Knowing how to tell if your computer has a virus or malware is a practical skill, not a niche one. Modern infections don't always announce themselves. Some slow your machine to a crawl. Others sit quietly for weeks, harvesting passwords or encrypting files in the background. The warning signs are real and learnable, and catching them early makes the difference between a quick fix and a full data recovery job.
Sudden slowdowns and unexplained crashes
A computer that abruptly becomes sluggish, without a Windows update or a new application to explain it, is a classic early signal. Malware runs processes in the background. Those processes consume CPU cycles and RAM, which leaves less headroom for your legitimate software.
Open Task Manager on Windows (Ctrl + Shift + Esc) or Activity Monitor on a Mac. Look at what's consuming CPU and memory. If a process you don't recognise is sitting at the top of the list, search its exact name before you assume it's harmless. Some malware disguises itself with names that look like Windows system processes, such as "svch0st.exe" (note the zero) instead of "svchost.exe".
Frequent crashes or the dreaded blue screen of death on Windows can also signal an infection, though hardware failure and driver issues cause the same symptoms. The pattern matters: if crashes started suddenly and nothing else changed, malware is a reasonable suspect.
Your browser behaves oddly
Browser hijackers are among the most common forms of malware consumers encounter. They rewrite your homepage, swap your default search engine, inject ads into every page you visit, and redirect your searches through third-party servers.
Signs worth noting include:
- A homepage or search engine you didn't set appearing on startup
- Toolbars or extensions you don't remember installing
- Pop-up ads appearing even on sites that don't normally show them
- Links that redirect to unrelated sites when you click them
Check your browser extensions list. In Chrome, go to Settings > Extensions. In Firefox, go to Add-ons and Themes. Remove anything you don't recognise, especially anything installed on a date that coincides with when the odd behaviour started.
Unusual network activity
Spyware, remote access trojans, and ransomware staging tools all communicate with external servers. That communication uses your internet connection, often at times when you're not actively doing anything online.
On Windows, open Resource Monitor (search for it in the Start menu) and go to the Network tab. Look for processes making outbound connections to IP addresses you don't recognise. On a Mac, the free tool Little Snitch gives a visual map of every outbound connection your machine attempts.
Your router's admin page can also show total bandwidth usage. A spike you can't account for, particularly overnight or when the machine was idle, warrants investigation.
Disabled security tools and missing admin access
Some malware actively disables Windows Defender, your firewall, or third-party antivirus software. Its logic is simple: a live security tool will detect and remove it, so the infection kills the tool first.
If Windows Defender is turned off and you didn't do it, treat that as a confirmed red flag. Check the status in Windows Security (Start > Settings > Privacy & Security > Windows Security). If the toggle is greyed out or returns to "off" every time you try to enable it, something is preventing the change.
Similarly, if your user account has lost admin privileges for no clear reason, or if you can't access Control Panel or Task Manager, malware may have altered your system policy settings. This is a more serious infection pattern and typically requires booting from a recovery drive to remediate.
Accounts sending messages you didn't write
If friends or colleagues report receiving strange emails or social media messages from your accounts, your credentials may be compromised. This can happen through a keylogger installed on your machine, or through a phishing site that captured your password. Either way, it's worth checking for malware even if the problem seems like a pure account issue.
Understanding how phishing attacks work helps here, because the two problems often arrive together. A phishing email delivers the malware, the malware captures the credential, and the compromised credential then lets attackers send messages on your behalf.
Files that changed, disappeared, or got encrypted
Ransomware is the most dramatic version of this: files you can open one day simply can't be opened the next, and a ransom note appears on your desktop. But subtler changes matter too. If documents show a modification date you don't recognise, or if folders you haven't touched have been reorganised, something accessed those files.
Some malware deletes or corrupts files as a payload rather than encrypting them for ransom. Others exfiltrate copies while leaving the originals intact, so there's no visible change at all. Regular backups are the only real protection against file-level damage, whatever form it takes.
What to do when you spot these signs
First, disconnect from the internet. This cuts off any active communication between the malware and its command server, which limits further data exfiltration or lateral spread if the machine is on a home or office network.
Next, run a full scan with a reputable security tool. Windows Defender is capable for many common threats. For a second opinion, Malwarebytes offers a free scanner that catches threats Defender sometimes misses, particularly adware and potentially unwanted programs. If you don't yet have a dedicated tool installed, our guide to choosing the best antivirus software for Windows and Mac covers what to look for before you download.
After removing any detected threats, change the passwords for your email, banking, and any other account you accessed from the infected machine. Do that from a different, clean device if at all possible. Enable two-factor authentication on those accounts if it isn't already on.
If scans come back clean but the symptoms persist, consider a full operating system reinstall. Some rootkits embed themselves below the OS level and survive a standard scan. A clean reinstall from a known-good image is the only guarantee of a clean machine.
Keeping the machine clean going forward
Most infections arrive through three vectors: malicious email attachments, drive-by downloads from compromised websites, and software bundled with pirated or free applications. Closing those doors cuts the risk sharply.
Keep your operating system and applications updated. Patch Tuesday, Microsoft's monthly security update release, exists because attackers actively exploit known vulnerabilities between patch cycles. An unpatched machine running an outdated browser is a soft target. Pair that habit with the broader practices in our guide to protecting your personal information online, and most common attack paths close off.
The symptoms listed here aren't always caused by malware. Some are caused by failing hardware, bloated software, or misconfigured settings. But when two or three of them appear together and you can't trace the cause, running a scan costs you nothing and potentially saves a lot.