The netstat command is used to give information about active connections and ports that your computer is listening on (along with some ethernet statistics). It won't tell you if you someone has "hacked" your computer, though it might tell you if someone is remotely connected to your computer (assuming they haven't compromised your computer to hide that kind of information).
netstat also won't tell you if anyone else is on your network, it can only tell you what your local computer is connected to. If you're concerned with someone unauthorized on your network, you could use a tool like nmap or wireshark and do some basic probing to see if there are any devices on your network that you don't recognize. If you have a WiFi network, your wireless AP should have a log of some sort that can tell you if a device is on your wireless that you don't recognize.
If your computer is acting unusual and you really do suspect someone has compromised it, it would be a good idea to disconnect it from the internet all together, backup any sensitive data, and try a fresh install.
To answer your edit directly:
The question intended to ask whether there were any elements within the result-set of running netstat that a "Super User" would interpret as clearly suspicious, e.g (... I suppose), an IP address which is not your own, or a an address that is known to originate in a suspicious place, or some string known to indicate a problem, etc.
Again, using netstat will only show you what your computer is connected to; as an example, this is the result when I run netstat -a:
C:\>netstat -a
Active Connections
Proto Local Address Foreign Address State
TCP 127.0.0.1:1032 localhost:1033 ESTABLISHED
TCP 127.0.0.1:1033 localhost:1032 ESTABLISHED
TCP 127.0.0.1:6118 localhost:6119 ESTABLISHED
TCP 127.0.0.1:6119 localhost:6118 ESTABLISHED
TCP 192.168.1.5:1031 fileserver:microsoft-ds ESTABLISHED
TCP 192.168.1.5:6316 imap11:imaps CLOSE_WAIT
TCP 192.168.1.5:7345 stackoverflow:https ESTABLISHED
TCP 192.168.1.5:7356 stackoverflow:https ESTABLISHED
UDP 0.0.0.0:1900 *:*
From these results alone I can see that my IP (192.168.1.5) has connected to my NAS (fileserver), an email server (imap11) and the StackOverflow web site (stackoverflow:https).
I can also see that my local host IP (127.0.0.1) has some connections established and my machine is also listening on UDP port 1900 (UDP 0.0.0.0:1900 *:*). These might concern me if the only tool I had was netstat, but I can also use the Windows Resource Monitor (or TCPView) to see which programs have active connections. I could also shutdown programs one by one and see which connections leave the ESTABLISHED state, but that could take a while...
Looking at those results, I can see that the localhost connections are my Firefox instance (which some program use localhost for inter-process communications), so I don't need to concern myself with that connection and the UDP is actually my media playing program that has an interactive interface (for remote play, etc.) and UDP doesn't go outside (or into) my network and I have an active firewall blocking it, so I don't need to concern my self with that either.
IFF I happened to see a connection I could not correlate to a known active connection (i.e. my email or internet), then I would break out the other tools I mentioned to further investigate that specific connection.
Keep in mind that netstat will only show you active TCP or UDP connections, and while TCP and UDP are the most common protocols, there are a slew of others that exist that are potential attack avenues that netstat cannot show. Additionally, an attacker or malicious program could bypass all protocols and use there own custom connection protocol using RAW sockets (low level programming). Granted some methods would require certain levels of administrative privilege, while others wouldn't.
So netstat can tell you some information, but it doesn't paint the whole picture and it especially can't give enough information to validate that something malicious is actually happening.
Hope that can help.
