Got another one of those classic calls this week: client saying the computer "feels weird." Couldn't really explain what, just that it was slow, opening things on its own, and the browser turned into a mess of tabs she doesn't remember opening. I've heard this story a hundred times, and most of the time the diagnosis is the same: malware. The problem is "malware" has become too generic a word. People still picture viruses trashing files, some 2000s movie scene, but the reality today is a lot more subtle. Most infections I see don't want attention. They want to sit quietly, stealing data or borrowing your machine's processing power to mine crypto or send spam. So the first move is never opening an antivirus and mashing "scan." It's paying attention to the signs first. A computer that got slow out of nowhere, without you installing anything heavy, is already suspicious. Different from a slowdown that creeps in over months, which is usually just Windows piling up junk and startup programs. An infection tends to be more abrupt. Another classic sign is opening Task Manager and seeing a process with a weird name, or one that's almost but not quite a legitimate system process, eating 80% of the CPU while you're not doing anything. I always get suspicious of names trying to mimic system processes, like "scvhost.exe" instead of "svchost.exe." One swapped letter and most people never notice. The browser is usually where it gets obvious. Homepage changed on its own, a toolbar showed up that nobody installed, Google searches redirect through some sketchy site before landing on the actual result. That's almost always adware or a browser hijacker that hitched a ride on some free installer. Some people download a PDF converter from a shady site and never read the install screens, just click "next, next, next," and that's the door it walks through. Also worth checking if the antivirus got disabled without you touching it, or if Windows Defender just vanished from settings. More sophisticated malware makes a point of defending itself by shutting down whatever could detect it. And a fan working hard while the PC is basically idle is another sign that rarely lies, usually points to a crypto miner running in the background. Once I've gathered those signs I don't start removing anything yet. I confirm first. I open Task Manager and sort by CPU and network usage, because malware talking to an external server tends to show up there, sending or receiving data constantly even when I'm not using the internet for anything. I check recently installed programs, in the control panel or settings, looking for something I don't recognize that showed up out of nowhere. And I check browser extensions, because that's where a lot of today's adware lives, plenty of people don't even remember installing that "discount coupons" extension that's actually tracking every site they visit. Only after that do I run an actual scan, and here I'd rather not trust the antivirus that's already installed, because if it's been compromised or disabled by the malware itself, the result will come back clean even when it isn't. I usually run Malwarebytes as a second opinion, and for stubborn cases I bring in Windows Defender Offline, which runs outside the main operating system before it fully loads. That matters because some malware actively hides while Windows is running normally, but can't disguise itself the same way once the scan happens in that offline mode. If the scan catches something really dug in, like a rootkit, it's sometimes worth booting into Windows Safe Mode before trying to remove it. In Safe Mode only the essential system processes load, so the malware doesn't get a chance to reload itself while you're trying to delete it, which happens a lot when you try removing it with Windows running normally. And here's the moment that separates an experienced tech from a beginner: knowing when to stop trying to clean and just reinstall the system from scratch. I know it feels bad to admit, but past a certain point, especially with ransomware or well-established banking trojans, the time spent making sure you got everything just isn't worth it. Back up the personal files, do a clean reinstall, move on with your life. A fresh reinstall is basically a guarantee, while manual cleanup always leaves that nagging doubt: did some remnant survive somewhere I didn't check? Once the computer's clean, whether through manual removal or a reinstall, there's a step a lot of people skip that I consider just as important as the cleanup itself: changing passwords. Especially if there was any sign of a banking trojan or keylogger, because in that case it's pretty likely credentials got captured before you even noticed the infection. Email, banking, social media, anything accessed during the suspect period. And there's a question I always ask at the end, the most important one of all: how did this get in? Because cleaning without understanding the entry point is treating the symptom, not the cause. Sometimes it was an email attachment that looked like an invoice. Sometimes it was pirated software downloaded off a torrent, which honestly is one of the most common entry points I see, people download a crack for some expensive program and the crack comes with a bonus. Sometimes it was a third party's flash drive plugged in without a second thought. Without understanding this part, the person goes right back to the same habit and reinfects in two or three weeks, and there I go again to the same house to fix the same problem. There was a case a few months back where I cleaned a client's PC and told him flat out to stop downloading software from pirate sites. Three weeks later he called again, same symptoms, basically the same adware. I asked what had changed since last time and he admitted he'd downloaded "just one more" software activator. Sometimes prevention isn't about any tool at all, it's about habit. Beyond that, the basics still hold: keep the system updated, don't disable the antivirus thinking it's "slowing the PC down," and be suspicious of anything asking you to turn off a protection just to continue an installation. Malware rarely gets in through some magic security flaw, most of the time it's the person themselves opening the door without realizing it.