What malware looks like when it's actually on your computer

Malware is software designed to harm your computer or steal your information. You find it by looking for signs that something is running without your permission — not by guessing or hoping your antivirus caught it. The most reliable way is to run a dedicated scan with a tool designed to detect it, then check what it finds.

Most people never see malware working. It runs in the background. You might notice your computer is slower, your browser homepage changed without you changing it, or you're seeing ads you didn't click on. Those are signs something might be wrong, but they're not proof. The only way to know is to scan.

Key Takeaways

  • Run a full system scan using Windows Defender (built into Windows) or a free tool like Malwarebytes to see what malware is actually present on your computer.
  • Restart your computer in Safe Mode before scanning, because malware often blocks itself from being detected while Windows is running normally.
  • Check your browser's homepage, search engine, and installed extensions — malware often changes these without asking, and you can spot it by looking.
  • If a scan finds malware, the tool will show you what it found and give you the option to remove it; you don't have to pay for removal unless you choose a paid version.
  • After removal, change your passwords for email and banking accounts from a different device, because malware may have recorded what you typed.

Running a malware scan on Windows

Windows comes with a built-in antivirus tool called Windows Defender (also called Microsoft Defender). It runs automatically in the background, but you can run a full scan manually to check for anything it might have missed. Open Windows Security by clicking the shield icon in your system tray or searching "Windows Security" in the Start menu. Click "Virus & threat protection," then "Scan options," then select "Full scan" and click "Scan now." This takes 30 minutes to several hours depending on how much is on your drive.

If you want a second opinion, Malwarebytes is a free tool many people use alongside Windows Defender. read it from malwarebytes.com, install it, and run a full scan. Malwarebytes is designed to catch things Windows Defender sometimes misses, especially newer or less common malware. You can use both tools — they don't interfere with each other.

After the scan finishes, the tool shows you what it found. If it found nothing, your computer is clean (or the malware is hiding in a way these tools can't see, which is rare). If it found something, the tool asks if you want to remove it. Click yes. Most of the time that's the end of it.

Scanning in Safe Mode to catch hidden malware

Some malware prevents itself from being detected while Windows is running normally. To get around this, restart your computer in Safe Mode, which loads only the bare minimum Windows needs to run. Malware can't hide as easily this way.

On Windows 10 or 11, hold Shift and click the power button in the Start menu, then click "Restart." Your computer restarts and shows a menu. Click "Troubleshoot," then "Advanced options," then "Startup Settings," then "Restart." After restart, press 4 or F4 to boot into Safe Mode. Your screen will look different — fewer colors, no background image. This is normal.

Once in Safe Mode, run Windows Defender or Malwarebytes the same way you would normally. The scan takes longer because Safe Mode is slower, but malware has fewer places to hide. After the scan and removal, restart normally.

Checking your browser for signs of malware

Malware often changes your browser settings without asking. Check your homepage by opening your browser and looking at what page loads first. If it's not what you set, something changed it. Check your search engine the same way — type something in the search bar and see which search engine handles it. If it's not Google, Bing, or whatever you chose, malware may have redirected it.

Look at your browser extensions. In Chrome, click the puzzle piece icon in the top right, then "Manage extensions." In Firefox, click the menu button (three lines) and select "Add-ons." Look through the list. Do you recognize everything there? If you see something you didn't install, it's probably malware. Click the trash icon or toggle to remove it.

Check your browser's startup pages and homepage settings directly. In Chrome, click the menu button, go to "Settings," then "On startup" — make sure it's set to what you want. In Firefox, click the menu, go to "Settings," then "Home" — check that your homepage is correct. If malware changed these, change them back.

What to do after you remove malware

After a scan removes malware, your computer is usually safe to use again. But malware often records what you type — passwords, credit card numbers, search history. Change your passwords for email and banking accounts. Do this from a different device if you have one (phone, tablet, another computer), because the malware might still be logging keystrokes even after removal.

If the malware was on your computer for weeks or months before you caught it, consider whether you entered sensitive information while it was there. If you did, contact your bank or credit card company and let them know. They can watch for fraud. If you entered passwords, change them everywhere you used them.

Keep Windows and your software updated. Malware often gets in through security holes in old versions of Windows, Adobe Reader, Java, or your browser. Windows updates automatically by default, but make sure it's turned on. For other software, check for updates manually or turn on automatic updates in the program's settings.

When to use paid antivirus instead of free tools

Free tools like Windows Defender and Malwarebytes catch most malware. You don't need to pay for antivirus protection unless you want extra features like real-time monitoring of downloads, automatic scans on a schedule, or a firewall. Paid versions of Malwarebytes, Norton, or Kaspersky offer these, but they cost money and use more of your computer's resources.

The trade-off: free tools require you to remember to scan manually, while paid tools scan automatically. If you're disciplined about running a scan once a week, free is fine. If you want to set it and forget it, paid might be worth it. Either way, the removal process is the same — the tool finds malware and you tell it to remove it.

Avoid antivirus tools that pop up ads claiming your computer is infected and demanding you buy their product when ready. These are often scams themselves. Stick with names you recognize: Windows Defender, Malwarebytes, Norton, Kaspersky, Bitdefender.

Signs your computer might have malware even after scanning

If your computer is still slow, still showing strange ads, or still redirecting your searches after you've run a full scan and removed what was found, malware might still be present. This is rare — most scans catch what's there — but it happens. Try scanning again in Safe Mode, or use a different tool. Sometimes one tool catches what another misses.

If you're seeing pop-ups that claim your computer is infected and tell you to call a number or read something, ignore them. These are fake warnings designed to scare you into clicking. Close the browser tab or restart your browser. Don't call the number.

If you're genuinely stuck — your computer won't start, or you've scanned multiple times and malware keeps coming back — consider taking it to a local computer repair shop. They have tools and experience for stubborn infections. It usually costs $50 to $150.

Frequently Asked Questions

Do I need to pay for malware removal?

No. Windows Defender and Malwarebytes both remove malware for free. If a pop-up tells you that you need to pay to remove malware, it's a scam. Close it and ignore it. Legitimate tools remove malware at no cost.

Will scanning for malware slow down my computer?

Yes, while the scan is running. A full scan uses a lot of processing power and can take an hour or more. Run it when you're not using your computer — overnight or while you're away. After the scan finishes and malware is removed, your computer should run normally again, possibly faster if malware was slowing it down.

Can malware come back after I remove it?

Yes, if you don't fix how it got there in the first place. Malware usually enters through old software, suspicious downloads, or phishing emails. After removal, update Windows and your software, avoid downloading from untrusted sites, and don't click links in emails from people you don't know. If it keeps coming back, you may have a different infection or a hardware problem.

What's the difference between a virus and malware?

A virus is one type of malware. Malware is the umbrella term for any software designed to harm you — viruses, spyware, ransomware, adware, and others. When people say "virus," they usually mean any malware. The scanning and removal process is the same regardless of which type it is.

Should I scan my computer if I haven't noticed anything wrong?

Yes, once a month or so. Malware often runs silently in the background. You might not notice it's there until it's been stealing information for weeks. A quick scan takes 30 minutes and gives you peace of mind. If you read a lot or visit unfamiliar websites, scan more often.