The main categories of malware
Different categories pursue different goals, so their symptoms and the right response differ too. Identifying the type is the first step towards handling it properly.
- Trojans: disguised as legitimate software while opening a backdoor for remote control
- Spyware: quietly collects keystrokes, browsing history and credentials
- Ransomware: encrypts files and demands payment, often alongside a data leak threat
- Rootkits: conceal themselves and other malware, and resist conventional detection
- Adware: injects advertising and hijacks browser search settings
- Fileless malware: leaves no file on disk, abusing built-in system tools in memory instead
- Botnet clients: turn a device into a node the attacker can direct at other targets
How infections usually start
Phishing email and SMS remain the primary entry point. An attachment may be a macro-enabled document, an archive disguised as an invoice, or a shortened link to a counterfeit login page. Messages written in fluent Traditional Chinese and imitating local couriers and banks are considerably harder to spot than they used to be.
Next come the software supply chain and unpatched vulnerabilities. Cracked software, installers from third-party download sites, and internet-facing services left un-updated can all let an attacker execute code with no user interaction at all. Removable storage and shared folders are then the usual vehicles for spreading laterally inside a network.
Possible warning signs
Unexplained slowdowns, fans running hard for long periods, a changed browser homepage or search engine, extensions or programs you never installed, and antivirus software that has been disabled and will not re-enable are all worth taking seriously. Sustained network traffic while the machine is idle is another common indicator.
It is important to remember that well-written spyware and rootkits may produce no visible symptoms at all. “The computer seems fine” is not evidence of safety, which is why real-time protection and periodic checks still matter.
A sound removal procedure
First, isolate: disconnect from the network so data cannot continue leaving and the infection cannot reach other machines on the same segment. Second, in a business setting, resist the urge to reimage immediately — confirm the logs and the timeline first so the scope of the intrusion can be established.
Third, run a full scan with fully updated protection, using a rescue boot environment if necessary so the malware cannot defend itself while the system is running. Fourth, once you believe it is clean, change every important password from a separate known-good device and review login history. If a rootkit is involved, or you cannot be confident the removal was complete, reinstalling the operating system remains the dependable option.
Prevention that can be sustained
Keep systems and applications on automatic updates, obtain software only through official channels, work day to day as a standard user rather than an administrator, and treat any message demanding immediate action with suspicion. These habits often prevent more than any single product does.
At an organisational level, network segmentation limits how far an infection can spread, least-privilege access limits the damage from one compromised account, and regularly verified backups guarantee a way out in the worst case. For the specifics of encryption-based attacks, see the ransomware protection guidance.