The computer is acting strange, and you want to know whether it’s hacked or just old.

Signs that carry little weight on their own

NIST’s incident handling guide says signs of an incident are “all too common,” that user-reported ones are often incorrect, and that even an accurate sign may not mean an incident, because a crash or a changed file can have ordinary causes, including human error. That fits what most offices see.

• The computer is slow, or the fan runs. The working-hard page covers how to read that.
• A pop-up in the browser. That has its own page.
• A program crashed, or a restart happened that you didn’t start.
• A friend says they got an odd message from you. That points at your mailbox before it points at this computer.

Signs that carry real weight

• A detection in the antivirus history that came back after removal. Microsoft describes this as possibly “an undetected malware component constantly, quietly, reinstalling the detected malware.”
• A sign-in to this computer that no one can place. See the next section.
• A program that starts at sign-in and no one can say who installed it. Open Settings, then Apps, then Startup, and read the list. Task Manager’s Startup apps tab shows the same list.
• The security tool reads off, and the reason is unexplained. The antivirus page covers what ordinary reasons look like.
• Two or more of the above on the same computer. One sign is a question. Several together, with dates close to each other, is a pattern.

One thing the computer can tell you: who signed in

Windows records successful sign-ins as event 4624 in the Security log, found in Event Viewer under Windows Logs. Each one carries a logon type. Microsoft’s table lists type 2 as someone at the keyboard, type 3 as a sign-in from the network, and type 10 as a remote desktop session.

A type 10 event at 2 a.m. on a computer nobody connects to remotely is worth writing down, with the account name and the source address. A type 10 event from your own IT person on the day they worked on it is not. If the log has nothing, that proves very little: the log only exists if sign-in auditing was on, and an attacker with administrator rights can clear it.

The scan that runs outside Windows

Microsoft says its offline scan runs from outside the normal Windows kernel, so it can find malware that hides while Windows is running, and that you can use it if you suspect an infection. Open Windows Security, Virus & threat protection, Scan options, choose the offline scan option, and select Scan now.

Save your work first. It takes about 15 minutes and restarts the computer. If BitLocker is on, suspend it beforehand or the computer may ask for the recovery key. Afterward, results are under Virus & threat protection, Scan options, Protection history. It doesn’t apply to servers or to ARM-based Windows.

What the computer cannot tell you

• Whether anyone who has the account password is signing in from elsewhere. That lives in the mailbox and cloud sign-in history, not on the computer.
• Whether data was copied. Most computers don’t keep that record.
• Whether it is clean. A scan finds what it recognizes, on the day it ran. A clean scan is a clean scan, and nothing more.

Write it down before changing anything

Write down each sign, the date you first saw it, and what the computer was doing. Don’t reinstall or wipe it yet, because that removes the evidence. If you decide to move forward, the evidence page lists what disappears first.

When we look at this with you, we read the startup list, the sign-in events, the detection history, and the accounts, and tell you what we found and what we didn’t, with the dates. A person reads the result.

Weak signs are worth a look, and several strong ones on the same machine are worth a call.

Related

• Mouse Moving on Its Own: Hardware, or Someone Connected?
• Keeping Evidence Before You Clean Up a Computer
• What a Compromise Check Can and Cannot Show You
• Antivirus Shows as Off and Nobody Turned It Off

Sources

• NIST: SP 800-61 Rev. 2, Computer Security Incident Handling Guide (section 3.2, signs of an incident)
• Microsoft Learn: Offline scan in Windows
• Microsoft Support: Troubleshoot problems with detecting and removing malware
• Microsoft Learn: Event 4624, an account was successfully logged on
• Microsoft Support: Configure startup applications in Windows