1. A computer-implemented method, comprising: executing at least one system restore in a computing device; analyzing a plurality of conditions to determine if malware detection is needed; determining a level of malware detection upon determining that malware detection is needed; and performing the malware detection at the determined level.