How to Check for Hacker Activity on Windows

All right, so now we got internet access on a return

on computer, let's go

ahead and log into the site, okay? All right, let's click Sign In,

and let us go

ahead and enter our email address.

Let us enter our password and log in into our email to check all of

our emails

that are sent to our account right now.

Now, let us just pause there for a moment.

What if a computer has already been hacked, and the hacker could see

all of the things that you entered inside your device?

And of course, if you see ransomware, it means that it is truly game over.

There is no other need for analysis or indicators, the computer has been

hacked. And what is happening behind the scene

is that we have already hacked into

the computer, and we're monitoring everything

that the user is doing.

And if I go in and enter keyscan_dom inside my hacker's computer,

and I hit Enter

on this, we can see everything that the user has entered into the

computer,

and I can see the password right here as one-two-three-four-five-six-seven-eight.

So we have full control and full access into the entire computer

system.

So you'll be wondering, what the hell is going on?

So majority of time, a hacker is going to be able to silently

watch everything that you're doing inside your computer

system.

And this is unlike those ransomware where you pop up, and it scares you, and you

know for sure you're already hacked.

But instead, we'll be looking at three signs,

three indicators that your

computer has under monitoring by a hacker.

Now what I want to do is go to the bottom left side, all right,

click under the

Start menu, and go ahead and enter CMD, and this would go and bring us

into command prompt. So go ahead and hit Enter on that.

And what I want you to do now is go ahead and enter netstat to see all

the existing

connection that you have with any other computers outside of your PC.

All right, so in this case, we have the following.

We have several connections for HTTPS. All right, so that is normal.

But if you see right here, all right, we got the following, which

is the hacker's

IP address. In this case, we have the following:

one-nine-two one-six-eight dot

zero dot one-nine-two and port four-four-four-four.

So this is the hacker who's connecting and remotely controlling

and monitoring everything that we're doing inside our computer

system.

The next thing you want to check for is do a right click at the bottom of your

task

bar and click under Task Manager. So once you click under Task Manager,

you want to look out for Windows PowerShell that is running.

And if you're just using a consumer computer, you should not be seeing Windows

PowerShell right here, okay? You see this process right here under

Processes?

All right, you have Windows PowerShell.

This should not be there at all. And now going back to the hacker's

computer, if I was to enter PS to list all the

running processes over here, and

if I was to enter, for example, get PID to actually list out the processor

we're

currently using to hack into the computer.

If I enter get PID, you see the following: three-two-nine-two as the process ID.

And of course, if I see over here, three-two-nine-two is PowerShell dot exe.

And the best way to terminate connection from the hacker is by killing off that

particular process. So now going back into our target

computer,

all I got to do is do a right click and click End Task, and this will kick

the hacker out from your computer.

And now going back into the hacker's box, you see right here, Meterpreter session

four closed. Reason: Died. And we have managed to kick the hacker off

of our computer. So the next way to check

is to look at our Windows Firewall and

see if it has already been turned on.

Let's go to the bottom left corner, all right, under the manual and the

firewall, all right, and go ahead and click under Windows Firewall, Control

Panel. So once you clicked on it, you can see the following over here.

We have the private networks, and we have the guest or public networks,

and all of

it is turned on. So that's great news that the firewall is running.

So the next best method is go to the bottom left corner under

Start menu again

and enter Defender. Right, and you will see the following Windows

Defender app.

Let's go ahead and click on it. Oh, gosh.

The app has been turned off by group policy.

That means the hacker would have actually went in and disabled your antivirus

system. So then the question is, what should we do?

Well, the best way is just to throw away the entire computer,

and that will help

you fix all possible hackers from further gaining any access into

your computer system, okay? Just kidding.

The best way out is to take out your entire hard disk drive.

Like, seriously, format it or throw it away and install a brand-new

hard

disk because you have no idea what kind of remnants are left remaining inside a

computer as a result of a cyberattack.

The other best way is to always prevent hackers from getting

access into your

computer, and that is by updating your computer regularly

and always running

antivirus scanning inside your computer as well as your mobile devices.

And once again, I hope you've learned something valuable

in today's tutorial.

And if you have any questions, feel free to leave a comment below,

and I'll try my

best to answer any of your questions.

Remember, like, share, subscribe, and turn on notifications so

that you can be kept

abreast of the latest ethical hacking tutorial. Thank you so much once again.