How to check if your PC is hacked (2026 Updated)

Assessing a Windows PC for Persistent Malware

Eric Parker demonstrates how to assess a Windows PC for persistent malware using an infected virtual machine. A computer can appear normal even when it contains information stealers or remote-access trojans (RATs). He emphasizes that no single symptom or tool proves a system is compromised.

Warning signs to investigate

• Windows Defender settings: On a personal PC, “Managed by your administrator” is suspicious if you did not configure it. Check Defender exclusions for unfamiliar programs, broad folder exclusions, or file-extension exclusions that could effectively disable protection.
• Restricted system tools: “Disabled by administrator” messages in PowerShell, Command Prompt, Task Manager, or Registry Editor may indicate malware interference. These restrictions can also be legitimate on managed work or school devices.
• Unusual behavior: Unexpected, deliberate-looking mouse movement or programs such as PowerShell repeatedly opening and closing may indicate remote access or a poorly written payload.
• Startup activity: PowerShell or Command Prompt windows appearing at every boot, or errors saying a file cannot be found, may point to suspicious startup entries.
• Processes and persistence: Process Explorer can reveal suspicious process names, parent-child relationships, and command-line activity. Autoruns can help locate programs configured to start automatically, including entries associated with startup, Explorer, scheduled tasks, and services. Neither tool is an antivirus, and unsigned or unfamiliar entries are not automatically malicious.
• Performance changes: Slowness and crashes are usually caused by ordinary software or hardware issues, not malware. A miner is more plausible if the PC speeds up when Task Manager opens or the fans run heavily while the computer is idle, though legitimate software can also use resources in the background.
• Defender prompts: An unexpected UAC prompt to change Defender settings may mean a program is trying to disable protection.

Checking and removing malware

1. Review Defender exclusions and scan the PC. Remove suspicious exclusions, then run a scan. Parker says a Quick scan checks running activity and common high-risk locations. A clean result does not necessarily mean a full scan will help; Defender may simply not recognize the malware.
2. Use a second-opinion scanner if needed. The video names HitmanPro, Sophos Scan and Clean, and Emsisoft Emergency Kit. Parker says Malwarebytes was less effective in his experience. Scanners can miss threats and may not undo malicious system-setting changes.
3. Disconnect the PC if an attacker may have remote control. If a RAT or reverse shell could let an attacker control the computer, disconnect it from the internet immediately. For a data stealer or miner, Parker says to proceed directly to cleanup.
4. Seek further help if necessary. The video points to BleepingComputer’s volunteer malware-removal forums, where users may be asked to run diagnostic tools such as FRST. The forum has rules, including restrictions on pirated software and AI-generated content.
5. Reinstall Discord after an infection. Some malware targets Discord’s main.js file to capture what users type, potentially without detection by antivirus.
6. Reinstall Windows if the infection is persistent or involved a targeted RAT. Back up appropriate data first. Parker describes reinstalling as the more reliable option when it is difficult to determine what a long-running attacker changed or installed. When possible, create installation media on another PC.

Securing accounts after a compromise

• Secure the email account first: Change its password, review active sessions, sign out compromised devices, and check for suspicious mail filters. The video demonstrates Google account session controls and notes that other providers have similar options.
• Change other credentials and revoke sessions promptly. Stolen information may be used immediately or sold later, so delays matter.
• Treat payment-card details as exposed if they were saved in a compromised browser or entered during the incident. Consider cancelling and replacing the card.
• Update software cryptocurrency wallets and move funds to a secure wallet as soon as possible, while recognizing that funds may already have been stolen.
• Revoke access to other accounts and devices that could be misused, including cloud security devices, cameras, and social media.
• Change credentials even if the malware is no longer running. If friends receive messages you did not send, accounts may have been compromised through password reuse or a one-time information stealer.

Guides and tools covered

• Process Explorer: Inspect processes, command lines, and process trees.
• Autoruns: Review persistent startup entries.
• Windows Defender: Check protection settings and exclusions, then scan.
• Second-opinion scanners: HitmanPro, Sophos Scan and Clean, and Emsisoft Emergency Kit.
• BleepingComputer malware-removal forum: Seek volunteer assistance and follow its preparation instructions.
• Windows installation tutorial: Parker refers viewers to a separate guide for reinstalling Windows.

Main speaker and source: Eric Parker, the video’s presenter.