How to Check for Malware Without Installing Antivirus Software

A computer can show signs of malware before any security program is added. Unexpected adverts, a changed browser homepage, unexplained data use, slow startup, locked files, or unfamiliar account activity may indicate spyware, a trojan, a browser hijacker, or another unwanted program. Windows already includes several tools that can help investigate these symptoms.

A careful check is useful when a Windows PC is too slow to download software, when a user wants a second opinion, or when an infection is suspected after opening a suspicious attachment. The process below uses built-in Windows features and trusted portable resources, while avoiding risky downloads that could make the problem worse.

Start With Windows Security And Recent Activity

Windows 10 and Windows 11 include Microsoft Defender through the Windows Security app. It is already part of the operating system, so checking it does not require installing a separate antivirus product. Open Windows Security from the Start menu, select Virus & threat protection, and review the protection history for detections, quarantined files, and blocked applications.

Run a Quick scan first, then choose a Full scan if the computer still behaves abnormally. A Full scan can take considerable time, especially on a large hard drive, so keep the computer connected to power. For suspicious behaviour that returns after a normal scan, Microsoft Defender Offline can restart the computer and inspect the system before Windows loads fully. This can help detect malware that tries to hide while the operating system is running.

Check Windows Update before scanning. Security intelligence and operating system updates improve detection accuracy, while an outdated system may miss newer threats. Avoid disabling real-time protection simply because a website or pop-up claims it is necessary.

Inspect Startup Apps, Processes And Extensions

Task Manager provides a useful view of programs that launch with Windows. Press Ctrl+Shift+Esc, open Startup apps, and examine unfamiliar entries, especially those with a high startup impact. A strange name does not automatically prove that a file is malicious, because legitimate drivers and update services can look obscure. Search the publisher and file location before taking action.

The Processes tab can reveal a program using unusual amounts of CPU, memory, disk activity, or network bandwidth. Right-click an unfamiliar process and choose Open file location. Be cautious with files located in temporary folders, a user’s AppData directory, or a randomly named folder. Do not delete system files based solely on their names; record the file path and research it using a reputable security source.

Browser extensions deserve a separate check. In Edge, Chrome, or Firefox, remove extensions that were installed without permission, have poor reviews, or request access unrelated to their purpose. A browser hijacker may alter search results, inject adverts, redirect shopping pages, or repeatedly open fake technical-support websites. Resetting the browser can remove unwanted settings, but save important bookmarks and passwords first.

Use Safe Windows Commands And System Checks

Windows Terminal or PowerShell can help confirm whether suspicious activity is persistent. The command Get-MpThreat may display threat history recorded by Microsoft Defender, while Get-Process lists currently running processes. These commands are useful for investigation, but they do not identify every malicious file. A process with a familiar name can still be counterfeit if it runs from an unusual location.

Review installed applications through Settings, then Apps and Installed apps. Sort by installation date and look for software added around the time the symptoms began. Unwanted programs sometimes arrive bundled with free utilities, cracked software, fake browser updates, or downloads from unofficial websites. Uninstalling an unfamiliar application is reasonable when its publisher and purpose cannot be verified, but do not remove essential drivers or business software without checking first.

System File Checker and Deployment Image Servicing and Management can repair damaged Windows components, but they are not malware scanners. Commands such as sfc /scannow and DISM /Online /Cleanup-Image /RestoreHealth can address corruption that causes crashes or errors. Run them from an elevated Terminal window and allow each process to finish. Repairing Windows files will not remove a hidden password stealer or ransomware infection.

Check Network Behaviour And Suspicious Files

A malware infection may create connections to unfamiliar servers, consume data in the background, or interfere with DNS settings. In Task Manager, the App history and Performance views can show unusually high network use. Resource Monitor, opened by searching Windows for its name, provides more detail about processes using network connections. An unknown connection is a warning sign rather than proof, since browsers, cloud storage, and Windows services regularly communicate with external servers.

Inspect the hosts file and DNS settings only if browser redirection continues. Incorrect settings can result from malware, but they can also be caused by a legitimate VPN, workplace configuration, or internet provider. On an NBN connection in Sydney, Melbourne, Brisbane, or regional Australia, sudden data consumption may be noticed quickly when a household has a fixed monthly plan or relies on a mobile hotspot. Record the issue before changing router settings.

For an individual suspicious file, a reputable online multi-engine scanner can provide additional evidence without installing antivirus software. Do not upload tax records, identity documents, client data, photographs, or confidential work files. Some online services retain or share submitted samples for research. A safer approach is to check the file’s digital signature, publisher, location, and hash where possible. Disconnecting from the internet may be appropriate if ransomware is actively encrypting files, although this should not delay professional help when valuable data is at risk.

Protect Data And Decide When To Seek Help

Back up important documents before making major repairs, but do not connect an unprotected backup drive while ransomware may be active. Use a clean device to change email, banking, cloud, and social-media passwords if there is evidence of credential theft. Enable multifactor authentication and sign out other sessions where the service allows it. If the computer handles business information, preserve suspicious messages, filenames, timestamps, and screenshots for later investigation.

Australian users should report scams and suspicious cyber activity through Scamwatch, while organisations may need to assess their obligations under the Privacy Act 1988 and the Notifiable Data Breaches scheme. A business that stores customer or employee information should avoid casually uploading samples or sending private logs to unknown websites. The Australian Cyber Security Centre also provides guidance for individuals and organisations responding to cyber incidents.

A professional PC repair service is appropriate when malware returns after removal, Windows cannot boot normally, files are encrypted, security tools are disabled, or there are signs of stolen accounts. A technician can use a controlled environment, bootable diagnostic media, data-preservation procedures, and hardware checks. A clean reinstall may be safer than repeated removal attempts when system integrity cannot be trusted.

Checking method	What it can reveal	Main limitation	Sensible next step
Windows Security protection history	Blocked or quarantined threats	May miss malware that is new or well hidden	Run a full scan and update Windows
Startup apps and Task Manager	Suspicious persistence and resource use	Legitimate software can look unfamiliar	Verify publisher and file location
Browser extension review	Hijackers, adware, and unwanted redirects	Does not inspect all Windows files	Remove unknown extensions and reset settings
Resource Monitor	Unusual network activity and active connections	A connection alone does not prove infection	Record the process and investigate its path
Offline Defender scan	Threats that hide during normal operation	Requires a restart and may take time	Save work, disconnect risky devices, and scan
Online file analysis	Additional opinions about one file	Privacy and sample-sharing risks	Never upload confidential or personal files
Professional diagnosis	Complex or persistent infections	Involves cost and may require downtime	Back up safely and provide evidence collected

A methodical inspection can identify many common warning signs without adding another antivirus package. Built-in Windows scanning, startup analysis, browser checks, network observation, and secure backup practices work best together. If the evidence points to credential theft, ransomware, or a compromised business computer, limiting further use and obtaining expert assistance is safer than repeatedly experimenting on the affected system.