How to identify and handle malware signs in your devices amid rising scams

Expert guidance on distinguishing genuine device issues from malware infections, recognising warning signs, and taking effective steps to secure your devices and accounts against evolving threats.

A slow computer or an alarming pop-up is not, by itself, proof of malware. What matters more is whether the device has made changes you did not approve: unfamiliar applications, changed browser settings, redirected searches, disabled security tools, or messages sent from your accounts. Those are stronger signs that something is wrong, and the safest response is to stop interacting with the warning, use a trusted scanner, and secure your accounts from a separate clean device.

The terms people use casually often describe different threats. Malware is the broad umbrella for malicious software. A virus spreads by attaching itself to other files or systems, while a trojan pretends to be legitimate software. Spyware is designed to monitor activity or steal information without consent, and ransomware locks or encrypts data until payment is demanded. Adware and browser hijackers may be less destructive, but they can still alter settings, push advertisements, and send searches to places you did not choose. Microsoft also distinguishes potentially unwanted applications from classic malware, which is useful because unwanted software may still be intrusive even if it does not meet a stricter definition of a virus.

Before doing anything else, ignore the instructions in the warning itself. Do not call any phone number shown in a pop-up, and do not click buttons such as “clean”, “renew”, “remove virus” or “allow” if they appear in an unsolicited alert. The US Federal Trade Commission warns that these messages are often part of tech-support scams. If you clicked a link, opened an attachment, or can see active suspicious behaviour, stop entering passwords or payment details on that device. If ransomware, remote control, or rapid account abuse seems to be under way, disconnect from the internet. On a work machine, contact IT before deleting anything.

The next step is to run a trusted scan. Use built-in security tools or software you obtain by typing the vendor’s official address yourself, rather than by following an ad, pop-up or caller’s instruction. Microsoft recommends using Windows Security or Microsoft Defender to run a quick scan first, followed by a full scan if concerns remain, with an offline scan reserved for more stubborn threats. If a detection is confirmed, quarantine or remove it. Allowing a file should be a deliberate choice made only after checking the file, the publisher and the detection details.

It is also important to separate device problems from account compromise. A password reset notice, an unfamiliar login, money leaving a bank account, or messages sent from your email can mean your account has been taken over even if the device itself is clean. In that case, use the service’s official recovery route from a known-safe device, change the password, turn on multifactor authentication, revoke active sessions and third-party access, and check forwarding rules and recovery details. If payment information may have been exposed, contact the bank as well.

Several symptoms can suggest infection, but they are not conclusive on their own. Slower performance, freezing, crashes, battery drain, fan noise, higher data usage and storage disappearing can all point to malware, yet they can also come from low disk space, overheating, too many startup items, browser extensions, or pending updates. Malwarebytes and McAfee both note that unexplained pop-ups, crashes and reduced speed are common warning signs, but they are only part of the picture. The key question is whether those symptoms are paired with unauthorised changes.

Stronger evidence includes a homepage or search engine changing without consent, new toolbars or extensions appearing, security software being disabled, or browser windows continuing to open after the browser is closed. Messages sent from your accounts without permission, files suddenly encrypted or inaccessible, and unusual password reset alerts are also serious indicators. On mobile devices, unfamiliar accessibility permissions, device-admin apps, VPN profiles, microphone or camera access, and screen-recording rights deserve close scrutiny. Kaspersky and McAfee both point to abnormal battery drain and data spikes as possible clues on phones, but those signs only matter when they line up with something you did not authorise.

On Windows 10 and Windows 11, Microsoft advises opening Windows Security, checking for security-intelligence updates, and running a quick scan, then a full scan if needed. If the threat appears persistent, a Microsoft Defender Offline scan can help because it restarts the system and runs before many malicious processes load. Afterward, review Protection history, choose quarantine or removal for confirmed threats, and uninstall any software you did not intentionally add. Unfamiliar browser extensions should be removed separately. Microsoft also warns against running two real-time antivirus products at the same time, because that can create conflicts and reduce performance.

The same general approach applies on Macs, Android phones and iPhones, although the menus differ. On macOS, check for unknown login items, background items, profiles, VPNs and browser extensions, then update the system and remove suspicious applications. On Android, ensure Google Play Protect is enabled, review permissions for accessibility, device administrator, SMS, notification, camera, microphone and location access, and remove unfamiliar apps. On iPhone and iPad, update the operating system, check for unknown profiles under VPN & Device Management, and review linked Apple Account devices. Security apps on iPhone can help with phishing and risky web activity, but they are not a cure-all for every possible compromise.

If a scan finds nothing, that does not automatically mean the device is healthy, but it does suggest a less dramatic explanation may be more likely. At that point, remove unknown extensions and notification permissions, uninstall recently added software, install all updates, and review storage, startup items, browser settings and battery health. If the problem returns after reboot, if security tools are being blocked, or if you cannot establish trust in the device, professional help may be the safer option. In serious cases such as ransomware, repeated reinfection, suspected remote access, financial theft or stalking, it may be necessary to preserve evidence before wiping the machine.

A full reset should be treated as a last but sometimes necessary step. Before reinstalling an operating system, save only known-clean documents and photographs, secure accounts from another device, and make sure you can still access your passwords and authentication methods. Do not restore suspicious executables, cracked software or an entire browser profile without checking it carefully. To reduce the chance of a repeat incident, keep software updated, download only from official sources, maintain offline or otherwise protected backups, use multifactor authentication, audit app permissions and browser extensions regularly, and scan removable drives before opening files.