Computer Virus Symptoms: Is Your PC Infected?
5 min read
When a computer starts behaving oddly, the first thought is usually "have I got a virus?". Most of the cases that reach me turn out to have nothing to do with malware: the disk is nearly full, an update is running in the background, or a browser extension is injecting ads. The reverse happens too. People go three months without noticing anything wrong, because the machine ran perfectly the whole time. How annoying a symptom feels and how serious the problem is are barely related. So the first step is not to start scanning. It is to work out which kind of symptom you are looking at.
1. What the symptom you are seeing usually means
The table below is where I start when a machine comes in. On the left is how people describe the symptom, in the middle is the more likely cause, and on the right is whether to drop what you are doing. It does not replace a proper check, but it does tell you what the next half hour should be spent on.
| What you see | What it more likely is | How worried to be |
|---|---|---|
| Slow to boot, fan running constantly | Disk nearly full, background updates, ageing hardware | Usually not malware. Check free space first |
| Browser home page changed, ads popping up | Adware or a malicious browser extension | Worth fixing, rarely serious |
| Programs you never installed appear on their own | Something really did get installed | Investigate |
| Antivirus switched off and will not switch back on | Malware protecting itself | Investigate |
| Files will not open, extensions renamed, a payment demand | Ransomware | Stop right now. See section 2 |
| Mouse moving on its own, screen acting as if operated | Remote control software is connected | Unplug the network now |
| Friends receive messages you never sent | The account was taken over; the PC may be fine | Change the password first, see section 2 |
The last row deserves an extra word. Plenty of people see their social account posting on its own and immediately reinstall the computer, but a stolen account and an infected machine are two different problems. The password may have leaked from an unrelated website and have nothing to do with this device. Get that wrong and you spend a day reinstalling while somebody carries on using the account.
2. Once you are sure something is wrong, unplug the network first
If you land on one of the rows that needs action, the first move is to cut the network: pull the cable out, or turn the wireless off. That stops anything still running from sending data out, and stops it receiving new instructions.
Note that this is unplugging, not shutting down. Powering off looks more thorough, but everything held in memory goes with it, and that is usually what tells you what the thing was doing and where it was connecting to. On a work machine, or one holding customer data, shutting down flushes away the most useful evidence you have. The one exception is ransomware actively encrypting files. That is the single case where cutting the power immediately is right, because every extra second costs you another batch of files.
While you are in there, check the sign-in history on your email and your bank for devices or locations you do not recognise. Most services have that page, and most of them let you sign every other session out with one click. It takes under five minutes and it is one of the few ways you can confirm for yourself whether somebody is still inside.
3. Four checks Windows can run without installing anything
Once the machine is off the network and the passwords are changed, these four checks need no extra software and fit inside half an hour. They will not always give you an answer, but they clear up most of the false alarms, and if you do end up needing help, you will have something concrete to hand over.
Four things you can finish in half an hour
- Run an offline scan. Open Windows Security, go to virus and threat protection, and pick the offline scan under scan options. It restarts the machine and scans before the system loads, which is the only way to catch the things that hide in the background protecting themselves.
- Look at what starts with the computer. In Task Manager, open the startup apps tab and look up every name you do not recognise. Look them up before disabling anything: a lot of unfamiliar entries turn out to be drivers.
- Look at what was installed recently. The app list in Settings can be sorted by install date. Scroll back to the days when things started feeling wrong and see what appeared around then.
- Clear out browser extensions. A hijacked home page or constant pop-up ads are down to an extension nine times out of ten. Remove anything whose purpose you are unsure of. Reinstalling the two you actually use costs very little.
4. A clean scan does not mean a clean machine
This is the part people misread most often. Antivirus compares what is on the machine against signatures for samples it already knows. A clean result means nothing matched anything known, not that the machine is fine. Tooling written for one specific target, a legitimate program that has been tampered with, or an attacker working through commands built into Windows itself can all pass without raising anything.
So the thing to judge is behaviour, not the number of detections. Is there a process you do not recognise connecting to an overseas address at the same time every day? Is there a user account nobody created? Is there a scheduled task that runs a command in the middle of the night? Each of those can be innocent on its own. Together they are not.
The same works the other way round. Thirty detections does not mean somebody targeted you. Most of them will be adware and trackers, and clearing them ends the story. Volume has never been a measure of severity.
5. When it is worth getting someone to look
Checking it yourself is worth doing. It saves money, and it makes you quicker the next time. Three situations are worth not carrying alone: the machine holds personal data belonging to customers or staff, you have to explain to a boss or a client what happened, or you have already cleaned it once and the symptoms came back. That third one is common, and it almost always means the way in was never closed. Clean it as often as you like and it will return.
Getting someone to look does not mean handing the machine over, and it does not mean letting an outsider into your company network. For a security check, you can run the tool yourself and send the output file back for me to interpret and write up. Nothing has to be opened up for remote access, and the machine stays where it is.
Asked directly, "is my computer infected?" usually has the answer no. What you need is confirmation, though, not reassurance. Use the table to sort the symptom, cut the network if the row says to, change passwords from a second device, and work through the four built-in checks. If you are still uneasy after that, or the machine holds data that cannot leak, that is the point where it is worth bringing someone in.
Common questions
- My computer got slow. Does that mean it has a virus?
- Usually not. The most common causes are a nearly full disk, too many programs launching at startup, or an update running in the background. Check free space and the startup tab in Task Manager first. If the slowdown was sudden and it arrived alongside programs you never installed or antivirus switching itself off, then it is worth investigating as an infection.
- Can I trust free online virus scanners?
- The security features built into Windows are enough to start with, so use the offline scan there first. If you do install something else, download it only from the vendor's own site. Searching for "free virus removal" and clicking the first result is itself a common way to get infected, because those sites exist to catch people who are already panicking.
- I already deleted the suspicious file. Do I still need a check?
- If it was adware, deleting it usually ends the matter. If the symptoms included antivirus being switched off or an account you did not create, or if the problem came back after deletion, then what you deleted was a result rather than the cause, and the machine is worth a proper look. Worth knowing too: deleting files removes the evidence of how it got in, which makes that question much harder to answer later.