Last reviewed: June 27, 2026
I’ve cleaned malware off WordPress sites enough times that I stopped being surprised by what infected sites look like. The most disorienting thing is how normal they can appear. Traffic behaving strangely. Weird links appearing in the source code. Redirects that only happen to certain visitors. Nothing visually broken.
Endpoint infections — malware on a Windows PC rather than a server — work similarly. The signs are often subtle, and many of the obvious “warning signs” you’ll read about are actually just slow hardware or an antivirus trying to upsell you.
This is how to tell the difference.
Signs that actually indicate infection
These are behavioral changes that don’t happen by accident.
Browser redirects you didn’t do. Your homepage changed to something you didn’t set. Searches route through an unfamiliar engine. Typing a URL takes you somewhere else first. This is almost always a browser hijacker — malware that modifies browser settings to route your traffic through ad networks or phishing pages.
Extensions or toolbars you didn’t install. Open your browser’s extension list. If you see something unfamiliar that you didn’t add, that’s a problem. Browser hijackers often arrive bundled with software installers — a checkbox you missed during installation added something you didn’t want.
Unexplained outbound network traffic. Open Task Manager (Ctrl+Shift+Esc), go to the Performance tab, and click “Open Resource Monitor.” Under Network, look for processes sending data that shouldn’t be. A browser sends data. A media player shouldn’t be connecting to external servers. If an unknown process is consistently sending outbound traffic, that’s worth investigating.
Files disappeared, got renamed, or became inaccessible. If documents you saved are gone or encrypted, ransomware is the most likely explanation. Ransomware typically renames files with unfamiliar extensions and leaves a ransom note. This is the most destructive type of infection and the reason offline backups matter.
Your antivirus software won’t open or update. Some malware specifically targets antivirus software to disable it. If your security tools suddenly stop running or update processes fail repeatedly, that’s more suspicious than a slow PC.
New admin accounts appeared. This one is easy to miss. Check Settings > Accounts > Other users. If there’s an account you didn’t create, something created it for a reason.
Signs that are probably not malware
These are common explanations that get blamed on viruses but usually aren’t.
Computer is slow. This is the most over-attributed symptom. Windows Update, search indexing, browser tabs with heavy JavaScript, startup programs, a full hard drive, fragmented storage, or just aging hardware all cause slowdowns. Open Task Manager and look at what’s using CPU and memory before assuming infection. A cryptocurrency miner would show up as a process using high CPU constantly — that’s different from general slowness.
Popup windows. There are two types. Real antivirus notifications come from software running in your system tray — they appear as Windows notifications in the corner of the screen or inside the security app itself. Browser popups claiming your computer is infected, especially ones with phone numbers or countdown timers, are scareware. They’re designed to look alarming enough that you click or call. Don’t.
A security warning you haven’t seen before. Windows SmartScreen, Microsoft Edge warnings, and Windows Defender notifications can look alarming when you first encounter them. A SmartScreen warning about an unfamiliar download doesn’t mean you’re infected — it means you downloaded something Windows hasn’t verified yet.
High CPU during certain tasks. Video calls, browser-based apps, and games legitimately use a lot of CPU. If high usage happens only when you’re doing something demanding, that’s normal behavior, not malware.
The fake virus popup problem
This deserves its own section because it’s become the most common security issue people encounter.
The setup is always similar: you’re browsing, a popup appears claiming your computer is infected. It often looks like a Windows notification or uses the logo of a real antivirus brand. It tells you to call a number immediately.
Never call that number. Real antivirus software does not put phone numbers in browser popups. Real Windows errors don’t appear in the browser — they appear in the Windows interface itself.
What these popups actually are: malvertising (malicious ads on legitimate sites) or websites designed to generate false alerts. The goal is to get you to call a fake “support” number where someone will request remote access to your computer and potentially install actual malware while pretending to remove a virus that was never there.
How to close them safely: don’t click anywhere inside the popup, including the X button, which may trigger a download. Use your browser’s window controls at the top of the screen, or press Ctrl+W to close the tab. If you can’t close it, press Ctrl+Shift+Esc to open Task Manager and end your browser process.
What to actually do if you suspect infection
Step 1: Don’t panic. Most infections are not catastrophic. Ransomware is the exception.
Step 2: Close anything suspicious without clicking inside it. Use Task Manager if needed.
Step 3: Run a full scan with your installed antivirus. Not a quick scan — a full one. This takes longer but checks more.
Step 4: Run Malwarebytes Free as a second opinion. It catches adware and potentially unwanted programs that traditional antivirus sometimes misses. Install from malwarebytes.com only — not from a search ad.
Step 5: If both scans are clean but symptoms persist, check your browser extensions, your startup programs (Task Manager > Startup tab), and your installed apps list for anything unfamiliar. Remove what you don’t recognize.
Step 6: If you found and removed something, change your passwords for important accounts — email, banking, anything you access through that machine. Assume the infection may have had access to what you typed.
What you don’t need to do: reformat and reinstall Windows for every infection. That’s a last resort for severe cases, not a routine response to adware.
A note on infection sources
Most people who get infected aren’t doing anything dramatic. Common sources: pirated software and games, unofficial download sites that bundle extras into installers, clicking links in email that looked plausible, browser extensions from outside the official extension stores, and occasionally malvertising on legitimate sites.
The pattern I’ve seen repeatedly on client sites and in community discussions: people are surprised how ordinary the vector was. Not a sophisticated attack. A checkbox they missed. A link they didn’t look at closely. A free download from a site they’d used before.
That’s worth knowing, not to create anxiety, but because it points at where actual prevention lives: habits, not just software.
