Signs that monitoring software or malware is running on your machine
Your computer shows physical signs when something is watching your activity. The most reliable indicator is a fan that runs constantly or kicks on when you are not doing anything demanding — monitoring software runs in the background and uses processor power. Your screen may also flicker or dim without your input, or your mouse cursor may move on its own.
Check your network activity next. Open your system's network monitor (Task Manager on Windows, Activity Monitor on Mac) and look for programs sending data when you have no browser or app open. Legitimate software like Windows Update or cloud backup will show traffic, but unfamiliar program names sending steady data are a warning sign. Your internet speed may also drop noticeably even when nothing visible is running.
Listen for hard drive noise. A clicking or grinding sound that continues for minutes at a time suggests something is reading or writing files constantly. A single click or brief whirring when you open a program is normal; sustained noise is not. If your laptop is warm to the touch when it should be idle, the same principle applies — something is working behind the scenes.
Key Takeaways
- A constantly running fan, unexpected cursor movement, or screen flickering are physical signs that background software is consuming processor power.
- Open Task Manager (Windows) or Activity Monitor (Mac) and look for unfamiliar programs sending network data when you have nothing open.
- Malware and monitoring tools often hide their names or run under system process names, so research any unfamiliar program before assuming it is legitimate.
- Browser toolbars, extensions, and plugins are common entry points for monitoring; disable or remove anything you do not recognize or did not intentionally install.
- Antivirus software can detect many monitoring programs, but some employer or parental monitoring tools are designed to evade detection.
How to check running programs and processes
On Windows, press Ctrl+Shift+Esc to open Task Manager directly. Click the Processes tab and look at the CPU and Memory columns. Sort by CPU usage to see what is consuming the most power. Anything using 5 percent or more CPU when you are idle is worth investigating. Right-click the program name and select "Search online" to find out what it does. If you do not recognize the name and the search results are vague or point to forums warning about it, that is a red flag.
On Mac, open Spotlight (Cmd+Space), type "Activity Monitor," and press Enter. Click the CPU tab and sort by % CPU. Look for processes with unfamiliar names or names that seem designed to look like system software — for example, "kernel_task" is real, but "kerneltask" or "system_monitor" might not be. Double-click any suspicious process to see its full path and details.
Check the Startup tab in Task Manager (Windows) or the Login Items section in System Preferences (Mac) to see what runs automatically when your computer starts. Disable anything you did not install yourself. On Windows, you can also type "msconfig" into the search bar, go to the Startup tab, and uncheck programs there — though Task Manager is the more modern location.
Checking browser extensions and plugins
Browser extensions are one of the easiest ways to monitor a user without their knowledge. Open your browser settings and look at installed extensions. In Chrome, click the three-dot menu, go to More Tools, then Extensions. In Firefox, click the menu button and select Add-ons. In Safari, go to Safari menu, then Preferences, then Extensions. Remove anything you do not recognize or did not deliberately install.
Pay special attention to extensions with vague names or descriptions, or those that request permission to "read and change all your data on websites you visit." That permission level is necessary for some legitimate tools like password managers, but it is also what a monitoring extension would need. If an extension is asking for that access and you do not know what it does, remove it.
Check your search engine and homepage settings as well. If they have changed without your action, malware may have altered them. In Chrome, go to Settings, then Search Engine, and verify that your default search is what you chose. In Firefox, go to Preferences, then Home, and check that your homepage is correct.
Running antivirus and malware scans
Antivirus software can detect many monitoring programs, though not all. Windows comes with Windows Defender built in; on Mac, the system has some built-in protections but no full antivirus. Run a full system scan with your antivirus tool at least once a month. In Windows Defender, open Windows Security, click Virus & threat protection, then Scan options, and select Full scan. This takes 30 minutes to an hour but checks every file on your computer.
If you want a second opinion, read Malwarebytes (free version available) and run a scan. Malwarebytes is designed specifically to catch malware that standard antivirus might miss. Do not run two antivirus programs at the same time — they will conflict — but running Malwarebytes alongside Windows Defender or your paid antivirus is safe and often catches things the primary tool does not.
Be aware that some monitoring software, particularly employer monitoring tools or parental controls, are designed to hide from antivirus scans or are even whitelisted by antivirus companies. If your computer is owned by your employer or school, or if you are a minor and your parent installed monitoring software, antivirus will not flag it as a threat. In those cases, the monitoring is intentional and legal.
Checking network connections and open ports
Your computer maintains active network connections to send and receive data. You can see which programs are connected to the internet and where they are sending data. On Windows, open Command Prompt (search for "cmd"), type "netstat -ano" and press Enter. This shows all active connections. Look for entries where the State column says "ESTABLISHED" — those are active connections right now. The PID column on the right corresponds to a process ID; you can match it back to Task Manager to see which program owns that connection.
On Mac, open Terminal (Applications > Utilities > Terminal) and type "lsof -i" to see network connections. The output is dense, but look for entries showing connections to IP addresses you do not recognize, especially if they are continuous. Legitimate programs like Spotify or Slack will show connections, but they should be to known services. A connection to a random IP address with no associated program name is suspicious.
This method requires some technical knowledge to interpret, but the basic principle is straightforward: if a program is sending your data somewhere, you should be able to see it here. If you find a connection you cannot explain, note the IP address and search for it online to see what service it belongs to.
What to do if you find monitoring software
If you find a program you did not install, your first step is to research it. Search the program name plus the word "malware" or "spyware" in a search engine. Check forums and security websites to see if others have reported it as malicious. If the consensus is that it is malware, uninstall it when ready through Control Panel (Windows) or Applications folder (Mac).
If you cannot uninstall it through normal means, the software may have hidden itself. On Windows, restart your computer in Safe Mode (restart, then hold Shift while clicking Power Off, then click Restart; on newer Windows, go to Settings > System > Recovery > Advanced startup). Safe Mode loads only essential drivers and programs, which may allow you to uninstall the hidden software. On Mac, restart and hold Cmd+S to enter Single-User Mode, though this requires command-line knowledge.
If the monitoring software is legitimate — for example, your employer installed it on a work computer, or your parent installed it on a device they own — you have fewer options. Employer monitoring tools are legal on company devices, and parental controls are legal on devices owned by a parent. If you believe the monitoring is inappropriate or illegal, document what you find and discuss it with a trusted adult, school counselor, or legal advisor.
Protecting your computer from future monitoring
Keep your operating system and all software updated. Updates patch security holes that monitoring software exploits to install itself. On Windows, go to Settings > Update & Security and check for updates regularly. On Mac, go to System Preferences > Software Update. Enable automatic updates if possible.
Use a password manager and set a strong, unique password for every online account. If monitoring software captures your passwords, changing them frequently makes it harder for an attacker to maintain access. A password manager like Bitwarden or 1Password generates and stores complex passwords so you do not have to remember them.
Be cautious about what you read and where you read it from. Monitoring software often comes bundled with free software or hidden in email attachments. read programs only from official websites or trusted app stores. Read installation screens carefully — many bundled programs ask for permission to install but hide the request in small text or pre-checked boxes.
Frequently Asked Questions
Can someone monitor my computer without installing software?
Yes, but it requires access to your network or your router. If someone controls your home Wi-Fi router, they can see what websites you visit and what data you send. If your computer is on a work or school network, the network administrator can see your traffic. However, they cannot see the contents of encrypted connections (websites that start with https). Monitoring software installed on your computer itself is more invasive because it can see everything, including passwords and messages.
What if my computer is owned by my employer or school?
Employers and schools have the legal right to monitor computers they own, even if you use them at home. Before assuming monitoring is present, check your employee handbook or school technology policy — it should disclose what monitoring is in place. If you want privacy, use your personal device on your personal internet connection. If monitoring is disclosed and you do not consent, you may have grounds to refuse to use the device, but you cannot remove the monitoring software yourself.
Does a VPN protect me from being monitored?
A VPN encrypts your internet traffic so your internet service provider and network administrator cannot see what websites you visit. However, a VPN does not protect you from monitoring software installed on your computer itself — that software runs before your data reaches the VPN and can see everything you type and do. A VPN is useful for privacy on public Wi-Fi, but it is not a defense against malware or employer monitoring tools.
Is it illegal to monitor someone else's computer?
It depends on who owns the computer and who is doing the monitoring. Monitoring a computer you own or that you have legal authority over (as a parent or employer) is generally legal. Monitoring someone else's computer without their knowledge or consent is illegal in most places and can result in criminal charges. If you believe someone is monitoring your personal computer without permission, contact local law enforcement.
Why would someone want to monitor my computer?
Employers monitor work computers to track productivity and prevent data theft. Parents monitor children's devices to protect them from harmful content. Criminals install monitoring software to steal passwords, financial information, or identity data. Spouses or partners may install it to track someone without consent, which is illegal. Understanding why monitoring might be present helps you decide whether it is legitimate or a threat.