How to tell if your PC has a virus: the network signs

A slow computer is not always a virus, and a virus does not always make a computer slow. Here is how to check calmly, with tools that are already in Windows, on any PC or laptop. Almost all malware has one thing in common: it needs the internet, so the network is a good place to look.

1. Signs worth taking seriously

"Malware" means any harmful program: viruses, spyware, programs that steal passwords or show ads. These signs don't prove anything on their own, but together they are worth a closer look:

• Windows Security is switched off and you didn't do it, or it won't switch on again.
• Programs, toolbars or browser extensions (small add-ons) appear that you never installed.
• Your browser changed by itself: a new start page or search engine, or lots of pop-up ads, even on sites that never had them.
• Friends get messages or e-mails "from you" that you didn't send.
• Passwords stop working or you get "new sign-in" e-mails you can't explain.
• Network activity while you are doing nothing: the internet is slow, the network light blinks, or the fan runs at full speed while the PC is idle.
• A message demands money to unlock your files. That is ransomware: go offline at once and get help.

Usually harmless: a PC that is slow after an update, a fan that spins up during Windows Update, or one pop-up on a single website. Windows also downloads updates in the background, which is normal network activity.

2. Scan with Windows Security

Every Windows 10 and 11 PC has a free virus scanner built in. Open Windows Security (Start › type Windows Security) › Virus & threat protection:

1. Under Virus & threat protection updates, click Protection updates › Check for updates.
2. Click Scan options › Full scan › Scan now. It checks every file and can take an hour or more; you can keep working.
3. If you still have doubts, choose Microsoft Defender Offline scan. The PC restarts and is scanned before Windows starts, so malware that hides while Windows runs can be found. Save your work first.
4. Look at Protection history to see what was found and what was done about it.

If you use another antivirus, run its full scan instead. Only one antivirus should be active at a time.

3. The network signs: which programs go online?

A harmful program usually has to send something out: your passwords, your files, or a "here I am, what next?" message to its owner. You can see which programs use the network right now.

Quick look: Task Manager

Press Ctrl + Shift + Esc. On the Processes tab, click the Network column to sort by it. The programs at the top are using the network now. A browser or Windows Update there is normal; a name you don't know is worth looking up.

Closer look: Resource Monitor

Press Windows key + R, type resmon and press Enter › Network tab › TCP Connections. You see each program, the address it is talking to (the Remote Address), and how much it sends. Right-click a program in Task Manager › Open file location to see where it lives. Programs in C:\Windows or C:\Program Files are normal places; an unknown program running from your Downloads or a hidden AppData folder deserves a closer look.

Is it signed?

Right-click the program file › Properties › Digital Signatures. A signature tells you which company made it. No tab at all means the file is not signed. Many small honest tools are unsigned too, so this is a clue, not proof.

What these tools can't do: they only show this moment, they show addresses as numbers, not who owns them, and they don't stop anything.

4. Two more quick checks

• Startup programs: Task Manager › Startup apps (Windows 10: Startup). Right-click anything you don't know › Disable.
• Browser extensions: in your browser's menu › Extensions. Remove what you don't recognise.

Thinking someone else may be using your computer? See Is my PC hacked? If a caller had remote control of your PC, see Gave a scammer remote access?

5. If the scan finds something, or the signs stay

1. Let Windows Security remove it and restart the PC. Then scan again.
2. Go offline (unplug the cable or switch off Wi-Fi) if the signs stay or a message demands money.
3. Change important passwords from another, clean device, starting with e-mail and banking, and switch on two-step sign-in.
4. At work: tell your IT team before changing anything.
5. At home: if in doubt, back up your personal files and reset Windows (Settings › System › Recovery › Reset this PC), or ask a trusted IT professional.

6. The network side, at any time, with Coinetic

Doing this by hand means a snapshot: Task Manager and Resource Monitor show this moment, not the program that sent data at 3 a.m. You see bare addresses, not who owns them. And the Windows Firewall lets every program connect out by default, so you only find out afterwards, if at all.

Coinetic works through the Windows Firewall that is already on your computer. To be clear: Coinetic is not an antivirus. It does not scan files or remove viruses; it works next to Windows Security or your antivirus. What it adds is the network side, which a virus scanner doesn't show you. No tool can promise 100% security.

• Programs going online, under your control: with outbound control switched on, every new program asks once before it may reach the internet, with who signed it, where it wants to go and a plain recommendation. Allow it, allow it only on your own network, or block it. The Programs page lists every decision.
• Unusual traffic stopped automatically (every plan): Coinetic learns what is normal for your PC for 7 days. After that, a program that suddenly contacts many internet addresses, scans other computers, sends mail like spam malware, or contacts one unknown address again and again at almost exact intervals (typical for remote-control malware) is quarantined: no internet, your home network still works. You see Coinetic stopped <program> from reaching the internet: <reason> and choose Release or Keep blocked.
• Every connection, with a name: the Connections page shows each connection with the program, who owns the address and the country. Right-click to see who signed the program, block it or stop it.
• New open doors reported: Coinetic tells you when an unsigned program suddenly starts listening on the network (waiting for connections from outside). The one-click Security check finds ports (doors into your computer) that are open to the whole internet: Coinetic closes it, or makes it invisible forever or until you unlock it from your phone. Try the free open-port check for your own address.
• Firewall switched off? You hear about it: if a program or malware switches the firewall off or opens a door from the internet, Coinetic tells you which program did it, and can switch the firewall back on by itself.
• At any time, not just once: Coinetic runs in the background, also when its window is closed. The Overview shows green when you are protected and amber when something needs you, and a notification appears at the bottom right when something needs you.
• Your AI security analyst (Pro + AI): right-click any line, program or connection and choose Ask AI, e.g. “Which programs on this PC went online today, and is any of them unusual?”. It looks up this computer's Coinetic data itself and answers in plain words, with what to do on this machine.

More guides: all Coinetic guides.

Frequently asked

How do you check if you have a virus for free?

Use Windows Security, which is built into Windows 10 and 11: update it, run a full scan, and if you still have doubts, the Microsoft Defender Offline scan. It costs nothing.

How can I tell if my laptop has a virus?

The same way as a desktop PC: look for the signs above (security switched off, unknown programs, pop-ups, network activity while idle), then run a full scan. A laptop that is often on public Wi-Fi is worth checking a little more often.

Can a virus hide from a scan?

Some malware hides while Windows is running. That is what the Microsoft Defender Offline scan is for: it scans before Windows starts. Watching what goes online is a second, independent way to spot it.

Does a firewall replace an antivirus?

No. An antivirus checks files; a firewall controls connections. They do different jobs and work best together.