- Press Ctrl-Alt-Del (all 3 keys simultaneously, known as a “three-finger salute”). This should pop up the Task Manager, or whatever Microsoft is calling it lately. One of the tabs should be Processes; click that tab.

1) Look up every process name on the Internet. Don’t trust all the information that you find, but try to get a general consensus from the more reliable sites whether that process name is likely to be malevolent or not.

2) Even if a process name is normal and expected (like svchost.exe), it’s still possible that a “hacker” was able to overwrite the normal system process with a tainted one.

3) If a process looks suspicious, for example u-r-0wn3d.exe, you will need to attempt removal. See Tips for ideas on that process.

- Open a command window, also known as a “DOS box”, by clicking Start | Run | cmd, or Start | Run | command on older systems. Type in the command: netstat -an. This will show you a list of systems you have connected to, and systems connected to you, and all “listening” ports. Learn the port numbers: 80 and 443 are typical for the “web”; 135, 139, and 445 are for Microsoft networks; find out what they all mean. If you see something suspicious, netstat -anbv might show you what process is doing the communication.