What Is Malware? Types of Malware and How to Protect Yourself

What is malware? Malware, or malicious software, is software with bad intentions, built to cause harm to you or your business through your computer or phone. Once installed, it starts its sneaky work, whether that is stealing your passwords, locking your files or using your device to infect others.

The first malicious programs appeared in the 1980s. Compared with today's malware they were simpler and relatively easier to detect, and the hackers' goal back then was mainly to damage the software or files on the computer. Some wanted to cause damage for fun, while others targeted specific companies or organisations, but their software ended up harming many more.

Today the goal is mainly money, and the numbers show it. From the complaints it received alone, the FBI recorded 20.9 billion dollars in cybercrime losses for 2025, according to the IC3 annual report. In this article we look at the types of malware, how to tell if you are infected, how to remove it from your computer and phone, which antivirus to choose, why Linux Mint is the most secure alternative to Windows, and 10 smart ways to protect yourself.

Types of malware

The types of malware you are most likely to come across are the virus, the worm, the Trojan, the rootkit, spyware, adware and ransomware. In the 1980s the vast majority were viruses and worms, but as technology evolved, malware evolved with it and new types appeared. Many modern threats are also hybrids, combining the functions of several categories.

Virus

A virus is code that attaches itself to a file or program and infects the computer when the user "runs" it. It took its name from biological viruses because it works in a similar way. When a biological virus infects a person, it attaches itself to the host and spreads through them to others. In the same way, a computer virus slows the computer down, destroys files and tries to spread to other computers.

A person recovers because they have an immune system. A computer's immune system is its antivirus, and if the antivirus does not do its job, the virus will destroy the "cells of the computer", meaning its files. Viruses travel inside an infected file, an infected website or an infected email.

Removing a virus is a delicate matter. The antivirus may find it or it may not, and if it does find it, it may remove it completely or leave a small piece behind from which it will replicate again. So if the problems come back a while after removal, the safest solution is a format, meaning a clean reinstall of the operating system, which is also what the UK's NCSC recommends when antivirus cannot clean the device.

Worm

A worm is malware that replicates itself and spreads on its own, without you having to run it. Once installed, it multiplies quickly and tries to reach other computers, starting with those on the local network and the people you communicate with. Its main goal is to spread silently to as many computers as possible, so it uses every method it can.

Spreading through email. The most common method, and the one that affects you directly, is sending emails to the addresses it finds stored on your computer. Apart from spreading the worm, this can seriously damage the image and reputation of your business, because if spam or a virus reaches your customers from your address, it will certainly leave a bad impression. To prevent it you need an outgoing antispam filter, which checks every email before it leaves your account. Konet's Semi Dedicated Hosting plans include the SpamExperts filter for both incoming and outgoing email.

Spreading through the local network. In many businesses and homes, computers are connected to a local network, and that is fertile ground for a worm. The best-known example is WannaCry, which in May 2017 spread around the world through a Windows security flaw, on computers that had not installed the update Microsoft had already released.

Spreading through file sharing. Many businesses (wisely) keep their files on a local NAS or file server for more security and control. But they (wrongly) neglect to protect it with a firewall and updates, so the worm reaches the shared storage and from there every computer that connects to it.

Trojan

The Trojan took its name from the Trojan Horse that we Greeks used at Troy. Just as the Trojan Horse was presented as a harmless gift, a Trojan presents itself as a harmless program, for example a free tool, a "cracked" program or an attachment that looks like an invoice. Nothing during installation suggests it is unsafe, and because you install it yourself, it often goes unnoticed.

Once installed, it hides in the system and gives the hacker remote control, essentially making them the administrator of your computer. Through that control the hacker gains access to your valuable data or downloads more malware. Trojans are usually hybrids, which means a Trojan can work as spyware and adware at the same time, or open the door to ransomware.

If a system is infected by a Trojan, removing it with antimalware is not enough to be sure, because it may already have downloaded other components. The right solution is a format and changing all your passwords from a clean device.

Rootkits and firmware infections

A rootkit is malware that hides deep in the system so that neither the operating system nor the antivirus can see it. Its most dangerous form lives in the motherboard firmware (UEFI), like LoJax, discovered by ESET in 2018, which survives even a format and a disk replacement.

Attacks like this are rare and targeted. But if an infection keeps coming back even after a clean format, you need a firmware reflash from the manufacturer or a new motherboard. Secure Boot makes these attacks much harder, so check that it is enabled in your computer's settings.

Spyware and infostealers

Spyware is the hackers' favourite software, because it lets them watch everything you do on your computer. Once installed, it starts sending data to the hacker, most often usernames, passwords and emails. Its most widespread form today is the infostealer, which within minutes steals the passwords saved in your browser and your card details. For example, Microsoft identified more than 394,000 Windows computers infected by a single infostealer, Lumma, within two months of 2025, malware that steals passwords, cards, bank accounts and cryptocurrency wallets.

With your passwords, hackers get into all your accounts, and they especially target bank accounts. Because they log in with your own credentials, in a "normal" way, they may not trigger the bank's security systems. That shows how important a strong password is, together with two-step verification.

Do not save your bank and email passwords in your browser, because it is the first place infostealers look. Keep them in a separate password manager or on paper in a safe place, and turn on two-step verification everywhere it is available.

Email fraud with a changed bank account

Another frequent target is business email, because business communication often involves moving money. Either with spyware or with a password stolen through phishing, hackers get into your email and watch your communication with suppliers and customers. As soon as the business is ready to receive or send money, they act. How to spot email scams is covered in a separate guide.

Without you noticing, they contact the customer or supplier and ask them to pay into a different bank account. They often claim the bank account changed recently, or that the payment should go to a supposed partner of yours, and the accounts they give are often abroad. The recipient cannot tell from the email that it did not come from you, because the hackers use your writing style and your signature.

This fraud is called Business Email Compromise (BEC) and it is one of the most profitable for hackers. According to the FBI report for 2025, it received 24,768 BEC complaints in a single year, with losses of more than 3 billion dollars. To protect yourself:

• Confirm every bank account change by phone, on a number you already know and not the one in the email.
• Turn on two-step verification for your email.
• Set up SPF, DKIM and DMARC on your domain, so it is harder for someone to send email using your address.
• If the payment has already been made, contact the bank immediately, because the faster you act, the better the chance of the money being frozen.

The good news is that these attacks leave traces. In the headers of every email, the receiving server records the IP address it came from, and the sender cannot change that record, while the sender name and address can be forged. Through these traces the hacker can be identified, so always report it.

Adware

Adware shows you ads without your consent, while the more advanced versions track the pages you visit and show ads related to them, so adware can be spyware at the same time. It often comes as a browser extension that was installed without you noticing, together with some free program.

You will notice it from ads appearing very often, from a changed browser homepage or search engine, and from ad windows that open with every click. It counts as malware because it works against your will, tracks you and burdens your system and connection.

Some adware that calls itself a "legitimate application" offers its own removal tool, but even then do not assume it is gone. First remove any extensions you do not recognise and reset your browser settings, then scan with antimalware. The only way to be sure it has really gone is to check the connections leaving your computer, which is a job for experts. For everyone else, if the ads keep coming back, the safest option is a format.

What is ransomware

Ransomware is malware that locks your files by encrypting them and demands a ransom to give you the key. It does not necessarily activate as soon as it is installed; it can stay dormant for quite a while until the hacker decides to activate it. Once active, it shows you the damage, the amount and a deadline, threatening that if you do not pay in time you will lose your files for good. With this psychological pressure it tries to stop you from asking an expert for help. Many hackers also copy the files before encrypting them and threaten to publish them, even if you have a backup.

When we first wrote this article, ransomware was the "latest fashion". Today it is one of the biggest threats to every business, since according to Verizon it appears in 48% of all the data breaches analysed in its 2026 report. And it does not mainly target large companies, as we used to think, because in the 2025 report ransomware was found in 88% of breaches at small and medium businesses, compared with 39% at large ones.

Do not pay the ransom. Europol and the Dutch police, through No More Ransom, point out that there is no guarantee you will get the key, while paying funds the next attack. On the same site you will find free decryption tools for many known ransomware families, and with Crypto Sheriff you can check whether there is a tool for yours.

If ransomware hits you:

1. Disconnect the computer from the network immediately, both cable and Wi-Fi, so it does not spread to other computers.
2. Do not delete anything, and take a photo of the ransom message.
3. Check No More Ransom for a decryption tool.
4. Do a clean reinstall and restore your files from a backup that was not connected to the computer.
5. Report it to the police.

The best defence against ransomware is a backup it cannot reach, meaning an offline copy, as the CISA guide also recommends. The paid antivirus products we recommend below also include dedicated ransomware protection, which stops unknown programs from encrypting your files, so make sure it is turned on.

How to tell if your computer has a virus

How do you tell if your computer has a virus? The average user often realises they are infected when it is already too late, because modern malware tries to stay quiet. But there are signs, which the NCSC also lists:

• Your antivirus reports an infection, or a message appears demanding a ransom.
• The computer has suddenly become slow or restarts by itself.
• Programs close for no reason, or programs you did not open start up.
• Windows from unknown programs appear asking you to do unusual things.
• Your contacts receive strange emails or requests for money from your address.
• Your browser has a new homepage or search engine, or has filled up with ads and extensions you did not install.

Watch out for the opposite too. A message in your browser or a phone call telling you that "your computer has a virus" and asking you to call a number or download a program is almost always a scam. The NCSC advises hanging up on such calls, and fake browser messages should be closed without clicking anything inside them.

How to remove malware from your computer

Removing malware on Windows starts with your antivirus and ends, if needed, with a format. Follow the steps in order:

1. Update Windows and your antivirus. The NCSC recommends updating the operating system and programs first and then scanning, so the antivirus recognises the latest threats.
2. Run a full scan. In your antivirus, choose a full scan rather than a quick one, so every file on the disk is checked.
3. Scan before Windows loads. Some malware hides while the operating system is running. That is why the big security companies offer rescue disks, such as Kaspersky Rescue Disk and ESET SysRescue Live, which start the computer from USB and scan the disk without Windows running.
4. Get a second opinion. Microsoft recommends not running two real-time antivirus programs together, but it allows on-demand scanners, which only run when you ask them to, such as Malwarebytes.
5. Change your passwords from a clean device. Start with email and your bank, and sign out of all active sessions on your accounts.
6. If the problems continue, format. Do a full format, wipe the whole disk and burn out every "weed" on your computer. Then restore your files from a backup made before the infection, and not from the infected disk, because, as the NCSC notes, you risk bringing the malware back with them. If you are formatting anyway, it is also the best moment to move to Linux Mint.

If you have a website and suspect that it has been infected, the process is different. See our guide to recovering from a WordPress hack, while on our servers Imunify360 continuously scans every account's files for malware.

Malware on your phone, how to remove it

You deal with malware on your phone differently from your computer, because, as the NCSC notes, antivirus usually cannot clean a phone or tablet. That is why prevention matters more here, meaning where you install apps from and what you tap.

Android. Google Play Protect checks your apps and, when it finds a harmful one, notifies you, disables it or removes it automatically, according to Google. Make sure it is on by opening the Google Play Store, tapping your profile icon, then Play Protect and Settings, where "Scan apps with Play Protect" should be turned on. Also uninstall any app you do not recognise or that you installed from a link outside Google Play.

iPhone. On an iPhone, what looks like a virus is often a spam calendar that floods you with notifications, or a fake message in Safari. You delete spam calendars as Apple describes, and you close fake messages without tapping anything inside them. Also keep iOS up to date, because updates close security holes.

If the problems continue, on Android or iPhone, the safest solution is a factory reset, as the NCSC recommends, after backing up your photos and contacts.

Do I need antivirus for Windows 11, free or paid

Do you need antivirus for Windows 11? Yes, you need a paid antivirus from a major security company, and only one. Whether you like antivirus or not, buying one is necessary, especially for businesses.

Do not trust free antivirus

One of the biggest mistakes you can make with your computer's security is installing a free antivirus. Antivirus sees every file you have and every page you open, so if you are not paying for the product, ask yourself the simple question: "How does a company that employs dozens of specialists survive while giving me its product for free?". Businesses do not run on air and "free services", so someone is paying, and often they are paying for your data.

This is not theory. The US Federal Trade Commission (FTC) required Avast to pay 16.5 million dollars and banned it from selling browsing data for advertising, because through its free antivirus and browser extensions it collected its users' browsing history and sold it, while promising to protect them from tracking. That is why we do not trust any free antivirus, and even less those suggested by an ad or a pop-up, because some of them are malicious themselves.

Which antivirus we recommend

Investing in a paid antivirus means investing in the company and the developers behind it, because you give them the money they need to keep improving it. We recommend two of the largest security companies in the world:

• Kaspersky. Kaspersky Premium scored 6 out of 6 for protection, performance and usability, 18 out of 18 in total, in the AV-TEST test for July and August 2026. Note that Kaspersky is no longer sold in the United States.
• ESET. ESET Security Ultimate also scored 18 out of 18 in the same test. ESET is a European company based in Slovakia, and its research team is the one that discovered the LoJax rootkit mentioned above.

Do not install two antivirus programs. Antivirus takes control of your computer, and Microsoft itself recommends not running two real-time protection programs together, because they slow the computer down and cause errors. If you want something extra, an on-demand scanner such as Malwarebytes can sit next to your antivirus without conflicting with it.

Linux Mint, the most secure alternative to Windows

Linux Mint is our recommendation for anyone who wants real extra security on their computer, which is why it gets a special place in this guide. Strange as it may sound, most malware is built for Windows, because it is the dominant operating system on personal computers. It is not impossible to be infected on Linux, but the chances are clearly much smaller, so moving to a Linux desktop is one of the most effective steps you can take.

Many people hesitate because they fear they will have to learn to use a computer from scratch. With Linux Mint that is not the case, because its desktop (Cinnamon) is the same as the Windows one, with a start menu at the bottom left, a taskbar and windows that work the way you know, and in our experience it is much better. It also comes ready with a browser, an email program, an office suite and support for your language.

Linux Mint also has two tools that help a lot with security. Update Manager updates the operating system and all your programs together, while Timeshift keeps snapshots of the system, so if something goes wrong you can go back to an earlier state. The current release, Linux Mint 22.3, receives security updates until April 2029.

Moving is easier than you think:

1. Back up all your files to an external drive.
2. Download Linux Mint Cinnamon from linuxmint.com and write it to a USB stick.
3. Start the computer from the USB stick and try it without installing anything, to check that everything works.
4. Install it and restore your files from the backup.

If your computer runs Windows 10 and cannot run Windows 11, Linux Mint is the most sensible choice to keep it secure for years.

10 ways to protect yourself from malware

Can you easily protect yourself from malware and keep your privacy safe? The answer is yes, as long as you know how. The suggestions below come from Konet's experience on the internet since 1999.

1. Buy a reliable antivirus

Unless you are a professional in both programming and security software, you cannot recognise every risk, so you need to leave your protection to a dedicated application. The antivirus's job is to block suspicious connections, data transfers and suspicious applications from running. We explained above which one to choose, and the most important thing is that there is one, that it is paid for and that it is always up to date.

2. Do not open suspicious emails

If you are not completely sure, do not open suspicious emails; delete them and block the sender. Email is one of the most common ways malware gets in, through two main methods, phishing links and infected attachments.

A phishing link can start downloading malware or take you to a fake page that asks for your passwords and sends them to the hacker. An infected attachment is usually disguised as a compressed file, an invoice or an image, with an executable file hidden behind it. As soon as you open it to see what it contains, it installs itself on your system. Email filters, such as SpamExperts and the internal security tools we have developed on our servers, stop many of these before they reach you, but no filter is perfect, so your attention remains the last line of defence.

3. Be very careful with ads

Not all ads are legitimate. The companies that serve them do not always check their content, and website and app owners cannot fully control what appears on their pages. These are the ads with countdown timers asking you to click before time runs out, the ones that "inform" you that you have a new message or have caught a virus, and the ones that look like the page's content so you do not get suspicious.

The risk exists even in search engine ads, where hackers impersonate well-known companies and send you to fake websites. That is why the FBI recommends using an ad blocking extension when you search, checking the URL before clicking an ad, and typing the bank's or company's address directly instead of searching for it.

4. Scan your disks

In the world of malware, being proactive is your strongest defence. Regular scanning is like a check-up at the doctor, because it finds small issues before they become big problems. Run a full scan at least once a month and schedule it in your antivirus settings so it runs on its own, while a quick scan is enough for the checks in between. Combining your antivirus with an on-demand scanner, such as Malwarebytes, gives you layered protection.

5. Do not click on just anything

A single click can lead you to a treasure of information or to an infection. Hackers exploit human curiosity with tempting headlines and offers, so-called clickbait, in emails, SMS, pop-ups and social media. Before you click, hover over the link to see where it goes, and on your phone press and hold the link to see the address. If a click seems unnecessary or even slightly doubtful, the best choice is not to make it.

6. Do not use pirated software

Pirated software, "cracked" versions of programs and unofficial activation tools often come with hidden malware, and the websites that host them are full of misleading download buttons. The people behind them do not put your security first; they want your data or control of your device.

Beyond the risk, using pirated software is illegal and unethical. Just as you want to be paid for the work you do, the creator of every piece of software wants to be paid too. Not to mention that it is essentially theft, which is a great sin!

7. Uninstall programs you do not need

Over time a computer collects programs you rarely use, and each one is a potential vulnerability, because a program you do not use is usually a program you do not update either. Uninstall them from Windows Settings rather than by deleting their folder, which leaves remnants behind, for example in the Windows registry. Avoid "cleaning tools" that promise complete removal, because they are often full of bloatware or even adware. The same goes for browser extensions: keep only the ones you use.

8. Keep your operating system up to date

An up-to-date operating system is like reinforcing the foundations of your digital home, because updates close the security holes that hackers exploit, while an outdated operating system is like a sieve, full of holes. Turn on automatic updates for Windows, your phone and your programs. You do not always need to open something to get infected, since some attacks simply exploit a security hole you have not closed, as WannaCry did.

If you are still on Windows 10, regular support ended in October 2025. Microsoft offers home users extended security updates (ESU) until 12 October 2027, but you need to enrol, free by syncing your PC settings or by paying, otherwise your computer no longer receives security updates. If your computer cannot run Windows 11, the best solution is Linux Mint.

9. Back up

Back up your data, we keep telling our customers, and we are telling you too. You can never have enough backups. When it comes to machines anything can happen, and for the same reason you carry a spare tyre in your car, you need a backup of your data. The best solution is several backups in different places, with at least one that is not permanently connected to your computer, so ransomware cannot encrypt it.

• External drives. They are cheap and easy to carry, but they are not the most reliable option and often fail after a few years, so get at least two and connect them only while you back up.
• Old computers. Instead of sending your old computer for scrap, use it for backups. A very useful job for it is backing up your email, switching it on once a day or once a week so that it downloads the email of all your accounts with POP3. Why this protects you is explained in my emails disappeared.
• VPS or dedicated server. You should not rely on other apps or companies to keep your data, because you do not know where they share it or who has access to it. With your own VPS you have your own online backup, accessible from anywhere, and nobody can change a privacy policy that affects your data. The only drawback is that you must lock hackers out, so it is better to turn to a specialist.

For the websites and email we host, we take a backup every 2 hours with 24 restore points, which you can restore yourself from cPanel with JetBackup, and we keep two more independent backup levels, one of them in another country.

10. Stay informed

The best solution, in everything in life, is to learn about the risks, because when you know them you know what to avoid. The average user does not have the training to recognise internet threats, and that lack of knowledge is a very common cause of infection. A virus can make your computer unusable, and a format will cost you time and files, while if it is a work computer the damage is even greater. So ten minutes of reading can save you hundreds of hours of work. Have a look at the articles on our blog, which often cover internet risks.

And if you want to reduce the risk as much as possible, move to Linux Mint, as explained above.

Where to report malware and cybercrime

If you fall victim to any malware or fraud, report the cybercrime to the police. So is malware a plague that cannot be fought? Of course not! Anyone who connects to the internet leaves traces, and through them the authorities can identify those responsible. In Greece you report it to the Hellenic Police Cyber Crime Division, according to the National Register of Administrative Procedures:

• by phone on 11188,
• by email at ccu@cybercrimeunit.gov.gr,
• online at gov.gr, with TAXISnet or web banking credentials,
• in person or by post, at 173 Alexandras Avenue in Athens or 326 Monastiriou Street in Thessaloniki.

Outside Greece, report it to your national police cybercrime unit. Keep the evidence, such as the emails with their headers, screenshots and payment receipts, because you will need them.

Your computer is not just a tool; it is also your personal space. Protect it the way you protect your privacy, because if it gets infected, it is not only your system that will suffer but your pocket too. If you have a question about the security of your website or email, open a support ticket and a technician will answer.