How to Tell if Your PC Has Malware: 10 Warning Signs

By NorwegianSpark Editorial · Published May 31, 2026 · Updated Sep 30, 2026 · 8 min read — written with AI assistance and reviewed by the NorwegianSpark SA editorial team.

The signs that your PC has malware are sudden slowness, pop-ups, programs and browser changes you did not make, security software that has been switched off, and network activity when you are doing nothing. To check for free on Windows, run a Full scan in Windows Security, then a Microsoft Defender Offline scan, which restarts the PC and looks for malware that hides from a running system. A computer rarely announces an infection — modern malware is designed to stay quiet — so this guide lists the ten symptoms that should make you suspicious, shows you how to confirm an infection rather than just worry about one, and tells you exactly what to do next. If you want a second engine or a paid suite, a full scan with a reputable antivirus such as Bitdefender is the fastest way to know for sure.

10 warning signs of malware

No single symptom proves an infection, but the more of these you notice together, the more likely something is wrong.

Sudden, unexplained slowness. Your machine bogs down even with few programs open, because malware is consuming CPU, memory or disk in the background.
Pop-ups and unwanted ads, especially ones that appear outside the browser or on sites that normally have none — a classic sign of adware.
Your browser changed by itself. A new homepage, an unfamiliar default search engine, or toolbars and extensions you did not install.
Programs you do not recognise, launching at startup or running in Task Manager with odd names.
Your security software is disabled or will not turn back on — malware often tries to blind your defences first.
Frequent crashes, freezes or the blue screen, beyond what the machine normally does.
Unexpected network activity, with the disk or network light busy while you are doing nothing — possibly data being sent out.
Files encrypted or renamed, with a ransom note — the unmistakable sign of ransomware.
Friends receive messages you did not send, suggesting an account or the machine has been compromised.
Redirected searches, where clicking a result sends you somewhere unexpected.

How to confirm an infection

Suspicion is not proof. To confirm, run a full scan — not a quick one — with a reputable, fully updated antivirus. A quick scan only checks the usual hiding spots; a full scan examines the whole system. If your installed antivirus has been disabled or you do not trust it, run the scan from Safe Mode, where most malicious code is prevented from loading, which makes detection and removal far more reliable. It can also help to run a second, on-demand scanner as a sanity check, since no single engine catches everything. Check your list of installed programs and browser extensions for anything you did not add, and review startup items in Task Manager. If a scan flags threats, you have your answer; if it comes back clean but the symptoms persist, the behavioural signs above still warrant the removal steps below.

How to check for malware on Windows 10 and 11, free

Windows already includes the two scans you need, and neither costs anything:

Full scan. Open Windows Security, select Virus & threat protection, then Scan options, choose Full scan and select Scan now. Expect it to take a while on a large drive.
Microsoft Defender Offline scan. In the same Scan options list, choose Microsoft Defender Offline scan and select Scan now. Microsoft describes it as a scan run "from outside the normal Windows kernel" that can target rootkits and viruses that infect the master boot record. Save your work first: Microsoft says it takes about 15 minutes and restarts the PC when it finishes.
Two catches from Microsoft's own documentation. If BitLocker is on, suspend it first or you may be asked for your recovery key. And if the Windows Recovery Environment is disabled, the offline scan silently does nothing — you can check with reagentc /info.
Read the results under Virus & threat protection → Scan options → Protection history.

Which scanners are worth adding as a second opinion — and how Defender compares with paid products in the 2026 lab tests — is covered in our best malware scanners guide. On a Mac the process is different; see how to remove malware from a Mac.

What to do if you find malware

If a scan confirms an infection, act methodically. Disconnect from the internet to stop data being exfiltrated or further payloads downloading. Let your antivirus quarantine and remove what it found, then reboot and scan again to be sure. Change your important passwords — email, banking, anything sensitive — but do it from a different, clean device, since an infostealer on the infected machine could capture the new passwords too. A password manager makes that mass reset far easier. For the full, careful process, follow our step-by-step malware removal guide. If the infection turns out to be ransomware, see our ransomware protection guide before doing anything else.

How to prevent it next time

Most infections are preventable. Keep your operating system and software updated so known vulnerabilities are patched. Run a reputable antivirus with real-time and web protection turned on — our best antivirus roundup covers the options. Be sceptical of email attachments and links, avoid pirated or cracked software (a leading malware source), and only install apps from trusted sources. Use strong, unique passwords with two-factor authentication, and keep regular backups so that even a worst-case infection cannot destroy your data. Those habits, plus one good security product, block the overwhelming majority of threats. Choosing that one good security product is what our security tool comparison is for.

Common mistakes to avoid

Ignoring the early signs and hoping they pass — malware rarely fixes itself and often spreads or escalates.
Calling the number in a pop-up. "Your PC is infected, call this number" pop-ups are themselves a scam; never call them. If you clicked a link that started it, see what to check after clicking a phishing link.
Changing passwords on the infected machine. Use a clean device, or you may hand the new passwords straight to an infostealer.
Running two real-time antivirus products at once to "be safe" — they conflict. Use one, plus an on-demand scanner if you want a second opinion.
Restoring from an infected backup, which simply reinfects you. Use a backup from before the symptoms started.

Frequently Asked Questions

How do I check my PC for malware for free?

On Windows 10 or 11, open Windows Security, select Virus & threat protection, then Scan options, and run a Full scan. For a deeper check, choose Microsoft Defender Offline scan and Scan now: it restarts the PC and scans from outside the normal Windows environment, which is aimed at rootkits and malware that hides from a running system. Microsoft says it takes about 15 minutes. Results appear afterwards under Protection history.

Can my PC have a virus without me knowing?

Yes. Much modern malware is built to stay quiet — infostealers copy saved passwords and cookies in the background and may cause no visible symptoms at all. That is why a clean feeling is not proof: if you have any reason for suspicion, run a full scan and an offline scan rather than waiting for obvious signs.

Can malware hide from antivirus?

Some advanced malware tries to evade detection — by disabling your antivirus, hiding in memory, or masquerading as legitimate system processes. That is why behavioural signs matter even when a scan comes back clean, and why running a scan from Safe Mode (where less malicious code is active) or with a second on-demand scanner can catch things a single real-time product misses. Keeping your antivirus and operating system fully updated closes the gaps most evasive malware relies on.

Is a slow computer always a sign of malware?

No — slowness has many innocent causes: too many startup programs, a nearly full disk, an aging hard drive, a heavy browser with dozens of tabs, or simply an old machine. Malware is one possible cause, not the only one. Treat sudden, unexplained slowness combined with other red flags (pop-ups, unknown processes, network activity) as suspicious, but do not assume the worst from sluggishness alone.

What's the difference between malware, viruses and adware?

Malware is the umbrella term for all malicious software. A virus is a specific type that replicates by attaching to other files. Adware bombards you with unwanted ads and is often more nuisance than catastrophe, though it can track you and open the door to worse. Other categories include trojans (malware disguised as legitimate software), ransomware (which encrypts your files for money), spyware and infostealers (which harvest your data). They differ in behaviour, but the detection and removal approach is broadly the same.

Should I factory reset if I think I have malware?

A clean reinstall is the most thorough way to remove a stubborn infection, and for serious cases it is the safest route. But it is also disruptive, so try a proper scan-and-remove process first. If you do reset, restore your files from a clean backup made before the infection — restoring an infected backup just reinfects you. Our removal guide walks through the less drastic steps to try first.

How did I get infected in the first place?

The most common routes are phishing (clicking a malicious link or attachment), downloading cracked or pirated software, installing fake updates or apps from untrusted sites, and malicious ads. Occasionally a compromised website or an unpatched vulnerability is to blame. Knowing the route helps you avoid a repeat — and good habits plus a strong antivirus block the large majority of these.

Affiliate disclosure

This article contains affiliate links. If you purchase through them, CyberTechVault earns a commission at no extra cost to you. Our assessments are based on vendors' published documentation, independent lab results and security disclosures — not on hands-on testing by us. Affiliate relationships never decide what we recommend.

Full disclosure: /affiliate-disclosure.