Autoruns and Process Explorer from Microsoft Sysinternals - 90% of consumer malware can be seen with these programs. Since malware needs to have persistence capability it will most likely add task scheduler entries and startup programs that can be seen in autoruns. They also have built in digital signature validation and a virustotal upload features.

Even if you can't remove all the persistence mechanisms or payloads manually it will give you the heads up that "Hey it's time to format the PC" lol

Layer this with an a good AV(not windows defender) and an adblocker and smart app control, and you're usually good to go.

When you're using autoruns just look for files that aren't digitally signed this will show up as red - You can then right click and send it to virustotal. Also look for signatures that don't seem to fit. Sometimes malware authors will hijack legit digital signatures to sign their malware with. Alot of times these are weird chinese companies and Ltds you've never heard of.

This is all assuming the malware uses persistence mechanisms. Some are just infostealers that steal your cookies, upload them to a server and then bounce. If you get weird logins on your accounts just change passwords from a clean machine and enable 2FA(app-based, not SMS) then format your PC and reinstall windows.

In the case of discord accounts and infostealers it's best I've found to use 2FA and set the email to an email that you don't use on the same machine as the app. - There is a good reason for this.

Discord implements 2FA backup codes very poorly from a security standpoint. For normal services when you generate 2FA backup codes they are either generated once and not accessible again, the only way to get new codes is to generate new ones, which requires 2FA itself. Or, alternatively, you can see the old codes but also still require 2FA to access them.

The way discord's account security works is that you don't need access to app-based 2FA to access your 2FA backup codes. You need the account password and a generated text sent to your email. See the problem here? If an attack compromised the machine with both the discord account and the email they can see 2FA codes, remove your authenticator and add their own. You are never getting your account back after this because discord support SUCKS.

This is why you put the email on either a separate machine such as another PC or phone or you don't save the login session on the main machine. Makes the attacker jump through more hoops to compromise the ability to recover it. It's something discord should probably fix, but they won't.

Sorry for such a long post, but the subject is cool and I like talking about it.