Unexpected Signs Your Computer Has a Virus (and What to Do)

The signs your computer has a virus are rarely the dramatic ones you expect. No skull on the screen, no flashing alarm. Instead you get a laptop that boots 40 seconds slower than last month, a fan that spins at idle, and a data meter that climbs while you sleep. Those quiet symptoms are the modern infection, and in 2026 they usually mean an info-stealer is quietly shipping your saved passwords and browser cookies to someone else.

I’ve cleaned malware off more machines than I can count over 18 years of building and fixing websites and the computers behind them. The pattern almost never changes: by the time most people suspect a virus, the malware has been resident for days. So here’s the verdict up front. If your PC suddenly slows down, your storage fills with no explanation, files go missing or get renamed, or your contacts start getting spam from you, treat it as an active infection until a full scan proves otherwise. Don’t wait. Disconnect, scan, and change your passwords from a clean device. The rest of this guide walks each computer virus sign, what it actually means, and exactly what to do.

Proof: I’ve run recovery on infected Windows and macOS machines for clients across 800+ projects since 2008, and I keep current with the annual threat reports. The signs below map to what security telemetry confirms: IBM tracked more than 16 million devices infected by info-stealers like Lumma, Acreed, and Vidar in the last year, and Verizon’s 2025 Data Breach Investigations Report found ransomware present in 44% of breaches, up 37% year over year. The slowdowns and odd network activity you notice are the visible edge of that.

Computer viruses have been around a long time. The first self-replicating programs appeared in 1949, and the term “virus” was coined in 1983 by Frederick Cohen. But the threat in 2026 looks nothing like a 1980s boot-sector virus. Today’s malware is built to stay hidden and monetize you: ransomware that encrypts your files for payment, and info-stealers that grab your logins and session tokens so an attacker can walk straight into your accounts. Endpoint vendors still record more than 500,000 new malicious files every day, and the known-sample count has passed 1.5 billion. The signs that something is wrong, though, are still mostly the same handful you can learn to spot.

What changed in 2026: The scary part of modern malware is no longer the file it deletes, it’s the data it quietly copies. Info-stealers have become the main on-ramp for account takeover, cloud compromise, and extortion. And a growing share of ransomware now skips encryption entirely, stealing your data and threatening to leak it instead. Security researchers warn these attacks are getting faster and more automated as attackers fold in AI. That’s why “my PC feels a little slow” deserves a real scan now, not next month.

What to do right now if you think you’re infected

If you recognize the signs of a computer virus below, act in this order before you do anything else. The single most important move is to cut the malware off from the internet so it can’t keep stealing data or spreading. Every minute a stealer stays online is more of your data leaving the building.

1. Disconnect from the network. Turn off Wi-Fi and unplug the Ethernet cable. This is the first step security agencies recommend the moment you suspect ransomware or a stealer, because it stops data exfiltration and lateral spread.
2. Don’t reboot or “clean up” yet. Rebooting can trigger encryption routines or wipe forensic clues. Leave the machine on but offline.
3. Run a full offline scan. Use the built-in Microsoft Defender Offline scan on Windows, or a reputable on-demand scanner like Malwarebytes, to catch what a normal scan misses.
4. Change your passwords from a different, clean device. Phone or another computer, not the infected one. Start with email, banking, and anything with money attached.
5. Turn on two-factor authentication everywhere. Info-stealers grab saved passwords and session cookies, so 2FA is your backstop when credentials leak.
6. Restore from a known-good backup if files are encrypted. Never pay a ransom on faith. Wipe and restore.

Signs your computer has a virus, and what each one means

Before the section-by-section breakdown, here’s the quick reference. Match the symptom you’re seeing to the likely cause, then jump to the matching section for the fix.

Sign you notice	What it usually means
Slow boot and sluggish performance	Malware running in the background, eating CPU and memory
Files missing, renamed, or corrupted	Self-replicating malware or early-stage ransomware encryption
Storage fills up with no explanation	Malware writing copies of itself or staging stolen data
Frequent freezes and crashes	Malware conflicting with system processes or your OS
Contacts get spam “from you”	Email or account hijack, credentials already stolen
Network activity while idle	Info-stealer transmitting data to an external server
Antivirus or firewall turned off on its own	Malware disabling defenses to avoid detection

Your PC is slow to start and slow to perform

A healthy PC doesn’t crawl for no reason. When your machine suddenly takes much longer to boot, apps hang, and the fan runs hard while you’re doing nothing demanding, malware is one of the most common culprits. Slowing the system down is almost a side effect of how malware works: it’s running its own processes, indexing your files, or pushing data out over your connection, and all of that steals CPU cycles and memory from you.

Open Task Manager on Windows (Ctrl+Shift+Esc) or Activity Monitor on macOS and look for an unfamiliar process pinning the CPU or network. Scan frequently even if you have antivirus installed, and run a manual full scan now and then, because some malware specifically tries to slip past a single real-time scanner. If you want to rule out a non-malware cause first, my guide to boosting the performance of a low-end computer walks through the usual suspects.

You have missing, corrupted, or duplicated files

Many viruses self-replicate, and some delete or corrupt files at random. In 2026 there’s a more sinister version of this sign. If you find files suddenly renamed, given a strange new extension, or encrypted so they won’t open, that’s a classic early symptom of ransomware. Don’t dismiss a folder full of files that won’t open as a glitch.

The moment you see files being renamed or encrypted in real time, disconnect from the network immediately and stop using the machine. Ransomware often encrypts in waves, so cutting it off early can save the files it hasn’t reached yet. Then scan, and restore anything damaged from a clean backup rather than trying to “repair” encrypted files on the infected drive.

Your storage space suddenly becomes full

If your drive fills up fast and you didn’t download or transfer anything large, something is writing data without your knowledge. Self-replicating malware copies itself across folders, and some strains stage stolen data on disk before sending it out. Either way, an unexplained storage spike is worth a scan.

Sort your files by size to find what’s eating the space, and watch for unfamiliar folders in system directories or your user profile. A sudden jump in disk usage paired with the slowdown above is a strong combined signal that you’re infected, not just low on space.

Your computer suddenly crashes and freezes

A computer doesn’t crash spontaneously. Repeated freezes, blue screens, or hard crashes usually point to a hardware fault, a bad driver, or malware interfering with system processes. When the crashes started right after a slowdown or a sketchy download, malware moves to the top of the suspect list.

Boot into Safe Mode, which loads only essential drivers and starves most malware of the processes it needs, then run a full scan from there. If the system is stable in Safe Mode but unstable normally, that gap itself is a tell that something is loading at startup that shouldn’t be.

Your email or accounts get hijacked

You normally authorize an email before it goes out. So when friends and colleagues start complaining about spam coming from your address, or you get alerts about logins from places you’ve never been, your credentials are already in someone else’s hands. This is exactly what info-stealers are built to do: harvest saved passwords, browser cookies, and session tokens so an attacker can reuse a session you already logged into, sometimes bypassing your password entirely.

If this is happening, change your passwords from a clean device immediately and turn on two-factor authentication. A good password manager makes that fast, and I cover the best ones in my guide to password managers. Then keep going down the list below, because email hijack is rarely the only thing the malware touched.

How to remove a virus and keep it off

Once you’ve disconnected and scanned, removal is mostly about being thorough. Run a full scan with a reputable engine, quarantine or delete what it finds, reboot, and scan again to confirm the machine comes back clean. On Windows, the built-in Microsoft Defender is genuinely capable in 2026 and runs at no cost. For a stubborn infection or a second opinion, an on-demand scan from Malwarebytes catches things a single scanner can miss. If you want a paid suite that bundles real-time protection with extras, Bitdefender is the one I recommend most often, and Surfshark Antivirus is a solid value if you also want a VPN in the same subscription.

Prevention is cheaper than recovery every single time. Keep your operating system and apps fully patched, since most malware rides in through known holes that updates close. Set your antivirus to update and scan automatically. Back up your important data on a schedule so ransomware loses its leverage. Be skeptical of attachments, downloads, and links, which is still how the vast majority of infections start. And on untrusted networks, route your traffic through a VPN. I explain the case for that in why you should use a VPN.

If you want to go deeper on staying protected, three of my guides pick up where this one leaves off: five tips to ensure defense from cyber threats, the practical steps in WiFi security measurements every user should know, and, if you run a company, best practices to secure your business. A virus on your machine doesn’t just slow it down. In 2026 it can hand over your accounts and your data. Catch the signs early, disconnect, scan, and you turn a potential breach into a bad afternoon.

Disclaimer: This site is reader-supported. If you buy through some links, I may earn a small commission at no extra cost to you. I only recommend tools I trust and would use myself. Your support helps keep gauravtiwari.org free and focused on real-world advice. Thanks. - Gaurav Tiwari