Malware is not always obvious. Warning signs include pop-ups, browser redirects, fake support messages, sudden slowdowns, unknown apps, disabled security tools, unexpected bank or account alerts, and people receiving strange messages from you.
| Warning sign | Why it matters | First response |
|---|---|---|
| Browser says to call a support number | Common tech-support scam pattern | Do not call; close browser or disconnect internet |
| Unknown remote access app installed | Someone may have accessed the device | Disconnect internet and get trusted help |
| Email sends strange messages | Account compromise may be involved | Change password from clean device, check forwarding rules |
| Files renamed or cannot open | Possible ransomware or drive failure | Stop using device; preserve evidence |
| Security tools disabled | Malware or scammer may have changed settings | Avoid random cleaner tools; use trusted support |
Common warning signs
Look for new browser extensions, changed homepages, repeated security warnings, unknown remote access tools, unusual startup apps, and files you cannot open. On business devices, also watch for failed login alerts and unexpected mailbox forwarding rules.
What to do first
Disconnect from the internet if you suspect active compromise. Do not enter passwords, do not call numbers shown in pop-ups, and do not grant remote access to anyone who contacted you unexpectedly. Use a known-good device to change important passwords and enable multi-factor authentication.
Run a careful scan
Use trusted security software already installed on the device or from the operating system vendor. Avoid downloading random cleaner tools from search ads. They can make the problem worse.
If a fake support caller already connected to the computer, tell the technician which remote-access app was used, whether any payments were made, and whether passwords or banking details were entered during the session.
Check accounts as well as the computer
Many incidents involve email or cloud accounts, not just the device. Check mailbox forwarding, recovery phone numbers, recent login activity, and shared cloud files.
For Microsoft 365 or Google Workspace, check sign-in history, mailbox forwarding, inbox rules, OAuth/app access, shared files, and admin accounts. For home users, check email recovery options, password manager access, and banking alerts.
When to get help
Get professional support if money, business data, customer information, remote access tools, or ransomware warnings are involved. For businesses, preserve evidence and avoid wiping devices before you understand what happened.
Recovery checklist
- Disconnect the affected device if compromise is active.
- Use a clean device to change important passwords.
- Enable multi-factor authentication where available.
- Check email forwarding and recovery details.
- Remove unknown remote-access tools and browser extensions.
- Back up important files only after discussing malware risk.
- For businesses, record times, alerts, users affected, and actions taken.
Everyday Computing provides malware checks, virus removal, account hardening, and small business security support across Sydney.