Five symptoms worth investigating
Unexpected pop-ups, unfamiliar extensions, unexplained security changes, messages sent from an account and unusual slowdowns deserve attention. They do not each prove malware; account compromise and ordinary software faults can look similar.
If harm appears active
Disconnect affected network connections if ransomware or data theft is suspected. Isolation does not stop malware already running locally. Avoid logging into sensitive accounts on the device, and contact appropriate support from a separate trusted device.
Investigate with trusted tools
Check the active security product and its updates, then follow official scanning guidance. Avoid random cleaner downloads and broad exclusions. A clean scan is useful evidence but does not guarantee a compromised system is trustworthy.
Recover accounts as well as the device
Change affected credentials from a trusted device, review sessions and recovery details, and enable available multifactor authentication. Decide whether rebuilding the system is appropriate before restoring files; never promise that a scan removes every risk.
Questions about this guide
Does a slow computer prove it has malware?
No. Updates, storage problems, background apps and other faults can look similar. Record suspicious messages or account activity and use trusted security tools rather than a pop-up advertising a repair.
What should I do before entering another password on a suspicious PC?
Use a device you trust for urgent account checks. Avoid links in warnings, and describe what happened before granting remote access or installing another cleanup tool.