police.uk or 0300 123 2040) in England, Wales and Northern Ireland, or Police Scotland on 101, as the NCSC directs.

ISPreview says spam-sending botnets favour email port 25, one reason providers often block it. If your email program stops sending, see why email won't send on home broadband.

A summary of the two providers' consumer Acceptable Use Policies, checked in October 2026:

Don't count on a grace period. Virgin Media says it normally warns before suspending, but keeps the right to act without notice over botnet activity, and BT will suspend an offending device as soon as it has told you about it. We couldn't find Sky help or policy wording on infected-device alerts, so Sky customers should ask Sky directly.

We found no provider page saying alerts close automatically once the traffic stops, so contact your provider through its official channels and note the date and who you spoke to. Have ready:

• the alert or letter, and any reference it gave;
• which device you think was infected and what you did (scanned, reset, reinstalled, removed or replaced);
• what you've changed on the router (new admin password, firmware updated, Telnet, UPnP or port forwarding switched off).

Questions worth asking:

• "What exactly did you detect, and when did you last see it?"
• "Is my service restricted in any way right now?"
• "Do you need anything from me in writing?"

If another warning arrives, go back through the device list and the router settings.

• Keep updates switched on. Virgin Media recommends automatic updates where offered; BT asks you to keep the operating system and antivirus up to date.
• Back up important files and check devices are encrypted, as the NCSC suggests.
• Use the security your provider includes. Virgin Media says Essential Security is switched on by default at no extra cost. BT says Cyber Threat Protect is included as standard with its broadband, and that Web Threat Protect is built into its hubs. Sky says Sky Broadband Shield is free to all Sky broadband customers and guards against virus, phishing and malware sites. ISPreview cautions that network-level security won't stop everything.

To see current packages, go to the BT broadband deals, Virgin Media broadband deals and Sky broadband deals pages, or the broadband providers hub, and check each provider's own site for its security extras. You can also compare broadband deals at your postcode. A malware warning isn't a reason to switch on its own, though: the same infected gadget would follow you to any network.