Signs Your PC Actually Has Malware — and the Myths That Cause Unnecessary Panic

A slow computer, a noisy fan or a strange-looking process in Task Manager can make it feel as though your PC has been infected. Search online, and you will quickly find alarming claims that almost any Windows problem is evidence of a virus.

In reality, many supposed “malware symptoms” have perfectly ordinary explanations. Low storage space, faulty updates, overloaded browsers, ageing hardware and legitimate background processes can all make a computer behave strangely.

At the same time, genuine malware is not always obvious. Modern threats may be designed to remain hidden while stealing passwords, monitoring activity, encrypting files or giving an attacker remote access.

The important question is not whether your PC has one unusual symptom. It is whether several suspicious changes appeared unexpectedly, particularly after a questionable download, email attachment, browser prompt or remote-support session.

What Counts as Malware?

Malware is a broad term covering software intentionally designed to compromise, damage, spy on or disrupt a computer system. It includes:

• Viruses
• Trojans
• Spyware
• Password stealers
• Keyloggers
• Ransomware
• Adware
• Browser hijackers
• Remote-access malware
• Cryptomining malware
• Worms

The UK National Cyber Security Centre describes malware as malicious software that can damage computer systems, networks or devices, while CISA notes that it may be used to steal information, interrupt services or gain unauthorised access. 

Potentially unwanted applications are slightly different. They may not behave like traditional malware, but they can still inject adverts, change browser settings, track browsing behaviour or install additional software without making their purpose clear.

Sign 1: Security Software Detects a Threat

The clearest evidence of malware is a detection from a trusted security product.

Windows Security may identify a threat and display information such as:

• The detected threat name
• The affected file
• Whether the item has been quarantined
• Whether further action is required
• The severity of the detection

Do not rely on a warning inside a webpage. A browser page claiming that “seven viruses have been found” is not the same as a detection from Microsoft Defender or your organisation’s approved security platform.

Open Windows Security directly from the Start menu and check:

Virus & threat protection > Protection history

If a threat has been detected, follow the recommended action. On a business computer, contact your IT provider before deleting files manually, as the detection may need to be investigated across other devices.

Sign 2: Programs Open, Close or Install Themselves

Unexpected applications are more concerning than ordinary performance issues.

Warning signs include:

• Programs launching without being selected
• Applications repeatedly crashing or closing
• Unknown software appearing in the installed-apps list
• Command Prompt or PowerShell windows briefly opening by themselves
• New programs starting every time Windows loads
• Security tools closing whenever you try to run them
• Applications requesting administrator access for no clear reason

The NCSC lists unexplained program activity, unexpected restarts and applications opening or closing by themselves among the behaviours that may justify investigating an infected device. 

That does not mean every brief command window is malicious. Legitimate applications, drivers and management tools sometimes run scripts during startup or updates. The wider context matters.

Sign 3: Your Browser Has Changed Without Permission

Browser-related malware and unwanted software often produce visible symptoms.

These may include:

• Your homepage changing
• Searches being sent through an unfamiliar provider
• New tabs opening automatically
• Websites redirecting somewhere unexpected
• Extensions returning after you remove them
• Toolbars appearing without permission
• Pop-ups continuing after the browser is closed
• Adverts appearing on normally advert-free pages

Google identifies persistent pop-ups, returning extensions, changed search settings and redirects to unfamiliar pages as possible signs of unwanted software. 

Bear in mind that some frightening desktop alerts are simply browser notifications from a website you previously allowed. They may be fraudulent without proving that malware is installed.

Check your browser’s notification permissions before assuming the entire computer is infected.

Sign 4: Files Are Renamed, Locked or Encrypted

This is one of the most serious warning signs.

Ransomware may:

• Change file extensions
• Prevent documents from opening
• Rename large numbers of files
• Replace the desktop background
• Create ransom-note text files
• Demand payment for a decryption key
• Make shared network files unavailable

The NCSC warns that malware affecting an organisation may leave devices locked or unusable and can delete or encrypt information. 

If files are actively being encrypted, immediately disconnect the computer from wired and wireless networks. This may help prevent the malware from reaching servers, shared drives, backups or other computers.

Do not start randomly deleting files or reinstalling Windows before the incident has been assessed. Valuable evidence and possible recovery options could be lost.

Sign 5: Your Accounts Show Activity You Did Not Perform

Malware does not always damage the computer. Some threats are built to steal information quietly.

Look for:

• Password-reset messages you did not request
• Successful logins from unfamiliar locations
• Emails sent from your account that you did not write
• New forwarding rules in your mailbox
• Purchases you do not recognise
• Multifactor authentication prompts you did not initiate
• Social-media messages sent without your knowledge
• New devices added to your Microsoft, Google or Apple account

Unexpected messages sent to your contacts can be a sign that your device or an online account has been compromised. 

Account compromise does not automatically prove that the PC contains malware. The password may have been stolen through phishing, reused on another breached service or exposed through an insecure browser extension.

However, unexplained account activity combined with suspicious computer behaviour should be treated seriously.

Sign 6: Security Settings Have Been Disabled

Malware frequently attempts to weaken the computer’s protection.

Check for unexpected changes such as:

• Microsoft Defender being turned off
• Real-time protection repeatedly disabling itself
• Windows Update failing or being blocked
• Firewall rules you did not create
• Browser security settings being reduced
• Your hosts file, proxy or DNS settings being altered
• Windows Security pages becoming inaccessible
• Updates being redirected or failing with unusual messages

There can be legitimate explanations. Another approved antivirus product may disable Microsoft Defender to prevent software conflicts, and a business VPN or web-filtering service may intentionally configure proxy or DNS settings.

On a managed business device, check with your IT provider before changing these configurations.

Sign 7: Unexplained Network or Processor Activity Continues When the PC Is Idle

Some malware uses the computer’s resources for activities such as:

• Sending spam
• Mining cryptocurrency
• Communicating with an attacker
• Uploading stolen data
• Scanning other devices
• Participating in a botnet

Possible symptoms include:

• Fans running heavily while the PC is idle
• Persistently high processor use
• Significant network activity with no applications open
• Battery drain that suddenly becomes much worse
• The computer becoming hot during light use
• An unfamiliar process repeatedly consuming resources

These symptoms justify investigation, but they are not proof by themselves. Windows indexing, cloud synchronisation, antivirus scans, application updates and browser tabs can all use considerable resources legitimately.

Use Task Manager to identify which program is responsible before drawing conclusions.

Sign 8: The Webcam or Microphone Activates Unexpectedly

An unexplained camera light or microphone indicator deserves immediate attention.

First check whether a legitimate application is responsible. Video-conferencing software, browser tabs, voice assistants and communication apps can retain permissions or continue running in the background.

Review access under:

Settings > Privacy & security > Camera

and:

Settings > Privacy & security > Microphone

Look for applications you do not recognise or programs that should not require access.

If activation continues without explanation, disconnect the PC from the internet and arrange a security check.

Sign 9: The Problem Began Immediately After a Risky Action

Timing matters.

Your risk is higher if suspicious behaviour started after you:

• Opened an unexpected email attachment
• Enabled macros in an unfamiliar document
• Installed cracked or pirated software
• Downloaded a fake update
• Installed an unknown browser extension
• Allowed someone remote access
• Disabled security software to run a program
• Used a misleading download button
• Opened a file from an untrusted USB drive
• Entered credentials into a suspicious webpage

Phishing remains a common way of delivering malicious software or stealing login details. The NCSC recommends combining user awareness with technical controls rather than relying entirely on people recognising every dangerous link. 

Myth 1: “My Computer Is Slow, So It Must Have a Virus”

A sudden slowdown can be associated with malware, but it is one of the least reliable symptoms when seen alone.

More common explanations include:

• Too many startup applications
• Low disk space
• An ageing hard drive
• Insufficient memory
• Windows installing updates
• Cloud files synchronising
• Browser tabs consuming memory
• Overheating
• A faulty driver
• A failing storage device

Check Task Manager, available storage, Windows Update and hardware health before assuming infection.

Malware becomes more likely when the slowdown appears alongside other evidence, such as unknown software, disabled security, browser redirects or suspicious account activity.

Myth 2: “Any Virus Warning Means My PC Is Infected”

Fake virus warnings are extremely common.

A webpage may claim that your computer is infected and urge you to:

• Call a telephone number
• Download a cleaner
• Renew an antivirus subscription
• Click “Allow”
• Install remote-access software
• Enter card details
• Sign in to confirm your identity

Microsoft warns that technology-support scams frequently use fake error and security notifications to persuade victims to contact criminals or grant remote access. 

A real Microsoft warning will not ask you to call an unknown support number displayed inside a browser page.

Close the page without interacting with it, then open Windows Security directly and perform a scan.

Myth 3: “Windows Security Found Nothing, So the PC Is Definitely Clean”

A clean scan is reassuring, but no security tool can guarantee that every threat has been found.

There are several reasons a scan may miss something:

• The malware is new
• The malicious process is not currently active
• Only a quick scan was performed
• The threat exists inside an online account rather than the PC
• The problem is an unwanted browser notification rather than a malicious file
• A browser extension or scheduled task was overlooked
• The threat has tampered with the security software
• The suspicious file has already been removed but credentials were stolen

When concerns remain, update the security software and run a full scan. Microsoft Defender Offline can also restart the computer and scan outside the normal Windows environment.

On a business device, endpoint security logs and network monitoring may reveal activity that a local scan cannot.

Myth 4: “Every Unknown Process in Task Manager Is Malware”

Windows runs many processes with unfamiliar names.

Examples include system services, driver utilities, audio components, cloud-sync applications and device-management agents. Closing the wrong process may cause instability or interrupt legitimate business software.

Rather than judging a process solely by its name, check:

• Its file location
• Its digital signature
• The publisher
• When it was installed
• Whether it restarts after being ended
• Whether trusted security software flags it
• Whether it is consuming unusual resources
• Whether the PC is managed by your organisation

Do not download a random “process remover” suggested by an advertisement.

Myth 5: “Macs Can Get Malware, but Windows PCs Cannot if They Are Updated”

No mainstream operating system is immune to malicious software.

Updates reduce risk by fixing known vulnerabilities, but malware can also arrive through:

• Stolen passwords
• Malicious documents
• Browser extensions
• Social engineering
• Fake applications
• Remote-access scams
• Users approving an installation

Keeping Windows and applications updated is essential, but it should be combined with security software, multifactor authentication, reliable backups and cautious application control.

Myth 6: “Incognito Mode Protects Me From Malware”

Private or incognito browsing mainly limits what the browser stores locally after the session.

It does not automatically:

• Block malicious downloads
• Detect unsafe attachments
• Hide activity from your employer or internet provider
• Prevent password theft
• Remove malware already installed
• Make an unsafe website trustworthy
• Stop a user from granting dangerous permissions

Use private browsing for privacy on a shared computer, not as a replacement for security controls.

Myth 7: “Malware Always Makes Itself Obvious”

Some malware is deliberately noisy, particularly ransomware and aggressive adware. Other threats are designed to remain unnoticed.

A password stealer gains little from making the computer unusable. Its purpose may be to collect browser passwords, authentication cookies, cryptocurrency wallets or business credentials and then disappear.

A computer that appears normal is therefore not automatically secure. Updates, endpoint protection, controlled administrator access and account monitoring are still necessary.

Myth 8: “The Only Reliable Fix Is to Wipe the PC”

Reinstalling Windows can be appropriate after a serious compromise, but it is not always necessary.

A straightforward adware infection or unwanted extension may be resolved by:

• Removing the application
• Deleting the extension
• Revoking browser permissions
• Resetting the browser
• Running a security scan
• Updating the system

A clean reinstall becomes more appropriate when:

• Ransomware has executed
• An attacker obtained administrator access
• Security controls were deliberately disabled
• Remote access was given to a scammer
• Malware returns after removal
• Sensitive business data may have been accessed
• The integrity of the computer cannot be confirmed

The NCSC’s recovery advice includes removing the infection, restoring the device and taking steps to prevent the attacker from regaining access. 

What to Do When You Suspect Malware

1. Stop Using the PC for Sensitive Tasks

Do not use the suspected computer for banking, password changes or confidential business work.

2. Disconnect It When the Behaviour Is Serious

Disconnect the network cable and turn off Wi-Fi if files are being encrypted, unknown remote-control activity is visible or data appears to be leaving the computer.

3. Record What Happened

Take photographs or screenshots of:

• Security alerts
• Ransom messages
• Suspicious applications
• File changes
• Unusual account notifications

Record what was opened or installed immediately before the problem began.

4. Run Trusted Security Scans

Update Windows Security or your organisation’s endpoint-protection system.

Run a full scan rather than relying only on a quick scan. For persistent Windows threats, consider Microsoft Defender Offline.

5. Review Installed Applications and Browser Extensions

Remove unfamiliar programs only after confirming that they are not legitimate Windows components, drivers or business tools.

Check browser extensions, startup applications and website-notification permissions.

6. Change Important Passwords From a Clean Device

Prioritise:

• Email
• Microsoft account
• Banking
• Cloud storage
• Business accounts
• Password managers
• Social media

Enable multifactor authentication and sign out unknown sessions.

7. Contact Your IT Provider

Business computers may contain client records, financial information, saved credentials or access to cloud services. Even a single infected endpoint can create a wider organisational risk.

The NCSC recommends isolating affected systems, investigating the incident and ensuring backups cannot be damaged by the infection. 

How to Reduce the Risk of Future Infection

The strongest protection comes from several controls working together:

• Keep Windows, browsers and applications updated.
• Use trusted, centrally managed endpoint protection.
• Remove unnecessary administrator access.
• Enable multifactor authentication.
• Block unapproved applications and browser extensions.
• Maintain secure, tested backups.
• Use email, web and DNS filtering.
• Avoid pirated or cracked software.
• Verify unexpected attachments before opening them.
• Never grant remote access following an unsolicited call or pop-up.
• Report suspicious behaviour quickly.

Businesses should make it easy for employees to report concerns without fear of blame. Early reporting often prevents a minor issue from becoming a serious breach.

The Practical Test: Look for Evidence, Not Just Symptoms

One unusual symptom rarely proves that malware is present.

A slow computer could need maintenance. A browser pop-up could be a notification scam. A busy processor could be installing updates.

Concern becomes more justified when several independent warning signs appear together, particularly when they follow a risky download, suspicious attachment or remote-access session.

Look for concrete evidence:

• Confirmed security detections
• Unauthorised software
• Persistent browser changes
• Disabled protection
• Encrypted files
• Unknown account activity
• Unexplained remote control
• Suspicious network communication

When the evidence is unclear, it is safer to have the computer professionally examined than to continue using it for sensitive work.

Worried Your PC May Have Malware?

Hamilton Group can inspect suspicious computers, remove malicious or unwanted software, check browser and security settings, investigate account compromise and help protect your business against further incidents.

For professional IT support, call Hamilton Group on 0330 043 0069 or visit hgmssp.com to book a meeting with one of our experts.