How to tell if your computer might be infected with malware

TL;DR — If your computer suddenly shows fake security pop-ups, browser redirects, unknown logins, disabled antivirus, unexplained slowness, or heavy network activity when you are doing nothing, treat it as a possible infection, not just "a glitch." The single most useful first move is to disconnect it from Wi‑Fi or unplug Ethernet, then run your built-in security scan and review startup apps, browser extensions, and recent account sign-ins. Reading time: ~7 min

What it is and where it sits

When people say a computer is "infected," they usually mean some kind of malware (malicious software) is running on the device. That can include adware (software that injects ads), spyware (software that watches activity), a password stealer, ransomware (software that locks files for payment), or a remote access trojan (software that lets someone else control the machine).

In endpoint security, your computer is the endpoint (the laptop, desktop, or workstation where a person works). Malware lives on that endpoint: in memory (active running code), on disk (files), in startup settings (so it launches again after reboot), in the browser, or sometimes in firmware (low-level device software, much rarer).

From an architecture point of view, malware sits in the same places legitimate software sits:

• It can start as a downloaded file, email attachment, browser extension, or fake installer.
• It talks to the operating system through normal system calls (requests programs make to the OS).
• It often talks out to the internet to a command-and-control server (a server that sends instructions or receives stolen data).
• It may try to replace or interfere with your defenses by disabling antivirus, adding startup tasks, or changing browser and DNS settings.

A normal endpoint security stack tries to watch these layers:

• The operating system's built-in protections: Microsoft Defender on Windows, XProtect and Gatekeeper on macOS.
• EDR (Endpoint Detection and Response): software that records suspicious behavior and helps isolate or investigate a device.
• Identity systems: your email, Microsoft 365, Google Workspace, bank, and other accounts that may show suspicious sign-ins after credentials are stolen.

A typical infection flow looks like this:

[User] ---- 1. opens fake invoice ----> [Email/Browser]
[Email/Browser] ---- 2. launches file/script ----> [Operating System]
[Operating System] ---- 3. starts malware ----> [Endpoint]
[Endpoint] ---- 4. steals data / changes startup ----> [Browser, Files, Accounts]
[Endpoint] ---- 5. outbound traffic ----> [Attacker Server]
[EDR/Antivirus] <---- 6. alerts / blocks ---- [Endpoint]

The important idea: infection is not just "a bad file exists somewhere." It usually means code is executing, persisting, or communicating. That is why signs like repeated pop-ups, new startup items, unknown browser extensions, and unexplained network traffic matter more than one odd file name by itself.

How it actually works

Here is one realistic end-to-end example: a fake browser update installs an infostealer (malware that steals passwords and cookies).

Step-by-step example

1. You visit a compromised website and see a message like "Your browser is out of date — install this update."
2. You download and run a file that looks legitimate.
3. The file installs itself in a normal-looking folder and adds persistence (a way to survive reboot), such as a Windows startup entry or a macOS Login Item.
4. It reads browser cookies (small files that keep you signed in), saved passwords, and autofill data.
5. It sends that data to an attacker server over HTTPS (encrypted web traffic), which can make it look like ordinary internet activity.
6. The attacker uses the stolen session cookies to access your email or business apps without needing your password again.
7. You notice symptoms that seem unrelated: your browser homepage changed, the fan runs constantly, your email account shows a sign-in from another country, and your antivirus says real-time protection is off.

What you can observe as a non-expert

These are the strongest practical signals, especially when several happen together:

• Security tools are disabled and you did not disable them.
• Browser redirects: searches go to the wrong site, or your homepage/search engine changed by itself.
• New extensions, apps, or startup items you do not recognize.
• Constant CPU, memory, disk, or network use while the computer is idle.
• Password reset emails or login alerts you did not trigger.
• Files suddenly encrypted, renamed, or inaccessible.
• Pop-ups claiming you are infected and asking you to call a number or install a cleaner.

Where to check on Windows and macOS

Windows

Start with these built-in places:

• Windows Security: Start → search for Windows Security → Virus & threat protection → Quick scan or Scan options → Full scan.
• Startup apps: Settings → Apps → Startup. Turn off anything unknown, but first note the name and publisher.
• Task Manager: Right-click taskbar → Task Manager → Processes. Sort by CPU, Memory, and Network to spot unusual activity.
• Installed apps: Settings → Apps → Installed apps. Sort by Install date and look for recent unknown software.
• Browser extensions: In Chrome/Edge/Firefox, open the Extensions/Add-ons page and remove anything you did not install.

macOS

• Security scan basics: Open System Settings → General → Login Items & Extensions and review what starts automatically.
• Activity Monitor: Applications → Utilities → Activity Monitor. Sort by % CPU, Memory, and Network.
• Applications folder: Finder → Applications. Sort by Date Added and inspect recent unknown apps.
• Browser extensions: In Safari/Chrome/Firefox, review Extensions and remove anything unexpected.
• Profiles: System Settings → Privacy & Security or search for Profiles. Unknown profiles can force browser or network settings.

If the device is managed by your employer, there may also be an EDR agent installed. In that case, the local user may see a warning, but the real investigation usually happens in the company security dashboard.

When to use it (and when not to)

Use these checks when you need to decide whether you are looking at ordinary computer problems or a likely security issue.

You probably do not need to jump straight to incident response if the only symptom is "the laptop feels old and slow." Infection becomes more likely when the symptoms involve security settings changing, unknown software appearing, accounts being accessed, or network activity continuing while idle.

Trade-offs

Every detection step gives you useful signal, but it also costs something.

• Built-in antivirus scan

  • Benefit: Fast, available now, no extra purchase.
  • Cost: Can miss newer threats; full scans take time and may slow the machine.

• Reviewing startup items and extensions

  • Benefit: Very effective for common adware and persistence tricks.
  • Cost: Easy to misidentify legitimate software; removing the wrong item can break a business app.

• Disconnecting the device from the network

  • Benefit: Stops data theft and attacker control quickly.
  • Cost: Interrupts work, cloud sync, calls, and remote support.

• Changing passwords

  • Benefit: Critical if credentials may be stolen.
  • Cost: If done on the infected device, the attacker may capture the new password too. Use a different clean device.

• EDR tooling

  • Benefit: Better visibility into process launches, persistence, and outbound connections.
  • Cost: Subscription cost, setup effort, alerts to triage, and some vendor lock-in (dependency on one platform's agent and console).

• Factory reset / wipe and rebuild

  • Benefit: Highest confidence that the infection is gone.
  • Cost: Downtime, possible data loss, app reinstall work, and recovery effort.

⚠️ Do not start deleting random files from system folders because they "look suspicious." Removing the wrong file can make Windows or macOS unstable and can destroy evidence your IT provider needs to investigate.

In practice

Below are practical checks you can run today. Use the menu path first if you prefer, and the command line only if you are comfortable with it.

Example 1: Run a full Microsoft Defender scan on Windows

Menu path: Start → Windows Security → Virus & threat protection → Scan options → Full scan.

If you prefer PowerShell, open Windows Terminal or PowerShell as Administrator and run:

Start-MpScan -ScanType FullScan
Get-MpComputerStatus | Select-Object AMServiceEnabled,AntispywareEnabled,AntivirusEnabled,RealTimeProtectionEnabled

This starts a full Defender scan and then shows whether core protections are enabled. The gotcha: a full scan can take a long time and noticeably slow the computer while it runs.

Example 2: List startup entries on Windows

Menu path: Settings → Apps → Startup.

CLI option in PowerShell:

Get-CimInstance Win32_StartupCommand | Select-Object Name, Command, Location, User | Format-Table -AutoSize

This lists programs configured to start automatically at login. The gotcha: some legitimate enterprise tools have unfamiliar names, so search the publisher and path before disabling anything.

Example 3: Check active processes and network use on macOS

Menu path: Applications → Utilities → Activity Monitor → review CPU and Network tabs.

Terminal option:

ps aux | head -n 20
lsof -i -nP | grep ESTABLISHED | head -n 20

The first command shows running processes; the second shows active network connections. The gotcha: many normal apps keep background connections open, so this is a clue-gathering step, not proof by itself.

Example 4: Review browser extensions in Chrome

In Chrome, open the address bar and go to:

chrome://extensions/

This opens the extensions page so you can disable or remove anything unexpected. The gotcha: some malware installs a policy-managed extension, which may reappear or show as controlled by an organization; that is a stronger sign you should escalate.

What to do immediately if several red flags appear together

1. Turn off Wi‑Fi or unplug Ethernet.
2. Do not log into banking, payroll, or email from that device.
3. From a different clean device, change important passwords and review recent sign-ins.
4. Run the built-in full scan.
5. If this is a work device, contact your IT or security provider before trying more fixes.

⚠️ If files are being encrypted, renamed, or deleted in real time, power the machine off or disconnect it from the network immediately. This can interrupt work and may affect unsaved data, but delaying can increase damage.

Further reading

• Microsoft Defender Antivirus documentation, especially the "Scan types" and "View protection history" sections
• Apple Platform Security
• The "Protect yourself from phishing" and account activity sections of Google Account Help or Microsoft Account Help
• NIST Small Business Cybersecurity Corner
• CISA guidance on ransomware and phishing

This article was written by an AI system and published pending human review. Verify anything you intend to act on.