Why would you look at your porforwarding...
Here's some steps:
1) Scan your computer
2) Do you use RSBot? If so: then go to RSBot/Scripts/Source/ and search for the phrase "getpass" and delete all scripts which contain it.
Steps to not be hacked:
1) Don't download random
****2) Be careful when using teamviewer, I would
never let people view my PC via teamviewer; It is very risky. (they could easily download their java drive-by onto your PC whilst you're not looking)