For malware, I just make sure I clean my cookies and cache every so often as they like to put to those there. Most of the time it's just to gather your browsing history.
I'd just like to point out that the concept described here is as misleading as it gets.
Cookies are tiny pieces of text that web servers (the things that websites run on) ask you to store and send on your next request (next click, basically). They can include session tokens ("I'm John Doe, I gave you my password and you told me to show you this:
c7b6d32c on my next visit") or personal preferences that the website doesn't deem important enough to store in their own database ("I prefer the white+blue color scheme and I want the sidebar hidden by default") and other stuff like that.
Whatever is written in a cookie is never
executed, i.e. it's not code or instructions to be interpreted or fed to the CPU. You could write the equivalent of "delete all files" in any programming language or directly in machine code into a cookie and nothing would happen.
Cookies exist because the protocol we use to browse the web (HTTP or HTTPS) is
stateless, which means that every click and every new page visited starts on a clean slate, there's no persistent connection between you and the website. It's always a request (click) and a response (new page shown), goodbye. It's never a longer conversation and neither the server nor your computer can refer to "the thing I said three minutes ago". With cookies, the exchange is now:
Browser: "Hi, I'd like to see the article "The Golden Age of Ballooning" and this is my cookie."
Server: "Okay, here's your article, and put this in your cookie."
And so a simple one-sided conversation can go on with the "state" frozen in time and stored in a cookie.
So that's what cookies are, harmless little text files. The only thing even remotely dangerous about them is that if someone manages to "steal" your cookie (e.g. intercepts it somewhere on the way from your computer to the web server), they can start impersonating you and making request in your name. And because the cookie is the only thing that encapsulates the whole "state" of your dealings with the server, the server has no idea it's not you anymore.
But with HTTPS and encrypted cookies and other security mechanisms, this is something that the user shouldn't worry about anymore, because if a new vulnerability appears, it will be deep inside the browser technology stack or deep inside the server stack, way out of the realm of simple precautions like "cleaning my cookies every couple of days".