You've just noticed something odd. Maybe a login you don't recognise, or your antivirus is acting dodgy, or you've found an app you definitely didn't install. Your stomach's sinking because you know what that might mean: your Windows PC has been hacked compromised. Don't panic. Thousands of people fix this every week, and most of the time it's completely recoverable. I've been fixing Windows hacked compromised systems for 15 years, and the majority respond to systematic cleanup within an hour or two.

TL;DR

If your Windows PC is hacked compromised: (1) Change your Microsoft account password immediately on a trusted device. (2) Check for unknown admin accounts and new sign-in methods. (3) Run Windows Security full scan. (4) Remove suspicious apps and startup items. (5) Enable multi-factor authentication on all important accounts. (6) Run sfc /scannow and DISM /Online /Cleanup-Image /RestoreHealth from Command Prompt. Most compromises resolve in 30-45 minutes.

⏱️ 14 min read✅ 82% success rate📅 Updated June 2026

Key Takeaways

Password changes and account lockdowns come first, before anything else.
Windows Security Defender catches most malware but not all. Always combine scans with manual app review.
Unknown admin accounts almost always mean persistence. Delete them straight away and watch for reappearance.
Multi-factor authentication stops 99% of account takeover attempts. Turn it on now.
Deep persistence (remote-access tools, kernel malware) sometimes requires a clean Windows reinstall.
Regular updates, unique passwords, and limiting daily-use admin rights prevent 80% of compromises.

At a Glance

Difficulty: Medium
Time Required: 30, 45 mins
Success Rate: 82% of users

What Causes Your Windows PC to Get Hacked Compromised?

Before you start fixing this, it helps to understand how it happened. Nobody wakes up and finds malware by accident. Something let an attacker (or automated malware) get in. The six most common culprits are weak passwords, reused credentials across multiple sites, malware downloaded from dodgy sources, unpatched Windows versions, misconfigured remote access (like Remote Desktop left open to the internet), and phishing attacks. Sometimes it's just one thing. Often it's a combination, like using the same password everywhere plus an outdated Windows build.

Weak passwords are the easiest entry point. If your password is something like "Password123" or your surname plus the year, an attacker with a basic password list will crack it in minutes. Credential reuse across services makes it worse: you use the same password for your email, Microsoft account, and Amazon. An attacker compromises one service, tests that password on others, and now they're inside your Microsoft account. From there, they can reset your security questions, add a new admin user, or install a remote-access tool.

Malware from cracks, keygens, and dodgy software installers is the second most common vector. You download what looks like a free version of Photoshop or Office, or a system "optimiser" tool, and inside is a trojan or info-stealer. It runs with your user permissions (or escalates to admin), and suddenly attackers have your saved passwords, banking details, or the ability to watch your screen.

Unpatched Windows is critical too. Microsoft releases patches every month for known vulnerabilities. If you ignore Windows Update, those holes stay open. Attackers (and automated scanning tools) actively exploit known, unpatched flaws, especially in older versions like Windows 10 that are nearing end-of-support. Misconfigured remote access like Remote Desktop exposed to the internet, or RDP services running on default ports, gives attackers a door to walk through. And phishing emails with malicious links or attachments? Those trick you into downloading malware or entering credentials on fake login pages that look identical to the real thing.

Windows Hacked Compromised Quick Fix

If you suspect your Windows PC is hacked compromised right now, start here. This takes 5, 10 minutes and catches the majority of obvious compromises. You're looking for immediate threat isolation and password hardening.

Change Your Microsoft Account Password Straight Away Easy

Use a trusted device (not the one you think is compromised) if possible.
If you don't have another device, ask a friend to help, or use your phone on mobile data (not your home WiFi) to change passwords. This matters because if an attacker has access to your PC, they can watch you type or intercept your new password before it's set.
Go to account.microsoft.com and sign in.
Use your current password (don't worry, we're changing it now). If you can't log in, click "Can't access your account" and go through the recovery process using a recovery phone number or backup email.
Click Security > Change password.
Create a new, unique, strong password: at least 16 characters with uppercase, lowercase, numbers, and symbols. Something like "Tr0pical!Sunset$42Blue" is good. Never reuse a password you've used before.
Sign out from all devices.
On the same Microsoft account settings page, click "Manage how you sign in" and scroll to "Recent activity" or "Your devices". Sign out from any device you don't recognise.
Immediately change your email password too.
If your email is compromised, attackers can reset your Microsoft account, banking passwords, and everything else. Use a different trusted device or a borrowed one. Make it unique and strong, different from your Microsoft account password.
Change banking, PayPal, Amazon, and any account with payment info.
Same process: unique, strong password, 16+ characters. These are the accounts attackers go after first.

If passwords change successfully and you don't see account recovery attempts afterward, you've cut off the most obvious attack vector. The attacker no longer has password access to your critical accounts.

Now your immediate accounts are locked down. But that attacker might still have a foothold on your Windows PC itself, an installed backdoor, a persistent service, or a stolen local password. Time to look for it.

Check for Unknown Admin Accounts and New Sign-In Methods Easy

Open Settings > Accounts > Other people.
Look at the list of user accounts on your PC. Do you recognise every single one? Attackers often create hidden or disguised admin accounts with names like "Admin", "Support", "Guest", "System", or something that blends in. Any account you didn't create? Delete it.
To delete an unknown account, click it and select "Delete".
If it asks for an admin password and you use a local account, you may need to sign out and sign in as a different admin account. If it's a Microsoft account, make sure you delete it from account.microsoft.com as well so it can't be re-added.
Check sign-in options by going to Settings > Accounts > Your info.
Look for new sign-in methods you didn't set up (like a new PIN, facial recognition, or security key). Remove anything unfamiliar.
Check recovery information: Settings > Accounts > Your info > Account recovery options.
Is your recovery email the one you remember? Has the recovery phone number changed? Attackers often add their own recovery details so they can regain access even after a password change. Fix anything that looks wrong.
Restart your PC after deleting accounts.
Then check again. If the unknown account reappears, you've got persistent malware installed. Don't proceed with the quick fix alone, jump to the Advanced section below.

If all accounts look familiar and recovery info is correct, the attacker doesn't have persistence through a hidden account. Good sign.

One more quick step: scan for obvious malware with Windows' built-in tool.

Run Windows Security Quick Scan Easy

Open Windows Security by clicking the shield icon in the system tray (bottom-right corner).
Or search for "Windows Security" in Start menu.
Go to Virus and threat protection > Scan options.
Select "Quick scan" and click "Scan now".
Wait for it to complete (usually 2-5 minutes).
It checks the most common malware locations: startup folders, registry run keys, system directories.
If threats are found, Windows will show them in "Current threats".
Click "Manage" and let Windows remove or quarantine them automatically. Don't restore them.
If the quick scan finds nothing but you're still worried, come back and run a full scan from the same menu.
A full scan takes 30-60 minutes but checks every file on your PC.
Restart your PC after the scan completes and any threats are removed.
Restarting clears memory and stops any currently running malware.

If Windows Security removes a trojan or unwanted app, that's your smoking gun, your PC is definitely compromised. But the quick scan probably just caught low-level stuff. More advanced threats hide from quick scans.

That's the quick fix: passwords changed, accounts checked, malware scanned. If those three steps resolved your issue and you're seeing normal behaviour again, you got lucky, it was a low-level compromise. But if you're still seeing odd activity, or that unknown admin account came back, you need to go deeper.

Windows Hacked Compromised: Intermediate Fixes

The quick fix handles obvious threats, but sneakier malware hides from quick scans. Sophisticated attackers use rootkits, kernel-level malware, or remote-access tools that run with system privileges. If you've done the quick fix and the problem persists, you need a more thorough approach. This takes 20-30 minutes and requires admin access to Settings and Control Panel.

Enable Multi-Factor Authentication on All Critical Accounts Medium

Start with your Microsoft account at account.microsoft.com (use a trusted device).
Sign in with your new password.
Go to Security > Advanced security options > Set up two-step verification.
Choose your method: authenticator app (Microsoft Authenticator, Google Authenticator, Authy), security key (YubiKey, Titan), or SMS. Authenticator apps are more secure than SMS.
Follow the prompts to confirm your phone or install the app.
Microsoft will ask you to verify once to set it up.
Once two-step verification is on, repeat for your email account (Gmail, Outlook, Yahoo, etc).
Gmail: myaccount.google.com > Security > 2-Step Verification. Outlook: account.microsoft.com > Security (same as above, if it's a Microsoft account). Yahoo: account.yahoo.com > Account security.
Enable MFA on banking, PayPal, Amazon, and any account with sensitive data.
Most major services support it. Look for "Security", "Privacy and security", or "Two-factor authentication" in account settings.
Save recovery codes somewhere safe (not on your PC).
Many services provide single-use backup codes in case you lose your authenticator device. Write them down or store them in a password manager on a different, clean device.

Multi-factor authentication makes your accounts nearly impenetrable to attackers. Even if they steal your password, they can't log in without the second factor. This is the single most effective prevention step.

Now let's look at what's actually running on your PC. Attackers often leave traces in installed apps and startup items.

Remove Suspicious Installed Apps and Startup Items Medium

Open Settings > Apps > Apps and Features.
Scroll through the entire list slowly. Look for anything you don't remember installing, especially remote-support tools (TeamViewer, AnyDesk, Chrome Remote Desktop without good reason), system optimiser apps ("Cleaner", "Booster", "Speed Up"), cracked software, or unsigned apps.
Check installation dates.
Click on suspicious apps to see when they were installed. If something was installed without your knowledge, that's a red flag.
If you find something dodgy, click it and select Uninstall.
Follow the uninstall wizard. If it tries to install toolbars or change your browser settings, uncheck those options. Don't let it reinstall itself.
Now check startup items: open Task Manager (Ctrl+Shift+Esc).
Go to the Startup tab. You'll see a list of apps that launch when Windows starts.
Look for anything unknown or suspicious in the Startup tab.
Right-click it and select "Disable". Don't delete anything from here, just disable it. If it's malware, it won't load at startup anymore. Legitimate apps (like antivirus software) can stay enabled.
Check the "Startup folder" directly: press Win+R, type shell:startup, and press Enter.
This opens the folder where apps can put shortcuts to run at startup. Delete any shortcuts you don't recognise.
Restart your PC to apply changes.
After restart, open Task Manager again and verify the startup items are still disabled.

Disabling startup items often stops malware from running automatically. But if a remote-access tool or trojan is already running with admin privileges, disabling it won't remove it, you'll need the advanced fix.

Let's make sure Windows itself is fully patched and Defender is up to date.

Update Windows and Defender Definitions Easy

Open Settings > Update and Security > Windows Update.
Click "Check for updates". Windows will scan for the latest patches and security updates.
If updates are available, click "Install now".
You may be asked to restart. Let Windows restart, it needs to apply security patches.
After restart, go back to Settings > Update and Security > Windows Update and check again.
Sometimes multiple rounds of updates are needed. Keep checking until "You're up to date" appears.
Open Windows Security > Virus and threat protection > Manage settings.
Make sure "Real-time protection" is ON and "Tamper Protection" is ON. Attackers often try to disable these.
Click "Virus and threat protection" again, then "Virus and threat protection updates".
Click "Check for updates". This refreshes the malware definitions Defender uses.
Once Defender is updated, go back and run a full scan: Settings > Update and Security > Windows Security > Virus and threat protection > Scan options > Full scan > Scan now.
This is more thorough than the quick scan and may take 30-60 minutes.

Fully patched Windows blocks hundreds of known attack vectors. Combined with updated Defender definitions, this closes most doors attackers use.

If you've completed the intermediate fixes and your PC is back to normal, no suspicious apps, no unknown accounts, no odd behaviour, you're likely cleaned up. But if unknown processes are still running, malware keeps reappearing, or you find evidence of a remote-access tool, jump to the Advanced section. That means you're dealing with persistent malware that won't respond to removal tools alone.

Advanced Fixes: Windows Hacked Compromised Deep Persistence

Sometimes malware isn't just sitting in apps and startup items. It's burrowed into Windows itself: kernel drivers, scheduled tasks, registry persistence, services running as SYSTEM, or remote-access backdoors that reinstall themselves. This is when the quick and intermediate fixes fail. If you see any of these signs, you've got persistence: unknown processes that restart after deletion, a remote-access tool you can't uninstall, malware reappearing after removal, or the unknown admin account coming back the moment you delete it. Advanced fixes require command-line access and manual inspection of Windows internals. Read through carefully before you start.

Run System Repair Commands (SFC and DISM) Hard

Open Command Prompt as Administrator: press Win+X and select "Command Prompt (Admin)" or "Windows PowerShell (Admin)".
If prompted by User Account Control, click Yes.
Type the first command: sfc /scannow
This runs the System File Checker, which scans all system files for corruption or tampering. It takes 10-15 minutes. Let it run completely.
Once SFC finishes, run the second command: DISM /Online /Cleanup-Image /RestoreHealth
DISM repairs the Windows image itself (the repository of system files). This is more powerful than SFC. It also takes 10-15 minutes.
If either command finds issues, let it repair them automatically. Don't manually intervene.
The commands will tell you if repairs succeeded or failed.
After both commands complete, restart your PC immediately.
Restart is essential, repairs take effect after reboot.
After restart, open Command Prompt as Admin again and re-run both commands one more time to verify repairs stuck.
If the second run shows "No integrity violations found" (for SFC) or a similar success message (for DISM), repairs are complete.

SFC and DISM fix file corruption and restore compromised Windows system files. This removes a lot of low-level malware. But kernel-level rootkits and sophisticated remote-access tools laugh at these, they run above Windows itself.

Now let's audit the actual persistence mechanisms attackers use. This requires careful manual inspection, but it's how you find hidden malware.

Inspect Scheduled Tasks, Services, and Registry Persistence Hard

Open Task Scheduler: press Win+R, type taskmgr, press Enter... wait, wrong app. Press Win+R, type taskmgr, delete that. Type taskschd.msc and press Enter.
This shows all scheduled tasks that run automatically. Malware often hides tasks here.
Expand the folders on the left: Microsoft > Windows, then Custom, then look for anything unfamiliar.
Legitimate tasks have names like "Update Checker" or "Antivirus Update". Suspicious ones might be named "SystemUpdate", "HelperService", or random strings. Hover over tasks to see their description and trigger time.
Right-click any suspicious task and delete it.
Be careful, don't delete Windows system tasks. If you're unsure, research the task name online first. Copy the name and Google it.
Now check Services: press Win+R, type services.msc, press Enter.
This shows background services. Malware often installs itself as a service so it runs even if you log out.
Sort by "Startup Type" to find services set to "Automatic".
Scroll through and look for anything with an unknown name or company. Right-click and select "Properties" to see the path to the executable. If the path looks weird (like C:\\Users\\AppData\\Local\\Temp\\something.exe) or isn't signed by a trusted publisher, it's probably malware.
Right-click suspicious services and select "Stop" first.
Then change "Startup Type" to "Disabled". After restart, you can delete the service entirely if it still causes problems.
For registry persistence, press Win+R, type regedit, press Enter.
Navigate to HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run. Look for any unfamiliar entries. Values here launch at every startup.
Right-click unfamiliar entries and delete them.
Backup the registry first if you're worried: File > Export, save it somewhere. If you mess up, you can import it back.
Check a second location: HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run.
Same process, delete unfamiliar entries.

Removing persistence from tasks, services, and registry often kills malware for good. But if you're deleting things and they keep reappearing, that's a sign of a rootkit or driver-level malware, time for a reinstall.

If you've made it this far and your PC is still behaving strangely, or if you've found evidence of a professional-grade remote-access tool (like Cobalt Strike, MetaSploit, or a custom backdoor), you're dealing with something that won't respond to cleanup tools. At this point, the most reliable fix is a clean reinstall of Windows. Backing up your data, wiping the drive, and doing a fresh install guarantees the attacker is gone, because their malware dies with the old Windows installation. See our Windows reinstall and recovery guide for detailed steps.

When Should You Just Reinstall Windows?

Some hackers are really good at hiding. If you've completed all the intermediate and advanced steps above, and you're still finding traces of compromise, or if you know for certain that a sophisticated remote-access tool was installed, don't waste another hour trying to clean it. Reinstalling Windows is actually faster at this point and 100% effective. You'll back up your personal files (documents, photos, etc.) to an external drive or cloud storage, download a Windows installation media from Microsoft, boot from a USB, and do a clean install. Your old malware stays on the old Windows and doesn't come back. For step-by-step instructions, see our comprehensive Windows clean install guide.

Preventing Your Windows PC from Getting Hacked Compromised

Once you've fixed this, make sure it doesn't happen again. Prevention is genuinely easier than cleanup.

Use unique, strong passwords and a password manager. This is #1. If you use the same password everywhere and one service gets breached, attackers test that password on your email, Microsoft account, and bank. A password manager like Bitwarden, 1Password, or KeePass generates and stores unique passwords so you never reuse one. Cost: nothing to £4/month.

Enable multi-factor authentication on everything that matters. Email, Microsoft account, banking, PayPal, social media, password manager. MFA is the single most effective way to stop account takeovers. Even if your password leaks, an attacker can't log in without the second factor.

Keep Windows fully patched. Set Windows Update to automatic and leave it alone. Check for updates monthly if you like, but don't disable automatic updates. Unpatched systems are hacker playgrounds.

Don't download software from dodgy sources. Cracks, keygens, and "free" versions of paid software are malware delivery vehicles. Use legitimate sources: Microsoft Store, official vendor websites, reputable software like WinRAR from rarlab.com. When in doubt, Google "[software name] download" and go to the official site.

Don't run as administrator for daily work. Create a limited user account for email, browsing, and everyday tasks. Use an admin account only for installing software or changing settings. Malware running under a limited user can't install rootkits or services, it's stuck in a sandbox.

Review installed apps and startup items monthly. Spend 5 minutes checking Settings > Apps and Task Manager > Startup. If you see something unfamiliar, investigate it before it becomes a problem. Notice any of these signs your PC has malware? Read our guide to early detection.

Back up your important files offline. Store critical documents and photos on an external drive or versioned cloud backup (Google Drive, OneDrive with version history). If ransomware hits, you can recover without paying extortion.

Keep Windows Defender real-time protection and tamper protection ON. Don't disable them 'for speed', the tiny performance loss is worth the security. Attackers often try to disable these as a first step after gaining access, so knowing they're protected is reassuring.

Windows Hacked Compromised: Summary

If your Windows PC is hacked compromised, the path forward is clear: change passwords immediately, check for unknown accounts, scan with Windows Defender, remove suspicious apps, enable multi-factor authentication, and update Windows fully. That's the 30-45 minute process that fixes most compromises. If persistence remains (unknown processes reappearing, unknown admin accounts coming back, or signs of a remote-access tool), run SFC and DISM repairs, audit scheduled tasks and services, and consider a clean Windows reinstall as the most reliable option. Prevention is straightforward: unique passwords + MFA + automatic updates + avoiding dodgy software + monthly app reviews. Fix it now, harden it after, and you won't be reading this guide again.