Password-protected archive: this stops antivirus from scanning the contents during download.
If someone already installed it then they should disconnect from the internet, move funds to a new wallet from a clean device, revoke exchange API keys, change passwords and 2FA, and wipe or reinstall the device.