How to Tell If Your Computer Has a Virus — 12 Warning Signs (2026)
12 signs your computer may be infected with a virus or malware — from obvious symptoms like pop-ups to subtle ones like disabled security tools. Includes how to check and what to do next.
Most computer viruses in 2026 are not the dramatic movie-poster variety that flash warnings across your screen and announce their presence with a skull graphic. The ones worth worrying about are considerably quieter — spyware silently logging keystrokes, crypto-mining malware running your CPU at 60% while you are reading emails, information-stealing trojans exfiltrating passwords in the background while your computer feels just slightly slower than it used to. Knowing how to tell if your computer has a virus is less about watching for obvious chaos and more about recognizing the specific patterns that malware produces — patterns that, once you know what to look for, are usually identifiable without any specialist knowledge. This guide covers every warning sign, how to check definitively, and what to do if your suspicions turn out to be correct.
Quick reference: the warning sign checklist
| Warning sign | Urgency | Most likely cause if infected |
|---|---|---|
| Sudden unexplained slowdown | Investigate | Crypto-miner, botnet, or background trojan |
| Excessive pop-up ads | High | Adware or browser hijacker |
| Browser homepage or search engine changed | High | Browser hijacker or PUP (Potentially Unwanted Program) |
| Programs you did not install | High | Trojan dropper or bundled malware |
| Antivirus or firewall turned itself off | Very high | Malware actively disabling defenses |
| Emails sent from your account you did not write | Very high | Account-hijacking malware or credential theft |
| Files missing, renamed, or encrypted | Critical — act immediately | Ransomware |
| Unusual network activity while idle | Investigate | Spyware, botnet, or data-exfiltration trojan |
| Browser redirects to unfamiliar sites | High | Browser hijacker or DNS hijacking malware |
| Frequent crashes or blue screens | Investigate | Malware corrupting system files or drivers |
| Mouse moving or typing happening on its own | Critical — act immediately | Remote Access Trojan (RAT) — active attacker |
| Security warning from your actual antivirus | Act now | Confirmed detection — follow removal steps |
None of these signs alone confirms an infection — a slow PC could be a startup bloat problem, a blue screen could be a driver issue. What distinguishes malware is persistence and pattern: symptoms that repeat, worsen over time, or reappear after restart. If three or more signs from the list above are occurring simultaneously and returning after you restart, malware is the most likely explanation and warrants an immediate scan.
The 12 warning signs explained
Your computer has suddenly slowed down for no obvious reason
InvestigateA slow PC has many innocent causes — startup bloat, a full drive, visual effects on aging hardware. What distinguishes malware-related slowdown is its sudden onset with no corresponding change you made. Crypto-mining malware and botnets consume CPU and RAM at all times, often deliberately set to run at moderate intensity to avoid triggering obvious alerts. If your Task Manager shows CPU or memory consistently elevated while you are doing nothing, and you cannot identify the process responsible, malware is a possibility worth investigating.
Check Task Manager (Ctrl + Shift + Esc). Under the Processes tab, sort by CPU usage. If an unfamiliar process is consistently consuming 20–40% of your CPU, search its exact name — if it is not recognized as legitimate software, run a full scan immediately.
Pop-up ads appearing on sites that normally have none — or appearing on your desktop
High concernMost modern browsers block pop-ups by default. If you are seeing pop-up ads on sites that do not normally show them, or seeing pop-up windows appearing even when no browser is open, adware has installed itself — either as a browser extension or as a standalone program. Adware pop-ups are designed to look like system warnings, prize notifications, or antivirus alerts to get you to click. Clicking them can download additional malware, which is the actual goal of the pop-up rather than the annoying symptom you are focused on.
Your browser homepage or default search engine has changed without your input
High concernBrowser hijackers modify your default homepage, new tab page, and search engine to redirect traffic through their own search infrastructure — generating ad revenue from your searches or harvesting search queries for data. If your browser now opens to a search engine you did not choose, or if Google searches are routing through an unfamiliar domain before reaching results, a browser hijacker is almost certainly responsible. Check your browser's installed extensions for anything you do not recognise, and check your browser's settings for default search engine and startup page settings.
Programs or apps you did not install are appearing
High concernOpen the Start menu and look at your installed applications (Settings > Apps > Installed apps). If you see programs you do not recognise and did not install, something has placed them there. This is how trojan droppers operate — they install themselves alongside seemingly legitimate software (free games, media players, PDF converters, download managers) and then add additional programs over time. An unfamiliar program in your installed apps list does not always mean active infection — some legitimate software installs companion tools — but anything you genuinely did not authorise and cannot identify should be removed and investigated.
Your antivirus or Windows Firewall has turned itself off
Very high concernThis is one of the most significant warning signs on the list. Sophisticated malware — particularly rootkits and advanced trojans — actively disables security tools as part of its infection process, because a running antivirus is the biggest threat to its continued operation. If Windows Security shows that your firewall is off and you did not turn it off, or if your antivirus protection is disabled and you cannot re-enable it, malware interference is the most likely explanation. An antivirus that cannot update its definitions despite a working internet connection is another version of the same symptom.
Friends or contacts report receiving emails or messages from you that you did not send
Very high concernIf contacts are telling you they received suspicious emails from your address — links, attachments, or unusual requests — account-hijacking malware or credential theft has occurred. Some malware harvests email credentials and uses your accounts to spread further, often to everyone in your contacts list. This can happen without any obvious signs on your own computer. Check your sent mail folder for emails you did not write. Check your email account's activity log for login locations you do not recognise. Change your email password immediately from a different device — and consider whether the same credentials are used on other accounts that now also need changing.
Files are missing, renamed, or you are seeing ransom messages
Critical — act immediatelyIf files have disappeared, been renamed with unfamiliar extensions, or if a text file or browser window has appeared demanding payment to recover your data — you have ransomware. Ransomware encrypts your files and then demands cryptocurrency payment for the decryption key. It is among the most destructive categories of malware and moves fast — a full encryption pass can complete in under an hour. If you see early signs (files suddenly unreadable, suspicious file extension changes), disconnect from the internet immediately and all connected drives, and seek professional help before the encryption process completes on any remaining files.
Unusual network activity while the computer is idle
InvestigateInformation-stealing trojans typically generate 50–200MB of outbound data during initial exfiltration phases, often during off-peak hours. If your router's activity light is blinking consistently while your computer is not in active use and no obvious downloads are running, something is communicating with external servers. Open Task Manager, go to the Network tab, and look for processes showing consistent network activity. Any unfamiliar process sending or receiving data at volume warrants immediate investigation. Your router admin interface (typically 192.168.1.1) can show you which device is generating the traffic and roughly how much.
Browser keeps redirecting to unfamiliar websites
High concernIf clicking links redirects through unfamiliar intermediate domains before reaching your destination — or sends you somewhere entirely different — a browser hijacker or DNS hijacking malware has modified how your network requests are routed. This is used to inject ads, steal credentials on fake login pages, or intercept banking traffic. Beyond the annoyance, a single redirect to a convincing fake login page represents a real credential theft risk. Check your browser extensions and check your DNS settings — your DNS server address in Network settings should be your ISP's server or a known public server like 8.8.8.8, not an address you do not recognise.
Frequent crashes or unexpected blue screen errors
InvestigateMalware that corrupts system files or injects malicious code into running processes can cause the same kinds of crashes as driver problems or bad RAM. If your PC is crashing frequently with stop code errors and none of the standard BSOD fixes resolve it, malware interference is worth ruling out. Run a full Windows Security scan before spending time on hardware diagnostics — the scan takes less time and a clean result tells you where to look next.
Your mouse is moving on its own or text is appearing without you typing
Critical — act immediatelyIf your cursor moves, text appears in fields, windows open and close, or your computer takes actions without your input — and this is not explained by a faulty mouse or keyboard — you may have a Remote Access Trojan (RAT) installed. RATs give attackers real-time, full control of an infected system, allowing them to observe your screen, type, copy files, install additional malware, and access any account you are logged into. This warrants immediate disconnection from the internet. Test with a different mouse and keyboard first to rule out hardware, but if the behaviour continues across devices, treat this as a confirmed serious infection.
Your antivirus has detected and flagged something
Act on it immediatelyA detection notification from Windows Security or your installed antivirus is the only confirmed sign of infection on this list — everything else is a symptom requiring investigation. If your antivirus alerts, read the notification carefully: it will identify what was found, where it was found, and whether it was quarantined or requires your action. If it reports the threat as quarantined, run a full scan to ensure nothing else is hiding. If it reports that it could not remove something, continue to the removal steps below.
Types of malware and what each one does
Virus
Replicates by attaching to other files. Spreads when infected files are shared. Can corrupt data and slow systems.
Trojan
Disguises itself as legitimate software. Once installed, creates backdoors, steals data, or drops additional malware.
Ransomware
Encrypts your files and demands payment for the decryption key. The fastest-growing threat category in 2026.
Spyware
Runs silently in the background, logging keystrokes, capturing screenshots, and stealing credentials. Often no visible symptoms.
Adware
Generates advertising revenue by injecting ads into your browser. Most common visible symptom: unexpected pop-ups.
Rootkit
Hides deep in the operating system to avoid detection, often disabling antivirus tools. Hardest to remove without professional help.
How to check your computer for viruses — step by step
Method 1: Windows Security (free, built-in, no download required)
Search for Windows Security in the Start menu and open it. Go to Virus & threat protection. Click Scan options and select Full scan. Click Scan now. A full scan checks every file on your system and takes 30–60 minutes. Let it complete without interruption — stopping it early can leave detections unaddressed.
If Windows Security itself will not open, or reports that it is managed by your organization when it should not be, malware may already be interfering with it. Proceed to Method 3.
Method 2: Microsoft Safety Scanner (free second opinion)
The Microsoft Safety Scanner is a free, official scanning tool from Microsoft that runs a one-time scan without installing permanently or conflicting with your existing antivirus. Download it from microsoft.com/safety/scanner, run it as Administrator, and select Full scan. The scanner expires 10 days after download, so use it within that window.
No single scanner catches 100% of threats. Running Windows Security and the Microsoft Safety Scanner in sequence takes about 2 hours total and covers the vast majority of known malware. If both come back clean but symptoms persist, the issue is more likely a software configuration problem than malware.
Method 3: Scan in Safe Mode (when normal scanning is blocked)
If your antivirus will not run, or if the scan keeps getting terminated, boot into Safe Mode — which loads only essential Windows processes, preventing most malware from loading alongside them. With malware not running, it cannot interfere with the scan.
To enter Safe Mode: go to Settings > System > Recovery > Advanced startup > Restart now. Select Troubleshoot > Advanced options > Startup Settings > Restart. Press 4 or F4 for Safe Mode. From Safe Mode, run your Windows Security full scan.
What to do immediately if you think you are infected
Disconnect from the internet
Unplug your ethernet cable or turn off Wi-Fi. This stops any ongoing data exfiltration and cuts off communication between the malware and attacker-controlled servers. Do this before running any scans if you suspect active data theft.
Do not log into accounts or make financial transactions
If spyware or a keylogger is active, any credentials you type could be captured. Change passwords for important accounts — email, banking, social media — from a different device (your phone or another computer) before cleaning the infected machine.
Run a full scan in Safe Mode
Boot into Safe Mode as described above and run Windows Security full scan. This prevents malware from actively interfering with the scanning process. Follow all removal instructions the scanner provides.
Remove detected threats and restart
Quarantine or delete everything the scan flags. Restart normally and run a second scan to catch anything that was not active during the first scan. Two consecutive clean scans with no recurring symptoms is a reasonable threshold for confidence.
Check your accounts for unauthorized activity
Review email sent folders, check bank and credit card statements, review login activity in Google, Microsoft, and social media account security dashboards. If any account shows access from unrecognised locations or times, change that password and enable two-factor authentication if not already active.
Seek professional help if symptoms persist
Rootkits and some advanced trojans can survive a standard scan and persist through reboots. If symptoms continue after two full scans and a restart, or if your antivirus finds threats it cannot remove, professional diagnosis is the appropriate next step rather than continuing to run the same tools.
How most infections actually happen
Understanding the entry points prevents reinfection. The most common routes in 2026 are: clicking a malicious link in a phishing email (still the most prevalent entry point), downloading software from unofficial sources or torrent sites, fake browser or system update prompts that appear on legitimate websites, malicious browser extensions disguised as productivity tools, and infected USB drives or external devices. Keeping Windows and all software updated, downloading only from official sources, and treating unsolicited "your computer needs an update" prompts with immediate scepticism — particularly those that appear outside Windows Update — eliminates the majority of infection risk without requiring any additional paid software.
Pop-ups that look like Windows security warnings, telling you that your computer is infected and directing you to download a specific "cleaner" tool, are one of the most common malware delivery mechanisms. Legitimate antivirus software never presents itself as a website pop-up. Windows Security alerts appear in the notification area of your taskbar. Any browser pop-up claiming your PC is infected and offering to fix it is itself malware or malware delivery. Close the browser tab, do not call the phone number, do not download anything it recommends.
If you are in New Jersey, New York, California, Texas, or Florida and need professional help removing a persistent infection, our remote computer support service handles malware diagnosis and removal without requiring you to bring your machine anywhere. For ongoing protection including regular scans, updates, and proactive monitoring, our maintenance support plan covers all of this on a scheduled basis.
Frequently asked questions
How can I tell if my computer has a virus?
Common signs include: sudden unexplained slowdown, excessive pop-up ads or browser redirects, browser settings changed without your input, programs you did not install appearing in your app list, antivirus or firewall turning off on its own, emails sent from your account that you did not write, unusual network activity while idle, and frequent unexpected crashes. Any single symptom may have an innocent explanation. Three or more occurring together and persisting after a restart is a strong indicator of infection.
What is the difference between a virus and malware?
A virus is one specific type of malware that replicates by attaching to other files. Malware is the broader category covering all malicious software — viruses, trojans, ransomware, spyware, adware, and rootkits. In everyday language, "virus" is often used to mean any of these, which is fine as long as your scan and removal tool covers all malware types, not just viruses specifically.
How do I check if my computer has a virus for free?
Windows Security is built into Windows 10 and 11 — search for it in the Start menu, go to Virus and threat protection, and run a Full scan. It is free, effective, and requires no installation. For a second opinion, the Microsoft Safety Scanner is a free official tool from Microsoft that performs a one-time scan without installing permanently.
Can a computer have a virus with no symptoms?
Yes — many modern malware variants are designed to operate silently. Spyware and information-stealing trojans collect passwords and personal data without causing noticeable performance impact. This is why running regular scheduled scans even when your computer feels normal is important — not just as a response to symptoms.
What should I do immediately if I think my computer has a virus?
Disconnect from the internet, avoid logging into accounts or making financial transactions from the infected machine, boot into Safe Mode and run a full Windows Security scan, change passwords for important accounts from a different device, and seek professional help if symptoms persist after scanning and removal.
Can't remove the infection yourself?
Some malware survives standard scans and requires professional removal tools and diagnosis. Our remote computer support team can connect to your PC, identify what is running, and remove it — usually in a single session.
Get remote virus removal support
