9 Signs Your PC Has a Virus (And What It Costs)

Most infections that reach this stage do it on purpose. Malware that can switch off Windows Defender, block antivirus updates or stop the antivirus program from opening at all is not an accident of a machine misbehaving. It is doing exactly what it was built to do: clear the one thing standing between it and the rest of the system.

Once your own defences are down, nothing is left checking what else the software is doing in the background. Turning the antivirus back on yourself rarely holds; well-built malware simply switches it off again within minutes. This is one of the clearest infection signs there is, and it should not wait.

This is ransomware, and it is the most serious sign on this list. The malware works through your files, often starting with documents and photos, renaming or encrypting each one so it can no longer be opened. Some versions leave a text file behind demanding payment to reverse it.

Paying is never the safe answer: it funds the people doing this and there is no guarantee the files come back. What matters is stopping it from spreading further and finding out how much can still be recovered. The machine should be shut down and left alone until it is looked at, because every extra minute it runs is a minute more files can be reached.

An email confirming a password change you did not make, a bank text about a login from an unfamiliar device, or a two-factor code you never requested all point to the same thing: something on the machine is watching what you type and sending it elsewhere. This is usually a keylogger or an infostealer, built specifically to sit quietly and harvest logins.

The infection itself is only half the problem. Every account you have logged into on that computer since it happened should be treated as exposed, which is why this is not something to leave for a convenient week. The sooner the machine is cleaned, the fewer accounts stay at risk while it keeps running.

If people you know are receiving messages or emails from you that you never sent, usually a link or an urgent request for money, the infection has reached the point of actively spreading. It has taken over an email account, a messaging app or a contacts list and is using your identity to reach the next machine.

This is not just embarrassing. Everyone who clicks that link becomes a new infection, and the accounts sending it are compromised in the same way the login alerts above are. It is worth a quick warning to the people it reached, but the machine itself needs to stop sending before anything else is done.

A browser hijacker changes the homepage, default search engine or new-tab page, usually to redirect searches through a site that earns the people behind it money on every click. It often arrives bundled inside free software, installed alongside a program you actually wanted without a clear prompt to opt out.

On its own it is more of a nuisance than a danger: search results get worse and pages take longer to load, but it is not usually stealing anything. It does tend to travel with other, less visible software, though, which is why a browser that has changed itself is worth having looked at properly rather than just reset.

Free software often comes bundled with extra programs that install alongside it unless you specifically opt out during setup, and plenty of people never see that screen. A toolbar in the browser, an unfamiliar icon on the desktop or a program running in the background you cannot account for is usually a sign of exactly that.

Most of it is low-grade adware rather than anything actively dangerous, but it rarely arrives alone. Once one unwanted program has made it through, it is common to find several more sitting alongside it, each one taking its own share of memory and processor time in the background.

A machine that reboots without warning, opens windows nobody touched or seems to click things by itself is being controlled by something other than you. This can be remote-access malware giving someone else a way into the machine, or a poorly written infection crashing the system as a side effect of what it is doing.

Either way, the computer is not fully under your control while it is running, which matters most if you use it for anything involving logins, banking or stored personal information. It does not always mean a serious breach, but it is not something to keep working around.

Not every infection announces itself. A lot of modern malware is built to stay quiet, because a program nobody notices can keep running for months, using the processor and the internet connection in the background for its own purposes. The only outward sign is a machine that feels slower than it should, especially when nothing is open.

This overlaps with the causes in our guide to slow computers, where hidden malware is one of seven possible reasons behind a slow machine. A slowdown on its own is not proof of a virus, since it can just as easily be an old drive or too much starting with Windows, which is exactly why the two problems get confused. It is common enough as an infection sign that it is worth having a machine looked at rather than assumed.

Adware is built to show ads: pop-ups over websites that do not normally have them, new tabs opening on their own, or ads appearing on the desktop with no browser running at all. It is usually the least harmful sign on this list, more a source of income for whoever installed it than an attempt to steal anything.

That said, "usually harmless" is not the same as harmless. Adware still runs without permission, and machines that pick up one unwanted program often have room for another to follow it in. It is the one sign here that genuinely can wait for a convenient time, rather than something to act on today.