---
title: What to do the moment you suspect malware
description: "The first hour after 'something is wrong with this computer': what to do, what not to touch, and how to tell an infection from a slow PC."
date: 2026-08-14
updated: 2026-08-30
tags: [how-to, security, windows]
url: "https://joshdargie.com/blog/suspect-malware-first-steps"
author: Josh Dargie
---

This one is about the first hour. Not the deep cleanup, the first hour: the window where what you do (and what you refrain from doing) decides whether this is an afternoon's annoyance or a genuinely bad week. It applies to a home PC and to the front-desk computer at a small business alike.

I clean up infected machines regularly, and the damage I see usually is not from the malware itself. It is from what someone did in a panic after they noticed it.

## First, is it actually malware?

A slow computer is usually just a slow computer. Genuine warning signs are more specific: browser search results going somewhere strange, security software that has turned itself off and will not turn back on, pop-ups appearing outside the browser, new toolbars or extensions you did not install, contacts receiving emails you did not send, or a full-screen warning demanding payment.

One thing to settle immediately: any screen that says your files are encrypted, or any webpage with a phone number urging you to call "Microsoft support", changes the playbook. Ransomware means stop entirely and get help now. And the phone-number warning is itself the scam; nothing legitimate ever asks you to call a number from a pop-up.

## Do these things, in this order

**Disconnect the network.** Toggle Wi-Fi off or pull the cable. Malware that cannot phone home cannot exfiltrate your files, pull down more payloads, or spread to the NAS and the other machines in the office. This is the single highest-value move and it costs nothing.

**Leave the machine on.** Instinct says shut it down. Resist it. Some infections only live in memory, and evidence of what happened can vanish with the power. There is no harm in a disconnected machine sitting there while you think.

**Change your important passwords, from a different device.** Assume anything typed on the suspect machine lately was captured. From your phone or a clean computer, change email first (it is the reset key to everything else), then banking, then anything work-related. Turn on two-factor authentication where it is offered, while you are in there.

**Write down what you saw.** The exact wording of the warning, what you clicked, what you downloaded, when it started. Thirty seconds of notes makes the eventual cleanup faster and more certain, whoever does it.

**Warn the humans around you.** At a business, tell staff not to open anything odd from that machine's accounts. At home, tell the family the computer is off limits until it is cleared.

## Do not do these things

Do not pay anything, obviously. Do not install three different "cleaner" tools from the first search results; a good portion of those are the disease wearing a doctor's coat. Do not keep using the machine for banking "just this once". And do not plug in a USB stick to rescue files and then move that stick to another computer; that is how infections commute.

## The standard cleanup, briefly

For a garden-variety infection on a home PC: from the disconnected machine, run a full scan with the built-in Windows Security (Microsoft Defender), including the offline scan option, which reboots into a clean environment to catch things that hide while Windows runs. Remove browser extensions you do not recognize and reset browser settings. Check the installed-programs list for anything recent you did not choose. Then, and only then, reconnect and let it update.

That handles a real share of cases. The honest caveat: a scan coming back clean is not proof of a clean machine, it is one tool's opinion. When the machine held anything that matters (business finances, client records, tax files) the professional answer is often a wipe and rebuild, because certainty beats hope. Knowing which cases deserve which treatment, and proving a machine is clean rather than assuming it, is exactly the judgment part of this work.

## Where it gets harder

More than one machine acting strangely, a business where the infected PC touches payments or payroll, anything involving an encryption notice, or an infection that keeps coming back after cleanup: those are past the blog-post stage, and speed matters in every one of them. If you are staring at one of those situations, [get in touch](/contact) and I will point you in the right direction, even if that direction is not me.