Your IT person will tell you that running AV etc within the scope of the the machine itself is no guarantee of a clean machine.
If I come across a known infected machine I boot from a special disc that has all the cleaning tools I am likely to need. That disc is also write protected to prevent back infection.
Yes that's how pros do it !
Even a copy of "Hirens" or similar would suffice.
Failing that there is another method that involves using ONLINE security software that cannot be tampered with.
But as least we know it was NOT Arduinos fault in any way whatsoever !