A device acting strangely—running slow, popping up ads, or behaving in ways you don't recognize—may be infected with malware. This guide helps you recognize the signs, handle a suspected infection safely, know when to call for professional help, and verify the device is truly clean afterward.
Common Malware Types
Ransomware
Encrypts your files and demands payment for the decryption key. Often spreads across shared drives.
Spyware
Secretly monitors activity, captures keystrokes, and steals credentials or sensitive data without obvious symptoms.
Trojans
Disguised as legitimate software; once installed, opens a backdoor for attackers to access your system.
Adware
Floods your device with unwanted ads and pop-ups; often bundled with free downloads.
Worms
Self-replicating malware that spreads across networks without needing user action, often causing widespread slowdowns.
Cryptojacking
Secretly uses your device's processing power to mine cryptocurrency, causing overheating and severe slowdowns.
Infection Indicators
What to Watch For
Symptoms Checklist
Safe Handling Procedures
Isolate Before You Investigate
- Disconnect from the network—unplug Ethernet or turn off WiFi—to stop malware from spreading or communicating with attackers
- Don't shut down immediately if you suspect ransomware or active data theft—this can destroy evidence needed for investigation
- Don't plug the infected device into other systems or shared drives
- Avoid using the device for anything sensitive (banking, email login) until it's confirmed clean
- Notify your IT/security team before attempting removal on a work device
Removal Steps (For Non-Critical, Confirmed Malware)
- Boot into Safe Mode (Windows) or Safe Boot (Mac) so malware processes don't fully load
- Run a full system scan with updated antivirus/anti-malware software
- Use a second reputable scanner (e.g., Malwarebytes) as a cross-check—no single tool catches everything
- Remove or quarantine anything flagged; review browser extensions and startup programs for anything unfamiliar
- Change passwords for accounts accessed on the device—from a different, clean device
- Update the OS and all software to patch the vulnerability that allowed infection
When to Call for Professional Help
- Ransomware or any sign files have been encrypted
- The device is used to access sensitive company data, financial systems, or customer records
- Multiple devices on the network show signs of infection simultaneously
- Antivirus can't remove the threat, or it keeps reappearing after removal
- You suspect data was stolen, not just that the device is infected
- The device is a server, or infection could affect shared/network resources
Antivirus Basics
- Use reputable antivirus/endpoint protection on every device—built-in options (Windows Defender, macOS XProtect) are a solid baseline
- Keep virus definitions updated automatically—outdated definitions miss new threats
- Schedule regular full-system scans, not just quick scans
- Never disable antivirus "to make something work faster"—if a legitimate program is being blocked, verify with IT before disabling protection
- Enable real-time protection, not just on-demand scanning
Post-Removal Verification
Confirm the Device Is Actually Clean
Real Incident Scenario
The Slow Computer That Wasn't Just Slow
- Report unusual slowness and antivirus being disabled to IT immediately, not after a week
- Disconnect the device from the network as soon as compromise was suspected
- Have IT investigate what disabled the antivirus—this is a classic cryptojacking/trojan behavior
- Check other devices on the same network for similar symptoms, since malware that disables security tools often spreads laterally