Common signs of malware include a device that suddenly runs slowly, programs or settings you did not change, unexpected pop-ups, new accounts or software, and security tools that switch themselves off. None of these proves infection, and well made malware may show no sign at all, so treat odd behavior as a reason to check, not a verdict.
What counts as malware?
CISA defines malicious code as unwanted files or programs that can cause harm to a computer or compromise data stored on it. It names three broad families. Viruses can damage or destroy files and spread through shared infected media, malicious email attachments and malicious web pages. Worms are a type of virus that self-propagate from computer to computer and can use up a machine's resources until it stops responding. Trojan horses are programs that hide a virus or other damaging program, and CISA notes it is not uncommon for free software to contain one, so the user believes the program is legitimate while it does something else.
CISA also notes that malicious data files, such as a document, a PDF, a ZIP file or an image, can exploit weaknesses in the software that opens them. A file does not need to be an executable to be a problem.
Which behaviors are worth a second look?
These are practical indicators, not a definitive list, and each has innocent explanations:
- Sudden slowness, overheating or a fan that never stops, especially when you are idle. Worm-like behavior consumes resources.
- Programs, browser home pages or search settings that changed without you changing them.
- Pop-up advertisements appearing outside the browser or on sites that normally do not show them.
- Software or browser extensions you do not remember installing.
- Your antivirus or update service turned off, and not turning back on.
- Contacts receiving messages you did not send, or you getting replies to emails you never wrote.
- Files that are renamed, missing or suddenly unopenable.
- On a phone, a battery that drains fast, unexplained data use, or apps you did not install.
- Login alerts from places you have not been.
Why might there be no signs?
Because the point of much modern malware is to stay hidden: collect credentials, wait, or move to other machines. CISA's ransomware guidance makes this concrete for organizations, saying a ransomware event may be evidence of a previous, unresolved compromise, with precursor malware sometimes present before the visible damage. By the time a screen locks, the intrusion may be weeks old.
A constructed example
A bookkeeper notices that her laptop fan runs constantly and her browser home page changed. She also remembers installing a free PDF converter last week. She disconnects the laptop from the network, uses a different device to change her email and bank passwords, and tells the IT contact, who runs a scan from a clean tool and finds a Trojan bundled with the converter. They reinstall the system from a clean image, restore her documents from a backup made before the install, and enable multifactor authentication on her accounts. The pop-ups were annoying. The saved passwords were the real exposure.
How to check or apply this
- Disconnect the device from the network if you suspect infection.
- From a different, clean device, change passwords for important accounts and turn on multifactor authentication.
- Run a scan with a trusted security tool and review installed programs and extensions for anything you did not choose.
- If it is a work device, report it. Do not try to fix it quietly.
- Where infection is confirmed, reinstall from a clean image and restore data from a backup you trust.
- Use an account with limited permissions for daily work, as CISA advises, so an infection has less to damage.
- Be wary of unsolicited attachments and links, even from people you know, and block pop-up advertisements, as CISA suggests.
- Keep software updated and install programs only from sources you trust.
Quick check
Is slow performance always malware?
No. Full storage, background updates or old hardware cause it too. Look for slowness together with other signs, such as unknown programs or changed settings.
Can malware be hidden in a normal looking file?
Yes. CISA notes that documents, PDFs, ZIP files and images can exploit weaknesses in the software that opens them.
Sources
Last reviewed: 18 October 2026.
