Malware isn't always obvious — some infections announce themselves with pop-ups and crashes, while others quietly run in the background for months, stealing data or hijacking your PC's resources. Knowing what to look for is the first step to catching an infection early, before it causes serious damage or spreads. This guide covers the most reliable warning signs, explains what each one typically means, and points you towards the right fix for each.
1. Your PC has become noticeably slower
A sudden, unexplained slowdown — especially if it coincides with high CPU, memory, or disk usage even when you're not doing anything demanding — is one of the most common malware symptoms, since many infections run background processes constantly (mining cryptocurrency, sending spam, or communicating with a control server).
What to check: Open Task Manager (Ctrl+Shift+Esc), go to the Processes tab, and sort by CPU or Memory. Look for unfamiliar process names using significant resources, especially ones with vague or randomly generated names, or multiple copies of the same unfamiliar process running at once.
Pro tip: Not all slowdowns are malware — an ageing hard drive, too many startup programs, or simply a PC that's outgrown its use are equally common causes. If Task Manager shows nothing unusual but the PC is still slow, our performance troubleshooting content elsewhere on the site covers non-malware causes too.
2. Pop-up adverts appearing unexpectedly
If you're seeing adverts pop up outside your browser, or even when no browser is open at all, this is a very strong sign of adware. Ads appearing within web pages that don't normally show them, or a sudden increase in ad volume across sites, points the same way.
What to check: See our dedicated guide on removing adware and browser hijackers for the full removal process, which covers checking installed programs, browser extensions, and scheduled tasks.
3. Your homepage, search engine, or new tab page has changed
Waking up to find your browser opens to an unfamiliar page, or that searches are being routed through a strange intermediate site before reaching results, is a classic sign of a browser hijacker — malware that specifically targets your browser settings.
What to check: Review your browser's extensions and settings for anything unfamiliar, as detailed in our adware and browser hijacker removal guide.
4. Your antivirus or firewall has been disabled without your knowledge
Some malware specifically targets and disables security software to avoid detection and removal. If you open Windows Security and find real-time protection switched off, or your third-party antivirus shows as disabled, and you didn't turn it off yourself, treat this as a serious warning sign.
What to check: Try re-enabling it via Windows Security > Virus & threat protection > Manage settings, and turn Real-time protection back on. If it immediately turns itself off again, or won't stay on, this strongly suggests active malware and warrants an offline scan — see the Microsoft Defender Offline scan option covered in our guide on scanning for and removing viruses.
5. Programs crashing, freezing, or behaving strangely
Frequent, unexplained crashes — particularly of programs that were previously stable — can indicate malware interfering with system files or competing for resources. This is a less specific sign on its own (software bugs and driver issues cause this too) but is worth noting alongside other symptoms on this list.
6. Unusual network activity or high data usage
Some malware communicates constantly with remote servers, whether to receive instructions, upload stolen data, or participate in a botnet.
What to check: Open Task Manager > Performance tab > Wi-Fi/Ethernet to see current network activity, or check Settings > Network & Internet > Data usage to see which apps have used the most data recently. Investigate any unfamiliar app using significant data, especially if you weren't actively using your PC at the time.
7. New toolbars, extensions, or programs you don't remember installing
Bundled software — extra programs and browser extensions installed alongside something you actually wanted — is one of the most common infection vectors, especially from free software downloaded outside official sources.
What to check: Review Settings > Apps > Installed apps, sorted by install date, and your browser's extensions list, for anything unfamiliar. Uninstall anything you don't recognise or specifically remember installing yourself.
8. Friends or contacts receiving strange messages "from you"
If people mention receiving odd emails, social media messages, or WhatsApp texts that you didn't send, your account credentials may have been stolen by an info-stealer trojan, even if your PC otherwise seems to be behaving normally.
What to check: Change your passwords immediately from a different, trusted device (not the potentially infected one), enable two-factor authentication, and then run a full scan on the affected PC using Windows Defender and Malwarebytes, as detailed in our virus scanning and removal guide.
9. Files have been renamed, encrypted, or a ransom note has appeared
This is the most serious sign on this list. If files suddenly won't open, have had their extensions changed, or you see an on-screen message demanding payment to restore access, you're dealing with ransomware.
What to check: Disconnect from the network immediately and do not pay any ransom. Follow the full process in our dedicated article on recovering from a ransomware attack.
10. Your browser's "downloads" or "search history" shows things you didn't do
Some malware silently downloads additional payloads or performs background searches. Periodically glancing at your browser's download history and search/browsing history for anything unfamiliar is a good habit, particularly on a family or shared PC.
11. Random pop-ups claiming your PC is infected and demanding you call a number
This deserves special mention: fake "Windows has detected a virus" or "Your PC is infected, call this number" pop-ups are themselves a form of malicious activity (scareware), designed to trick you into calling a fraudulent support line or downloading further malware — not a genuine warning from Microsoft or your antivirus.
Warning: Genuine Windows or antivirus alerts never ask you to call a phone number. If you see this kind of pop-up, close the browser tab (using Task Manager to force-close the browser if it won't close normally) and do not call any number shown or download anything it suggests.
12. Your fan runs constantly at full speed, or the PC runs hot even when idle
Cryptocurrency-mining malware in particular is known for pushing the CPU or graphics card to maximum usage continuously, causing constant fan noise and heat even when you're not doing anything demanding.
What to check: Task Manager's Performance tab will show sustained high CPU or GPU usage with no obvious cause — investigate via the Processes tab as described under sign #1.
What to do if you recognise several of these signs
- Disconnect from the internet if you suspect active data theft or ransomware.
- Run a full scan with Windows Defender, followed by a second-opinion scan with Malwarebytes — see our complete guide on how to scan for and remove viruses.
- Check installed programs and browser extensions for anything unfamiliar and remove it.
- Change your important passwords from a separate, clean device once the PC is confirmed clean.
- If ransomware is involved, stop and follow the dedicated ransomware recovery guide instead, as the correct first steps differ from a standard infection.
Closing thoughts
Malware symptoms range from blatant (ransom notes, constant pop-ups) to subtle (a slightly slower PC, a background process quietly eating bandwidth), which is why it's worth knowing the full range of warning signs rather than just the obvious ones. If you notice even one or two of these signs, it costs nothing to run a quick scan to check — catching an infection early, before it spreads or steals data, makes recovery far simpler and less stressful.
Was this guide helpful? Explore more Malware Removal guides, or browse all Security & Performance articles.