The students at Justus Liebig University (JLU) Giessen have been asked to provide proof of identity in person because of “legal requirements”.
The attack, on 8 December, initially took the entire university offline.
It told students it was investigating the incident with the help of Germany’s Research Centre for Cyber Security.
“All employees and students have to collect their new personal password personally,” the university said in a statement.
Students have been asked to bring an ID card to the university’s gym at an allotted time determined by their birth date.
According to the published schedule, it will take a full five days to process all students.
Meanwhile, the university has made 1,200 USB sticks available to staff so computers can be scanned for viruses.
“They are talking about two waves of virus-checking, so they clearly are quite unsure of what has happened,” said Prof Alan Woodward, at the University of Surrey.