How to tell if your computer has a virus

Most of the time when someone tells me they think their computer has a virus, it doesn't and it ends up being something else like having a nearly full hard drive, or a failing one, or a pile of browser extensions, or it's a five-year-old laptop that's just plain old and slow. The symptoms often look alarming — slow, weird, popping things up — but it isn't always malware, and the fix for a disk-space problem is not an antivirus subscription.

If you spend money on an antivirus subscription to solve a disk-space problem, you still have a disk-space problem and now you're out $60. So it's important to first figure out if what you're seeing is an infection or something else.

What an infection looks like, and what it doesn't

Real signs of malware on a Windows machine:

• Pop-ups appearing on the desktop when no browser is open.
• Your home page or default search engine changes by itself, and changing it back doesn't stick.
• Programs starting up that you never installed.
• Task Manager, Settings, or your antivirus won't open - or opens and then closes immediately.
• Your computer is sending email or posting things you didn't send or post.

Things that look like malware but usually aren't:

• Slow startup on a laptop that's four or five years old.
• A fan running loud.
• A browser running very slow with twenty tabs open.
• Websites showing you ads.
• A weird pop-up inside a browser that went away when you closed the tab.

If what you're seeing is in the second list, you probably don't have a virus. You more than likely just have a normal computer that needs to be upgraded, which I cover in this article: Upgrading an older laptop or PC.

How to check if your computer has a virus

Do these before you spend any money.

Check free disk space

Open File Explorer, click This PC, and look at the C: drive. If it's down to the last few percent, that alone will make a machine feel broken: slow to boot, slow to open things, programs crashing. Clear out downloads, empty the recycle bin, and uninstall apps that you don't use. If the drive fills back up on its own after you clean it, that's a different problem and worth looking into, but it's still not a virus.

Look at what runs at startup

Press Ctrl+Shift+Esc to open Task Manager, click the Startup apps tab, and read the list. Right-click and disable anything you don't recognize. You're not deleting anything; you're telling it not to launch when Windows starts. Reboot and see how the machine feels. A lot of "it's gotten so slow" turns out to be a dozen programs loading at startup time.

Review your browser extensions

In Chrome, Edge, or Firefox, open the extensions page and look at what's installed. Remove anything you don't remember adding, anything that promises coupons or shopping deals, and anything whose name you can't explain. Extensions are the single most common source of browser pop-ups, redirects, and "my search engine changed by itself" complaints, and they're not malware in the traditional sense. Someone using the computer clicked "Add" at some point.

Run Microsoft Defender

Open Windows Security from the Start menu, click Virus & threat protection, and run a full scan. Defender is the antivirus built into Windows 10 and 11, and it is genuinely good now. It consistently scores at or near the top of the independent antivirus test labs. There is no need to install a second antivirus to "really check," and in fact installing one often causes more problems than it solves.

When a paid scanner is worth it

A few situations where adding a second scanner on top of Defender makes sense:

• A machine that's already infected and fighting you — Defender won't open, or it finds something and the thing comes back.
• A computer that gets cleaned and reinfected within a few weeks.
• An older relative's computer where someone needs an extra set of eyes on what's running.
• A household where someone keeps installing things from wherever.

For a second-opinion scanner, I recommend Malwarebytes. It's designed to run alongside Defender, not replace it, and the free version will do an on-demand scan. The paid version adds real-time protection which is what you need for ongoing protection... but for a once-in-a-while check, the free version is enough.

What to do if the machine is infected

If Defender or Malwarebytes finds something real, or the symptoms from the first list are clearly present:

1. Disconnect the computer from the network. Unplug the ethernet cable or turn off wifi. This stops the infection from talking to whoever sent it and from spreading to other devices on your network.
2. Scan from Safe Mode by restarting Windows in Safe Mode and running the scan from there. Less of the machine is running, which means less of the malware is running, which means the scanner has a better chance of removing it.
3. Change your passwords from a different device. Use your phone or another computer, not the infected one. Start with email, then anything financial, then anything else important. If the infected machine was logging your keystrokes, typing a new password on that infected machine just hands that one over too.
4. Check anything financial. Look at recent charges on your credit cards and recent activity on your bank accounts. If you see something you didn't do, call the bank.

If the machine gets scanned clean and the symptoms come back within a few days, then as a final resort you might need to reinstall Windows. But in most cases Malwarebytes should be able to fix the problem before it comes to that.

Scams that pretend to be infections

There are a couple of things to carefully look out for: the full-screen pop-up and the phone call.

The full-screen pop-up says your computer is infected and tells you to call a phone number. Real antivirus software never asks you to call anyone. Close the browser (Alt+F4, or shut the machine down if you have to) and ignore the number.

The phone call comes from someone claiming to be from Microsoft, saying they've detected a problem on your computer and need remote access to fix it. Microsoft doesn't do this, and neither does any legitimate caller. Hang up immediately.

If you want more on how to tell real sites and real contacts from fake ones, I wrote about that here: how to tell if a website is real before you type your credit card in, and how to spot and block scammers on your iPhone.

An ounce of prevention...

Here are a few things you can do to keep your computer from getting infected in the first place:

• Keep Windows updated. Most of what the updates fix are the holes malware uses to get in.
• Keep backups. An external drive, a cloud backup, or both.
• Be careful what you install. Free programs from sites you've never heard of are where most of this comes from. Browser extensions too — there's a related post on stopping Windows 11 from reinstalling apps you already deleted that covers some of the junk that ships preinstalled.