Signs your computer may be infected with malware

Something on the computer isn’t right. It’s slower than it was last month, a window keeps appearing about an antivirus subscription you don’t remember buying, or the browser opens on a page nobody chose. The question you actually want answered is whether this is malware or just a bad week for an ageing laptop.

Often it’s the laptop. Machines get slow because the disk is full, because someone left 40 browser tabs open, or because a five year old PC is running software written for a newer one. Ruling that out first is sensible, not naive.

But some symptoms are worth taking seriously straight away, and a few of them are easy to misread.

What malware actually covers

The Australian Signals Directorate defines malware as any type of code or software used for a malicious purpose. Its own list covers adware, information stealers, keyloggers, pharming, ransomware, trojans and backdoors, viruses and worms, and web shell malware.

That range matters, because the different types behave differently. Ransomware announces itself. An information stealer is designed so you never notice it. So “my computer seems fine” isn’t evidence of much.

ASD also notes that some malware pretends to be an antivirus or security product. Hold that thought, because it explains most of what we actually get called about.

The warning signs worth acting on

ASD publishes a list of signs that a device may be infected. These are the ones that come up most in a small business.

Pop-ups telling you to renew or update something. A warranty notice, an expired antivirus subscription, a driver that needs updating right now. ASD lists “suspicious pop-up ads about updating or downloading software” as a warning sign, and these are also the single most common thing a staff member reports to us.

The machine is slow when it shouldn’t be. Not slow with 12 apps open, slow with nothing running. Same for a laptop that gets hot, drains its battery quickly or runs its fan hard while you’re doing nothing demanding. ASD treats these as signs the processor is running at capacity for a reason you can’t see.

Apps crash, or the machine reboots on its own. Software fails for ordinary reasons, a bad update most of the time. A sudden pattern of crashes and restarts across several apps is different, and it’s on ASD’s list as “error messages you never used to see”.

Your browser opens somewhere you didn’t choose. A changed home page or a search that keeps landing on a site full of ads is a classic redirect. Changing the setting back doesn’t fix it, because whatever changed it is still there.

Files you can’t open, or a ransom note. Treat this as ransomware until proven otherwise and stop what you’re doing. Don’t start renaming or restoring files over the top of anything.

Unexpected apps, toolbars and icons. New software you didn’t install, or an extension that turned up in the browser by itself.

Account activity you can’t explain. Logins at odd hours or from somewhere you’ve never been, a password that no longer works, a large export of data. This is often the first real evidence of an information stealer, and it shows up in the account rather than on the screen.

Someone knows something they could only know from your device. ASD lists it, and it’s the one people dismiss because it sounds far fetched. It isn’t.

What we actually see on the service desk

Over the twelve months to 18 August 2026, six tickets across six different client businesses were about a suspected virus, malware or infection. Four of those six were a person reporting a warning message appearing on their screen.

None of them were a machine already encrypted. In every case the trigger was the pop-up itself.

That fits ASD’s point about malware impersonating security software. The warning is usually the attack, not a report of one. It wants you to ring a number or install a “fix”, and once you do, someone is on the phone talking you through giving them access.

So the practical rule is simple. A security warning that arrives with a phone number is a scam. Real antivirus software does not ask you to call anyone.

What to do in the first ten minutes

1. Don’t ring the number and don’t click the button. Close the window. If it won’t close, close the browser from the taskbar or restart the machine.
2. Don’t enter any passwords on that device. ASD’s recovery advice is explicit about this, because keystrokes can be logged. If passwords need changing, change them from a different device you trust.
3. Disconnect it from the network if you have real reason to think something is running, such as files you can’t open or software you didn’t install. Unplug the cable or turn off the Wi-Fi. Leave the machine on.
4. Run a quick scan. Open the Windows Security app from the Start menu, then Virus and threat protection, then Quick scan.
5. If you’re still not satisfied, run the offline scan. In the same place, choose Scan options, then Microsoft Defender Antivirus (offline scan). Microsoft’s own description of why it exists is worth knowing: it restarts the device and scans without loading Windows, so persistent malware has a harder time hiding. Save your open files first.
6. Tell your IT provider what you saw, including the exact wording of the message. That detail decides whether this is a cleanup or an account investigation.

About “free online virus scans”

The original version of this article said free online scans aren’t reliable. That’s too broad, so here’s what I’d actually say.

A web page that claims to be scanning your computer from inside a browser isn’t scanning anything. It can’t. Those pages exist to sell you something or to install the problem they’re offering to solve.

Software that runs on the machine is a different thing, and the one you already own is built into Windows at no extra cost. Use that before you download anything else.

What stops most of this

ASD’s small business guide names three measures as the starting point: turn on multi-factor authentication, update your software, and back up your information.

Multi-factor authentication is the one that matters most here, because it limits what a stolen password is worth. Updates close the holes malware uses to arrive in the first place. Backups are what make a ransomware demand a nuisance rather than a disaster.

None of that is exotic, and none of it needs a new product.

One thing to do today: tell your staff that a security warning with a phone number in it is always a scam, and that nobody will ever be in trouble for closing the window and asking. That single sentence prevents most of what we get called about.

If you’d like someone to look at a machine that’s been behaving oddly, get in touch.