This page is a pointer, deliberately: malware deserves its own deep guide, and this series keeps it there. But no slow-PC diagnosis is complete until infection is ruled out — because tuning a compromised machine polishes someone else's operation while the cause keeps running.
Most malware that slows a PC is not dramatic. It is a cryptominer using your processor when you are not looking, adware injecting itself into the browser, or a bundle of "helpers" that arrived with a free download. The pattern has tells: fans loud at idle, CPU busy with nothing open, a browser that opens pages by itself. Two scans, both built into Windows, settle the question.
A PC that slows suddenly rather than gradually, fans that run when nothing is open, CPU or GPU load at an untouched desktop, a browser with a changed homepage or unfamiliar extensions, and programs in the apps list you never installed — any two of these together mean scan first, tune later. Gradual slowness over years is wear and software pile-up; a step-change is an event, and events have causes.
Open Windows Security → Virus & threat protection → Scan options and run a Full scan. The quick scan checks only the usual hiding places; the full scan reads the whole drive and can take an hour or more on a big disk — let it finish. Read the result list carefully: Windows names what it found and what it did, and anything marked "remediation incomplete" is a thread to pull, not a pass.
On the same screen, Microsoft Defender Offline scan restarts the PC and scans before Windows and its drivers fully load — the environment where rootkit-class malware hides from in-Windows scans. Save your work first. It takes about fifteen minutes, and a clean result here plus a clean full scan is a genuinely strong all-clear from tools already on your machine, at no cost.
Half of "my PC is infected" is actually a hijacked browser, which no disk scan fully fixes. In your browser: review the extensions and remove anything you do not recognise, check the search engine and startup pages settings, and if pop-ups survive that, use the browser's own reset-settings option. A miner tab or a rogue extension can hold a full CPU core by itself while the rest of the PC tests clean.
Honesty cuts both ways: a clean scan proves no known malware was found, and it makes infection unlikely — it is not a mathematical guarantee. If the step-change slowness, idle fan noise and mystery programs all persist after both scans and a browser cleanup, treat it as a real suspicion and follow the deep malware-removal guide rather than tuning around it.
The video runs both scans and reads the results with you — what a miner pattern looks like, what a clean result honestly means, and when to dig deeper.
▶️ Watch Full VideoYes — miners are designed to throttle down when you open Task Manager and ramp up when the PC is idle, which is why fans at an untouched desktop and heat with nothing open are classic tells. The Offline scan exists partly because it runs where such tricks do not work.
Usually the slowness lifts with the cause. Change the passwords that matter from a clean device if the detection was a stealer-class name, keep an eye on the same symptoms for a week, and treat the bundle that brought it in — the free download it rode in on — as uninstalled too.
For these scans, no. The Full and Offline scans built into Windows Security are the correct first tools and they are genuinely capable. Paid suites add features and central management; they do not change the order of operations on a slow PC.