What is the difference between being hacked and having a virus?

A virus wants your CPU cycles or your ad clicks — it runs automatically and doesn't need a person behind it. Being hacked means a human has active or recurring access to your machine, usually through a RAT (Remote Access Trojan) or stolen credentials. The signs are different: viruses cause slowness and pop-ups, while a human intruder creates user accounts, changes passwords, and opens connections on unusual network ports. Check netstat -ano for ESTABLISHED connections on ports like 4444, 5555, or 5900 — those point to remote access tools, not generic malware.

Can someone hack my computer without me knowing?

Yes, and it's more common than most people think. RATs (Remote Access Trojans) are designed to be invisible — they use minimal CPU, create no visible windows, and disguise themselves as legitimate Windows processes. One we found was called WinUpdate64.exe using 0.2% CPU, hiding in AppData/Local/Temp. The only reliable way to catch silent intrusions is checking network connections with netstat -ano and auditing Event Viewer login logs for activity at times you weren't using the computer.

How do I check Event Viewer for signs of hacking?

Open eventvwr.msc, go to Windows Logs then Security, and filter by Event ID 4625 (failed login attempts) and 4720 (user account created). On a normal home computer, you should see almost zero 4625 events. Hundreds of failed login attempts from the same source within a few hours means something is brute-forcing your machine. Event ID 4720 existing when you didn't create a new account is a strong indicator of unauthorized access.

What should I do first if I think I've been hacked?

Disconnect from the internet immediately — pull the ethernet cable or turn off WiFi. This cuts off the attacker's access before they can see you responding. Then check netstat, Event Viewer, and Task Manager from the disconnected machine. If you confirm unauthorized access, change all your passwords from a different device, run a full malware scan from Safe Mode, and check for unknown user accounts with the net user command. For RATs or active remote access, professional removal is safer than DIY because the attacker may have installed multiple persistence mechanisms.

Is my computer hacked or just slow?

Almost certainly just slow. About 7 out of 10 people who contact us convinced they've been hacked have either ordinary malware (not an actual person on their machine) or nothing wrong at all — their computer is aging, has too many startup programs, or a dying hard drive. A hacked computer usually doesn't feel slow because attackers want to stay hidden. The real signs are in netstat connections, Event Viewer logs, and unknown user accounts, not in performance.

How to Tell If Your Computer Has Been Hacked (2026)

Your mouse moved. You didn’t touch it. That’s the one sign that actually means someone is on your machine right now — and it’s also the rarest one. Most of the time, the signs are quieter.

If you’re here because something feels off and you want to know for sure, the fastest thing you can do is open a command prompt and type netstat -ano. That single command shows every active network connection your computer has. You don’t need to understand all of it — just scroll through and look for ESTABLISHED connections to IP addresses you don’t recognize, especially on ports that aren’t 80 or 443. Port 4444 and 5555 are Metasploit defaults. Port 8080 is commonly abused by RATs. If you see traffic going somewhere weird at 2 AM when you’re not doing anything, that’s not Windows Update.

netstat and What It Actually Tells You

I got a call from a guy who was convinced his ex-girlfriend had installed something on his laptop. Wouldn’t say how he knew, just kept saying “it feels like someone’s watching.” We pulled up netstat -ano and sure enough, there was an ESTABLISHED connection to a residential IP address on port 5900 — that’s VNC. A remote desktop tool was running, and it wasn’t one he’d installed. PID was 7384. We went to Task Manager, found PID 7384 — it was calling itself “WinUpdate64.exe” sitting in his AppData\Local\Temp folder. Actual Windows Update doesn’t put executables in Temp directories and doesn’t use VNC.

That connection had been active for weeks. He’d never have found it without netstat because the program used maybe 0.2% CPU and no visible window.

To actually run this: open cmd as administrator, type netstat -ano | findstr ESTABLISHED to filter out the noise. You’ll get a list like:

TCP    192.168.1.5:49832    185.143.xx.xx:443    ESTABLISHED    1284
TCP    192.168.1.5:50111    44.238.xx.xx:8080    ESTABLISHED    7384

The last number is the PID. Cross-reference it in Task Manager — Details tab, sort by PID. If the process name looks fake or the file lives somewhere weird, that’s your answer. You can also paste suspicious IP addresses into VirusTotal — it checks against 90+ security vendors and community reports.

Most people reading guides about “am I hacked” are told to check if their computer is slow. A slow computer is not a hacked computer. It’s a computer with too much junk on it, or a dying hard drive, or Chrome with 47 tabs. I’d estimate that maybe 3 out of 10 people who call us genuinely worried they’ve been hacked actually have been. The rest have malware that isn’t really “hacking” or nothing wrong at all.

The Stuff That Actually Points to Unauthorized Access

A hacker on your machine is different from a virus on your machine. Viruses want your CPU or your clicks. A person who has broken in wants your files, your passwords, or your webcam. The signs are different.

Your webcam light turns on and you’re not on a video call. This one gets mentioned everywhere and I’ll be brief — if the light blinks on and nothing obvious is running, open Task Manager, sort by GPU, and look for anything accessing the camera. Most legitimate apps (Zoom, Teams, Discord) show in the system tray. If the process accessing your camera is something you’ve never heard of, kill it and scan the machine.

Passwords changed on accounts you didn’t touch. Not just “forgot your password” but you literally can’t log into Gmail, and when you check the recovery email it’s been changed to something you don’t recognize. This sometimes means a keylogger captured your credentials. Check Event Viewer — eventvwr.msc, then Windows Logs > Security, filter for Event ID 4624 (logon events). If you see logon types you don’t recognize happening at 4 AM, that’s a problem.

New user accounts exist on your computer. Open cmd, type net user. If there’s an account you didn’t create — especially something generic like “admin2” or “support” — someone or something added it. Malware doesn’t usually create user accounts. People do.

Your antivirus is turned off and you can’t turn it back on. Lots of stuff can disable Defender temporarily — a game booster, some VPN software, a bad update. But if you go to Windows Security and the real-time protection toggle is greyed out, or it turns itself off again five minutes after you enable it, something is actively fighting you for control of that setting.

Event Viewer — Nobody Checks This But You Should

Event Viewer is the black box recorder of your PC and nobody reads it. That’s fine, you don’t need to read all of it. Here’s the one thing worth checking:

Open eventvwr.msc, navigate to Windows Logs > Security. Click “Filter Current Log” on the right, and type 4625 in the Event ID field. That shows failed login attempts. On a normal home computer, you should see almost none. If you see hundreds of 4625 events from the same source over a few hours, something is brute-forcing your machine. The FBI’s IC3 reports track this stuff nationally — remote access fraud is one of their fastest-growing complaint categories.

Also look at Event ID 4720 — that’s “user account created.” If you didn’t create a new account and that event exists, well.

I had a customer last year whose laptop would wake up from sleep at random times during the night. Screen would be on when she came downstairs in the morning. Turned out someone had set up a scheduled task — visible in Task Scheduler — that woke the machine at 3 AM, ran a PowerShell script that exfiltrated her Documents folder to a cloud storage endpoint, then put the machine back to sleep. Event Viewer had the entire timeline. The scheduled task was created three weeks before she noticed anything. She found it because her upload bandwidth had been spiking and her ISP sent her a usage warning.

When It’s Not Actually a Hack

I want to be honest about this part because a lot of guides skip it.

Pop-up ads in your browser are not hacking. That’s adware or a browser hijacker and while it’s annoying, nobody is “inside your computer.” Your ISP or a tech support scam telling you “your computer has been compromised” is almost always fake. Random slowness after a Windows update is just Windows being Windows.

If every one of these checks comes back clean — netstat shows nothing weird, Event Viewer looks normal, Task Manager processes are all legitimate, no unknown user accounts — your computer probably isn’t hacked. Sometimes a computer just acts strange because a driver glitched or an update went sideways. I spend a lot of my week telling people their machine is fine when they were sure it wasn’t.

If the checks don’t come back clean, or if you found something in netstat or Event Viewer that you’re not sure about, the next step is running a proper malware scan from Safe Mode — our malware removal guide walks through that. The important thing is you now know whether you’re dealing with a real intrusion or a false alarm, and that distinction matters because the response is completely different.

For anything involving a RAT or active remote access — someone is literally on your machine — disconnect from the internet first. Pull the ethernet cable or turn off WiFi. Do it before anything else. Then you can figure out next steps without whoever it is watching you do it.