How to Tell If Your Computer Has Been Hacked
Short answer: Open a command prompt as admin and run netstat -ano | findstr ESTABLISHED. Look for connections to IP addresses you don't recognize on unusual ports (4444, 5555, 8080, 5900). Cross-reference the PID in Task Manager's Details tab — if the process has a fake name or lives in AppData/Temp instead of System32, someone may have remote access to your machine.
Your mouse moved. You didn’t touch it. That’s the one sign that actually means someone is on your machine right now — and it’s also the rarest one. Most of the time, the signs are quieter.
If you’re here because something feels off and you want to know for sure, the fastest thing you can do is open a command prompt and type netstat -ano. That single command shows every active network connection your computer has. You don’t need to understand all of it — just scroll through and look for ESTABLISHED connections to IP addresses you don’t recognize, especially on ports that aren’t 80 or 443. Port 4444 and 5555 are Metasploit defaults. Port 8080 is commonly abused by RATs. If you see traffic going somewhere weird at 2 AM when you’re not doing anything, that’s not Windows Update.
netstat and What It Actually Tells You
Here’s what a real finding looks like. Say you suspect someone with past access to your laptop installed something on it. Running netstat -ano shows an ESTABLISHED connection to a residential IP address on port 5900 — that’s VNC. A remote desktop tool is running, and it isn’t one you installed. Say the PID is 7384. In Task Manager, PID 7384 turns out to be calling itself “WinUpdate64.exe” and sitting in your AppData\Local\Temp folder. Actual Windows Update doesn’t put executables in Temp directories and doesn’t use VNC.
A connection like that can stay active for weeks. You’d never find it without netstat because the program uses maybe 0.2% CPU and no visible window.
To actually run this: open cmd as administrator, type netstat -ano | findstr ESTABLISHED to filter out the noise. You’ll get a list like:
TCP 192.168.1.5:49832 185.143.xx.xx:443 ESTABLISHED 1284
TCP 192.168.1.5:50111 44.238.xx.xx:8080 ESTABLISHED 7384The last number is the PID. Cross-reference it in Task Manager — Details tab, sort by PID. If the process name looks fake or the file lives somewhere weird, that’s your answer. You can also paste suspicious IP addresses into VirusTotal — it checks against 90+ security vendors and community reports.
Most people reading guides about “am I hacked” are told to check if their computer is slow. A slow computer is not a hacked computer. It’s a computer with too much junk on it, or a dying hard drive, or Chrome with 47 tabs. Only a minority of people who are genuinely worried they’ve been hacked actually have been. The rest have malware that isn’t really “hacking” or nothing wrong at all.
The Stuff That Actually Points to Unauthorized Access
A hacker on your machine is different from a virus on your machine. Viruses want your CPU or your clicks. A person who has broken in wants your files, your passwords, or your webcam. The signs are different.
Your webcam light turns on and you’re not on a video call. This one gets mentioned everywhere and I’ll be brief — if the light blinks on and nothing obvious is running, open Task Manager, sort by GPU, and look for anything accessing the camera. Most legitimate apps (Zoom, Teams, Discord) show in the system tray. If the process accessing your camera is something you’ve never heard of, kill it and scan the machine.
Passwords changed on accounts you didn’t touch. Not just “forgot your password” but you literally can’t log into Gmail, and when you check the recovery email it’s been changed to something you don’t recognize. This sometimes means a keylogger captured your credentials. Check Event Viewer — eventvwr.msc, then Windows Logs > Security, filter for Event ID 4624 (logon events). If you see logon types you don’t recognize happening at 4 AM, that’s a problem.
New user accounts exist on your computer. Open cmd, type net user. If there’s an account you didn’t create — especially something generic like “admin2” or “support” — someone or something added it. Malware doesn’t usually create user accounts. People do.
Your antivirus is turned off and you can’t turn it back on. Lots of stuff can disable Defender temporarily — a game booster, some VPN software, a bad update. But if you go to Windows Security and the real-time protection toggle is greyed out, or it turns itself off again five minutes after you enable it, something is actively fighting you for control of that setting.
Event Viewer — Nobody Checks This But You Should
Event Viewer is the black box recorder of your PC and nobody reads it. That’s fine, you don’t need to read all of it. Here’s the one thing worth checking:
Open eventvwr.msc, navigate to Windows Logs > Security. Click “Filter Current Log” on the right, and type 4625 in the Event ID field. That shows failed login attempts. On a normal home computer, you should see almost none. If you see hundreds of 4625 events from the same source over a few hours, something is brute-forcing your machine. The FBI’s IC3 annual reports track online fraud nationally, and tech support scams — which usually hinge on getting remote access to your PC — rank among the costliest categories.
Also look at Event ID 4720 — that’s “user account created.” If you didn’t create a new account and that event exists, well.
Another pattern to watch for: a laptop that wakes from sleep at random times during the night, with the screen on in the morning. One possible cause is a malicious scheduled task — visible in Task Scheduler — that wakes the machine at 3 AM, runs a PowerShell script that exfiltrates the Documents folder to a cloud storage endpoint, then puts the machine back to sleep. Event Viewer will show the entire timeline, and such a task can run for weeks before anyone notices. Unexplained spikes in upload bandwidth, or a usage warning from your ISP, are another clue.
When It’s Not Actually a Hack
I want to be honest about this part because a lot of guides skip it.
Pop-up ads in your browser are not hacking. That’s adware or a browser hijacker and while it’s annoying, nobody is “inside your computer.” Your ISP or a tech support scam telling you “your computer has been compromised” is almost always fake. Random slowness after a Windows update is just Windows being Windows.
If every one of these checks comes back clean — netstat shows nothing weird, Event Viewer looks normal, Task Manager processes are all legitimate, no unknown user accounts — your computer probably isn’t hacked. Sometimes a computer just acts strange because a driver glitched or an update went sideways. Plenty of machines that feel compromised turn out to be fine.
If the checks don’t come back clean, or if you found something in netstat or Event Viewer that you’re not sure about, the next step is running a proper malware scan from Safe Mode — our malware removal guide walks through that. The important thing is you now know whether you’re dealing with a real intrusion or a false alarm, and that distinction matters because the response is completely different.
For anything involving a RAT or active remote access — someone is literally on your machine — disconnect from the internet first. Pull the ethernet cable or turn off WiFi. Do it before anything else. Then you can figure out next steps without whoever it is watching you do it.
Frequently Asked Questions
What is the difference between being hacked and having a virus?
A virus wants your CPU cycles or your ad clicks — it runs automatically and doesn't need a person behind it. Being hacked means a human has active or recurring access to your machine, usually through a RAT (Remote Access Trojan) or stolen credentials. The signs are different: viruses cause slowness and pop-ups, while a human intruder creates user accounts, changes passwords, and opens connections on unusual network ports. Check netstat -ano for ESTABLISHED connections on ports like 4444, 5555, or 5900 — those point to remote access tools, not generic malware.
Can someone hack my computer without me knowing?
Yes, and it's more common than most people think. RATs (Remote Access Trojans) are designed to be invisible — they use minimal CPU, create no visible windows, and disguise themselves as legitimate Windows processes. One we found was called WinUpdate64.exe using 0.2% CPU, hiding in AppData/Local/Temp. The only reliable way to catch silent intrusions is checking network connections with netstat -ano and auditing Event Viewer login logs for activity at times you weren't using the computer.
How do I check Event Viewer for signs of hacking?
Open eventvwr.msc, go to Windows Logs then Security, and filter by Event ID 4625 (failed login attempts) and 4720 (user account created). On a normal home computer, you should see almost zero 4625 events. Hundreds of failed login attempts from the same source within a few hours means something is brute-forcing your machine. Event ID 4720 existing when you didn't create a new account is a strong indicator of unauthorized access.
What should I do first if I think I've been hacked?
Disconnect from the internet immediately — pull the ethernet cable or turn off WiFi. This cuts off the attacker's access before they can see you responding. Then check netstat, Event Viewer, and Task Manager from the disconnected machine. If you confirm unauthorized access, change all your passwords from a different device, run a full malware scan from Safe Mode, and check for unknown user accounts with the net user command. For RATs or active remote access, professional removal is safer than DIY because the attacker may have installed multiple persistence mechanisms.
Is my computer hacked or just slow?
Almost certainly just slow. Most people who are convinced they've been hacked have either ordinary malware (not an actual person on their machine) or nothing wrong at all — their computer is aging, has too many startup programs, or a dying hard drive. A hacked computer usually doesn't feel slow because attackers want to stay hidden. The real signs are in netstat connections, Event Viewer logs, and unknown user accounts, not in performance.