In this paper we will discuss on ways to fight against malwares (malicious-logic software), spywares and Trojan horses. We will also talk about drawbacks of today’s countermeasures for malware detection and removal. At the end, we will introduce a method to determine system changes which can be helpful in case of exposing unattended malware installation. Our solution is based on creating and comparing system snapshots (checksum of system files & directories) in different situations. As an example, after installing operating system and tuning different necessary services and before connecting system to unprotected network it is a good idea to create a system snapshot because in this state we are sure that system is in safe and healthy mode. When system state changes or if we suspect on malware infection we have to create another system snapshot. By comparing these two, our approach will report system changes and in case of infection, administrator will figure out where the malware is installed or which files are modified and also will be able to undo system modifications made by malicious software.