Is my PC hacked? How to see what really connects

Most of the time, a slow or strange-acting PC is not hacked. But you don't have to guess: Windows has its own tools that show which programs run, which ones talk to the internet, and who can sign in. Here is how to check, calmly, in about 15 minutes.

1. Signs worth taking seriously, and myths

Signs worth checking

• Your passwords were changed, or you get "new sign-in" e-mails you can't explain.
• Friends receive messages or e-mails from you that you never sent.
• Windows Security or your antivirus was switched off, and you didn't do it.
• A remote-control program (for example a remote desktop or support tool) is installed or running that you didn't install, or the mouse moves by itself.
• A user account appears that you don't know, especially one with administrator rights.
• New browser extensions, a changed home page or search engine you didn't choose.

Usually not a sign of a hack

• Many svchost.exe processes. That is normal: Windows runs many of its services this way.
• Lots of connections from your browser. One web page can talk to dozens of servers (pictures, fonts, ads, video).
• Blocked attempts from the internet. Every computer on the internet gets knocked on all the time. If they are blocked, your firewall is doing its job. Nothing to worry about.
• A pop-up in your browser saying "Your PC is infected, call this number". That message is itself usually the scam. Close the browser tab. Microsoft does not contact you out of the blue about infections.
• A slow PC. Updates, a full disk or an old hard drive are far more common causes.

2. See what connects: Resource Monitor

Press Windows key + R, type resmon, press Enter, and open the Network tab.

• Processes with Network Activity: which programs are using the network right now.
• TCP Connections: each connection with the program (Image), the Remote Address and the port. Port 443 is normal encrypted web traffic.
• Listening Ports: programs waiting for connections from outside.

Look for a program you don't recognise that keeps a connection open. Don't panic about addresses: most belong to Microsoft, Google, your antivirus or cloud services. A name you don't know is a reason to look closer, not proof.

3. The same in a command: netstat -ano

Open Command Prompt and type:

netstat -ano

• -a shows all connections and listening ports, -n shows addresses as numbers (faster), -o shows the PID, the number of the program that owns the connection.
• State: ESTABLISHED = an open connection; LISTENING = waiting for connections; TIME_WAIT / CLOSE_WAIT = closing, usually harmless.
• Foreign Address: the other side. 127.0.0.1 and [::1] are your own PC; 192.168.x.x, 10.x.x.x and 172.16.x.x to 172.31.x.x are your own network.

To find the program behind a PID: Task Manager › Details tab, column PID. Or, in a Command Prompt run as administrator, netstat -anob shows the program name under each connection.

In PowerShell (Windows 8 / Server 2012 and later):

Get-NetTCPConnection -State Established |
  Select-Object RemoteAddress, RemotePort, @{n='Program'; e={(Get-Process -Id $_.OwningProcess).ProcessName}}

netstat and PowerShell show a snapshot: a program that connects for a second every hour will rarely be caught this way.

4. Check programs, startup and accounts

• Task Manager (Ctrl + Shift + Esc) › Processes: right-click an unknown name › Open file location. Programs from C:\Program Files or C:\Windows are normal places; an unknown program in AppData, Temp or Downloads deserves a closer look. Right-click the file › Properties › Digital Signatures shows who published it.
• Startup: Task Manager › Startup (Windows 11: Startup apps). Disable what you don't know or need. Microsoft's free Autoruns tool (Sysinternals) shows every place programs can start from, including scheduled tasks and services.
• Accounts: in Command Prompt, net user lists local accounts and net localgroup administrators lists who has administrator rights. Accounts like Administrator, Guest, DefaultAccount and WDAGUtilityAccount are built into Windows. Also check the sign-in activity of your Microsoft or e-mail account online.
• Installed programs: Settings › Apps. Sort by install date and look for anything new that you didn't install, especially remote-control tools.

5. Run a full scan

Windows Security › Virus & threat protection › Scan options:

• Full scan: checks all files. It takes a while; you can keep working.
• Microsoft Defender Offline scan: restarts the PC and scans before Windows starts, so malware that hides while Windows runs can be found. Save your work first.

6. When to get help

If you found clear signs (an account you don't know with administrator rights, a remote-control tool you never installed, security switched off):

1. Take the PC off the network: unplug the cable or switch off Wi-Fi.
2. Change important passwords from another, clean device, starting with e-mail and banking, and switch on two-step sign-in.
3. If banking or payments may be affected, call your bank.
4. At work: tell your IT team or provider before changing anything, so they can keep the evidence.
5. At home: ask a trusted IT professional. If in doubt, back up your personal files and reinstall Windows.

7. Seeing it all the time with Coinetic

Doing this by hand means...

• a snapshot: netstat and Resource Monitor show this moment, not the program that connected at 3 a.m.;
• bare numbers: you see an address, not who owns it or which country it is in;
• no say in the matter: the Windows Firewall lets every program connect out by default, so you only find out afterwards;
• remembering to check again next week, on every PC.

With Coinetic: installed in minutes, then it runs by itself

Coinetic works through the Windows Firewall that is already there. Setup installs a protection service that works in the background, also when nobody is logged on. No tool can promise 100% security, but you no longer have to guess what your PC is doing.

• Every connection, with a name: the Connections page shows every live connection in and out, with the program, the remote address, who owns it and the country. The live log shows every allowed and blocked connection with the rule that decided it.
• Is that program who it claims to be? Right-click any connection, port or log line › Process info shows the publisher and the digital signature. From the same menu you can block the program or stop it.
• You decide who may connect out: with outbound control on, every new program asks once, with who signed it, where it wants to go and a plain recommendation. Allow it, allow it only on your own network, or block it. The Programs page lists every decision.
• Unusual behaviour stopped automatically: in every plan, Coinetic learns what is normal for your PC for 7 days. A program that then suddenly contacts many addresses, scans other computers, sends mail like spam malware or "phones home" at regular intervals can be cut off from the internet automatically, and you can release it with one click.
• A one-click security check: the Security check lists what to fix, with an explanation and one-click fixes you can undo. The Overview shows green when you are protected.
• Your AI security analyst (Pro + AI): right-click any line, ban, port or connection and choose Ask AI, e.g. “What is this program connecting to, and is that normal?”. It looks up this computer's Coinetic data itself and answers in plain words, with what to do on this machine.

Coinetic runs on Windows 7 to 11 and Windows Server 2008 R2 to 2025, in any Windows language.

More guides: all Coinetic guides.

Frequently asked

How do I know if my computer is hacked?

Look for concrete signs: passwords changed without you, accounts or remote-control tools you don't know, security software switched off. Then check connections (Resource Monitor or netstat -ano), startup programs and accounts, and run a full or offline scan with Windows Security.

How do I see network connections in Windows?

Open Resource Monitor (resmon) › Network › TCP Connections, or run netstat -ano and match the PID in Task Manager › Details. Both show the current moment only.

My firewall shows many blocked attempts. Am I being hacked?

No. Every computer on the internet is probed all the time by automated scanners. Blocked means the firewall stopped them. What matters is what was allowed.

Is a full scan enough?

It is a good start. If you still see clear signs afterwards, run the Microsoft Defender Offline scan and get help from an IT professional; reinstalling Windows is the safest way to be sure.