Signs of malware: How to tell if your computer is infected

An employee mentions that their laptop fan has been running hard all week with nothing open. A day later, a client calls to ask about an odd invoice email that came from that employee’s address. If you have wondered how to tell if your computer has a virus, this is often what the signs of malware look like now: two small clues in two different places that turn out to be connected.

Most malware today is built to stay quiet. It steals passwords, watches email or waits for the right moment to launch ransomware, so some of the most important signs show up in your accounts rather than on the screen.

How to tell if your computer has a virus: signs on the machine

The FTC lists several common signs of malware. Any one of them can have an innocent cause, but they are worth reporting, especially when they appear suddenly.

• New sluggishness, freezing or crashing that doesn’t match how you are using it, or a fan running hard while the computer sits idle.
• A changed browser home page, or searches that redirect to sites you didn’t choose.
• New toolbars, extensions or add-ons you don’t remember installing.
• A flood of pop-ups, including fake antivirus or warranty warnings urging you to call a number.
• Repeated error messages from Windows or macOS.
• Security tools that are turned off or won’t open, such as Windows Security or Task Manager.
• Files you can’t open, or files with new extensions, which can mean ransomware has started encrypting data.

Signs in your email and accounts

Password-stealing malware often does its real damage in the cloud. Microsoft lists these as possible signs that a Microsoft 365 mailbox has been compromised:

• 01Inbox rules that forward mail to unknown addresses, or move messages into folders like RSS Subscriptions, Notes or Junk Email
• 02Messages in Sent Items or Deleted Items that you didn’t write
• 03Missing or deleted email
• 04Unexplained password changes or account lockouts
• 05A mailbox that is suddenly blocked from sending email
• 06Strange changes to your email signature or contact details

Also watch for multifactor authentication prompts you didn’t trigger. A push request at 6 a.m. while you are asleep means someone already has your password, so deny it and report it. On our side, email sign-in monitoring looks at a mix of signals, such as sign-ins from unexpected places, and it has caught real takeover attempts at client offices. When it does, we contain the account within the hour.

The infection trick to warn staff about

Attackers increasingly get people to install the malware themselves. One technique Microsoft has tracked closely is called ClickFix. A page that looks like a routine CAPTCHA or a “fix this error” prompt tells you to press Windows key + R, paste something and press Enter. The page has already copied a malicious command to your clipboard. Microsoft reports these campaigns deliver password stealers and remote access tools, and that it observed thousands of devices affected per month in early 2025, even on machines with endpoint detection and response running.

The rule for staff is simple: no legitimate website will ever ask you to paste a command into Windows to prove you are human. Close the page and tell IT. It belongs in your security awareness training.

Five steps when something looks wrong

1. Disconnect it from the network by unplugging the cable and turning off Wi-Fi. Leave it on unless IT says otherwise, since evidence can help show what happened.
2. Stop signing in to accounts on that device. The FTC warns that malware may be capturing what you type.
3. Call your IT provider and describe what you saw and when it started.
4. Change passwords from a clean device, starting with email, banking and anything stored in the browser, and confirm MFA is on.
5. Check the account for new inbox rules, forwarding and unfamiliar sign-ins, and have IT sign it out of all sessions.

Common mistakes

• Running a free online scanner and calling it fixed. A real cleanup finds how the malware got in, what it touched and whether it spread. Sometimes the safest fix is wiping the computer and restoring from a known-good backup.
• Shutting the computer down before IT has looked at it.
• Cleaning the laptop and forgetting the account. A stolen password or session still works from anywhere.
• Waiting a few days to see if it goes away.

If you keep client, patient or financial records, an infected computer can also become a compliance question. HHS guidance says that when ransomware encrypts electronic protected health information, a breach is presumed under HIPAA unless the organization can show a low probability that the information was compromised. Accounting firms, law firms and nonprofits that hold confidential client data face their own reporting duties, so your incident plan should say who decides whether an infection is reportable. That decision belongs in your compliance program before an incident. For the threats behind these signs, see our list of types of malware.

Spotting malware shouldn’t depend on someone noticing a noisy fan. Our layered cybersecurity puts a 24/7 security operations center behind every client’s devices, and it can isolate an infected device. Book a 15-minute call about anything on your computers that looks wrong right now, and we’ll help you work out what happened.

Frequently asked questions