Signs of a Hacked Computer: What’s Real, What’s Not, and What to Do First

The most reliable signs of a hacked computer are: a password that suddenly stops working, password-reset or new-sign-in emails you didn’t request, antivirus that turns itself off and won’t stay on, programs or browser extensions you didn’t install, messages sent from your accounts that you didn’t write, and — the unambiguous one — the mouse moving or windows opening on their own. A slow computer by itself almost never means you’ve been hacked.

We get this call regularly at our help desk, and the honest answer is that most "I think I’m hacked" cases turn out to be something mundane — while a few real compromises go unnoticed for weeks because the symptoms were quiet. Here is what each sign actually indicates, what to do in the first ten minutes, and which scary-looking symptoms are usually nothing.

Signs that deserve immediate attention

  • Your password stops working on an account you use daily. Attackers who take over an account often change the password immediately to lock you out. This points to a stolen credential, not necessarily malware on the machine.
  • Password-reset or "new sign-in" emails you didn’t trigger. Someone is actively trying to get in, or already has. Take these seriously even if nothing else seems wrong.
  • Windows Defender or your antivirus is disabled and re-disables itself after you turn it back on. Legitimate software rarely does this. Malware disabling protection is usually its first move.
  • New programs, browser extensions, or toolbars you never installed. Especially remote-access tools like AnyDesk, TeamViewer, or ScreenConnect that you didn’t put there yourself.
  • Contacts receive emails or messages you didn’t send. Your account or machine is being used to spread — and the attacker has been in long enough to harvest your address book.
  • The cursor moves, windows open, or text types on its own. That is a live remote-control session. Disconnect the network immediately.
  • Files are renamed or won’t open, and a text file demands payment. Ransomware. No ambiguity — stop using the machine and get help before anything spreads.

Hacked account vs. hacked computer — they’re different problems

This distinction changes what you do next. If the symptoms are all about accounts — resets you didn’t request, messages you didn’t send, sign-ins from odd places — the likely cause is a stolen or reused password, often from a phishing email or an old data breach. The computer itself may be perfectly clean, and the fix is account recovery: new passwords and multi-factor authentication. If the symptoms are about the machine — disabled antivirus, unknown programs, a moving cursor — the device itself is compromised, and changing passwords from that device just hands the attacker your new ones.

What to do in the first ten minutes

  1. Disconnect the machine from the network. Unplug the Ethernet cable or turn off Wi-Fi. For a business computer, leave it powered on — shutting it down can destroy evidence in memory that an investigator needs.
  2. Use a different, trusted device to change passwords. Email first, since it can reset everything else. Then banking, then the rest. Turn on multi-factor authentication as you go.
  3. Check your email settings for forwarding and inbox rules. Attackers plant rules that quietly forward or delete mail so you don’t see recovery notices.
  4. Run a full scan with your endpoint protection from the affected machine once it’s offline, and treat the results as a starting point, not a verdict.
  5. If it’s a work computer, stop here and call your IT provider. Don’t wipe or reinstall Windows on your own. Reimaging destroys the evidence needed to answer the question that matters to a business: what did they access?

When it’s probably NOT a hack

  • General slowness. The single most common false alarm. Aging hardware, a nearly full drive, Windows updates, or too many startup programs explain the vast majority of slow computers.
  • Pop-ups in the corner of the screen. Usually a website you accidentally allowed to send browser notifications. Annoying, but fixed in your browser’s notification settings — no malware removal required.
  • A full-screen "YOUR COMPUTER IS INFECTED — CALL MICROSOFT" warning with a phone number. That is a scam page trying to get you on the phone, not evidence of a hack. Microsoft does not put phone numbers in virus warnings. Close the browser (Ctrl+Alt+Del if needed) and never call the number.
  • Crashes and blue screens. Almost always drivers, updates, or failing hardware.
  • Loud fans. Usually updates or indexing running in the background — though a machine pinned at 100% CPU while sitting idle for days is worth having checked, since hidden cryptomining does happen.

When to bring in help

For a personal laptop with no sensitive data, careful cleanup or a fresh Windows install may be enough. For a business machine — anything that touches customer data, accounting, or your email domain — treat it as an incident, not a repair ticket. A security team can isolate the device, determine how the attacker got in, establish what was accessed, and rebuild it properly so the same door isn’t left open. That last question is the one insurers, regulators, and customers will ask, and you can’t answer it after a DIY wipe.

Equal Tech Solutions provides managed cybersecurity and incident response for small businesses across Cleveland, Chattanooga, and the Southeast US — including 24/7 endpoint monitoring that catches these signs before you do. If something on your screen right now prompted this search, contact us and we’ll help you figure out whether it’s real.