How To Tell If Your Computer Has Been Hacked By A Hacker

How To Detect A Hacker In Your Computer

There are many symptoms that could indicate someone has hacked your computer system, but how do you know for certain? The good news is a script kiddie (amateur hacker) will leave breadcrumbs after taking a constitutional through your computer's mainframe. The bad news is for a hacker who knows what they're doing, there's often discreet (if any) signs that they were ever there. 

Step 1: Close Unnecessary Programs & Apps

With today's computer systems and vast array of applications, at any given time, your computer could have hundreds of processes or subroutines running. It makes wading through the muck that much harder. It's likely many of those 'free' apps you have running are also spying on your activities, and reporting your information to a home server so the developer can resell your information.  First things first, open your computers add or remove programs dialog by going to your control panel (or in windows 7, by simply typing 'add or remove' in your search bar in your start menu). Get rid of the programs you never use.  Next, shutdown any unnecessary programs.  Things like your web browser, and any of those programs that are running in the background that aren't system critical. Now that we've tidied up our system a tad, let's do some searching.

Step 2: Netstat

Netstat (short for Network Statistics) is a tool run from your command prompt. Don't worry, it's easy to use.  Simply open your command prompt (from your windows accessories menu) or type 'cmd' into your search/run bar. Netstat is a wonderful tool to view active connections to your computer.  Netstat itself has a list of switches you can use to further filter what you see.  In this case, in the command prompt, we're going to type 'netstat -abo' - that 'a' switch tells netstat we want to view all current connections to the computer. The 'b' switch tells netstat to display the binary file - in this case, it means the name of the application that is actually creating the connection. 'o' tells us the process identifier. Netstat shows us five things - the protocol, the local address, the foreign address, the state, and the program making the connection.

Scan the application names for anything fishy. If you don't know what the application is intended for, or it's something obscure like 'process.exe', google it. 99% of the time, programs with obscure names mean nothing, but be on the lookout for anything with the application name "Can not obtain ownership information".  There's no reason to be alarmed just yet, but it does mean we need to do a bit more searching.

Step 3: Task Manager

You can run, but you can't hide. If you get the obscure "Can not obtain ownership information", look at the PID column.  The PID column is known as the process identifier. Open your system's task manager by hitting ctrl + alt + delete or by left clicking on your bottom tile bar and selecting 'Start Task Manager'. Click view and go to 'Select Columns'. Click the checkbox next to 'PID (Process Identifier)

Now that we have the PID column, click on your processes tab, and you'll be able to sort by clicking the column "Processes".  Find the PID number of the process that had the "Can not obtain ownership information" to view the name of the program that has the network connection.
Google the name of the process to determine if it is malicious in nature.

How To Spot A Hacked Computer Summary

Tracking down hackers inside your system can be a tedious task, but with the complexity of viruses, trojans, and attack methods that are becoming more and more complex - antivirus programs will frequently overlook or completely miss threats to your system. It's up to you to keep your system safe.