Signs your computer may have been compromised

A hacked computer usually shows visible changes before the damage spreads. The most common signs are a computer that runs slower than normal, programs that open on their own, a browser homepage that changed without your action, or a cursor that moves by itself. You might also see unfamiliar programs in your installed software list, pop-up windows that appear even when you are not browsing, or a taskbar icon you do not recognize.

Check your login history if the computer is connected to a network or cloud service. Most email providers, banking sites, and social media platforms show you where and when your account was accessed. If you see a login from a city you have never visited or a device you do not own, someone else has your password. Similarly, if you notice charges on your credit card or bank statement that you did not make, a hacker may have stolen your financial information from the computer.

Listen for unusual sounds — a computer that is constantly working hard will have a fan that runs loudly even when you are not using any programs. This can mean malware is running in the background and using your processor to mine cryptocurrency or send spam.

Key Takeaways

  • A hacked computer often runs slowly, shows unfamiliar programs, or displays pop-ups even when you are not browsing the internet.
  • Check your email, banking, and social media login history to see if someone accessed your accounts from an unfamiliar location or device.
  • Disconnect the computer from the internet when ready if you find signs of a hack, then run a full scan with your antivirus software or Windows Defender.
  • Change all your passwords from a different device after you have cleaned the computer, starting with email and banking accounts.
  • If your computer is part of a workplace network, tell your IT department right away so they can check other machines on the network.

How to run a security scan on Windows

Windows 10 and Windows 11 come with built-in antivirus software called Windows Defender. Open the Start menu, type "Windows Security" and press Enter. Click "Virus & threat protection" on the left side of the window.

Under "Current threats," click "Scan options." Choose "Full scan" — this checks every file on your computer, not just the ones you use often. A full scan can take one to three hours depending on how much data you have. Let it run without interrupting it. When the scan finishes, Windows Defender will show you what it found. If it detects threats, click "Remove" or "Quarantine" to stop them from running.

If Windows Defender finds nothing but you still suspect a hack, read Malwarebytes from malwarebytes.com on a different computer and transfer it to a USB drive. Run Malwarebytes on the suspect computer in Safe Mode — restart your computer, hold down the Shift key while clicking the power button, then choose "Restart," and select "Troubleshoot" > "Advanced options" > "Startup Settings" > "Safe Mode." Malwarebytes often catches threats that Windows Defender misses.

What to do when ready after you find a hack

Disconnect the computer from the internet right away. Unplug the ethernet cable or turn off Wi-Fi. This stops malware from sending your data to a hacker or downloading more harmful code. Do not shut down the computer yet — malware can hide itself during shutdown.

Run your antivirus scan while the computer is offline. After the scan completes and threats are removed, you can reconnect to the internet. If the computer is part of a work network, tell your IT department before you reconnect. They need to check whether malware spread to other machines.

Do not use the hacked computer to change your passwords. Instead, use a phone, tablet, or a different computer that you trust. Change your email password first — your email account is the key to resetting passwords on every other service. Then change passwords for your bank, credit card companies, and any other financial accounts. After that, change passwords for social media, shopping sites, and any other accounts that hold personal information.

Checking your browser for signs of hijacking

Browser hijacking is when malware changes your homepage, search engine, or adds unwanted extensions. Open your browser and look at the address bar. If your homepage is not what you set it to be, you have been hijacked. Check your search engine too — if searching from the address bar takes you to a site you did not choose, malware has changed your settings.

Look at your installed extensions. In Chrome, click the three vertical dots in the top right, go to "Extensions," and review the list. Remove anything you do not recognize or remember installing. In Firefox, click the menu button (three horizontal lines), select "Add-ons," click "Extensions," and delete unfamiliar items. In Edge, click the three dots, go to "Extensions," and remove anything suspicious.

Reset your browser settings to defaults if you cannot find the hijacking malware. In Chrome, click the three dots, select "Settings," click "Reset settings" at the bottom, and confirm. In Firefox, click the menu button, select "Help," then "Troubleshoot Information," and click "Refresh Firefox." In Edge, click the three dots, select "Settings," click "Reset settings," and choose "Restore settings to their default values."

Protecting your computer after a hack

After you have removed the malware and changed your passwords, take steps to prevent another hack. Install all available Windows updates — go to Settings > Update & Security > Windows Update and click "Check for updates." Restart your computer when prompted. Updates patch security holes that hackers use to break in.

Turn on Windows Firewall if it is not already on. Open Windows Security, click "Firewall & network protection," and make sure the firewall is on for all three network types shown. A firewall blocks unauthorized connections to your computer.

Enable two-factor authentication on your email, banking, and social media accounts. Two-factor authentication means you need a code from your phone or an authentication app in addition to your password to log in. This stops a hacker from accessing your accounts even if they have your password. Most banks require this, but you should turn it on for email and social media yourself.

When to seek professional help

If your computer still shows signs of being hacked after you have run a full antivirus scan and removed threats, the malware may be deeply embedded in your system. Take the computer to a local repair shop that specializes in malware removal. They have tools and experience that go beyond what standard antivirus software can do.

If you cannot access your computer at all, or if it will not start up, a professional can recover your files and reinstall Windows. This is more expensive than a standard malware removal but may be necessary if the hack has damaged your operating system.

If your financial accounts were compromised, contact your bank and credit card companies directly. Use the phone number on the back of your card or your statement, not a number from a search result — scammers sometimes pose as banks. Tell them about the unauthorized charges and ask them to freeze your accounts or issue new cards.

Frequently Asked Questions

Can a hacker see me through my webcam?

Yes, if malware has infected your computer, a hacker can access your webcam without your knowledge. Cover your webcam with tape or a sliding cover as a basic precaution. Check your camera settings in Windows Security to see which programs have permission to use it, and remove permission from anything you do not recognize.

Will restarting my computer remove a hack?

Restarting alone will not remove malware, but it can slow down an active hack. Some malware runs only in your computer's memory and disappears when you restart, though the infection usually remains on your hard drive. Always run an antivirus scan after restarting to find and remove the malware permanently.

Is it safe to use my computer after removing malware?

It is reasonably safe after you have run a full scan, removed threats, and changed your passwords. However, if the same signs return within a few days, the malware may not have been completely removed. Run another full scan or take the computer to a professional.

What if I think my phone was hacked instead of my computer?

The signs are similar — unexpected battery drain, overheating, unfamiliar apps, or unusual charges. Restart your phone, check your installed apps and remove anything unfamiliar, and change your passwords from a different device. If problems continue, back up your data and perform a factory reset through your phone's settings.

Do I need to replace my computer if it was hacked?

Not usually. After removing malware and changing your passwords, your computer is as safe as any other. Replacement is only necessary if the hardware itself was damaged, which is rare, or if you are uncomfortable using the computer after a hack. A fresh Windows installation is a middle option — it removes everything and reinstalls the operating system cleanly.