Remote access tool vs remote access trojan (RAT): what's the difference?

A trojan is malware dressed up as something you want. A remote access trojan is one that, once it's running, lets someone else control the computer over the internet. It usually arrives as an email attachment, a fake invoice or update, a pirated game or app, or a download a scammer talks you into.

Once installed, it hides: it starts with Windows, avoids showing a window or an icon, and may try to switch off security software. The person behind it can then watch the screen, record keystrokes, copy files and saved passwords, use the camera or microphone, or install more malware.

The same letters cause confusion: RAT can mean remote access trojan or remote administration tool. Security news nearly always means the trojan.

• The pointer moves, windows open or text appears that you didn't do.
• The camera light comes on when you aren't using the camera.
• Your security software has been switched off, or won't update.
• Programs you don't recognize in Task Manager or in its Startup apps tab.
• A program you don't know keeps a steady network connection open.
• Passwords stop working, or your accounts show sign-ins you didn't make.

None of these proves it on its own. The step-by-step checks in how to tell if someone is remotely accessing your computer show what's running, who is signed in and what's connecting out, with tools built into Windows.

1. 1

   Step 1: Disconnect the PC

   Unplug the network cable or turn off Wi-Fi. That cuts off whoever is controlling it.

2. 2

   Step 2: Scan it

   Run a full scan with your security software, then an offline scan, which checks the PC before Windows starts. In Windows Security that's Virus & threat protection, then Scan options.

3. 3

   Step 3: Change your passwords from another device

   Start with your email, then banking and anything that pays for things. Turn on two-step verification and sign out of other sessions in each account.

4. 4

   Step 4: Reset if you can't be sure

   If the scan can't clean it or keeps finding it, back up your documents and photos (not programs) and use Reset this PC in Settings, System, Recovery, or reinstall Windows.

5. 5

   Step 5: Get help when it matters

   On a work PC, tell your IT team before you touch anything. If money or card details were involved, call your bank.

RemoteAccessApp is remote access software for your own PCs and for helping people, built so a session is never hidden from the person at the PC:

• You install it yourself. From remoteaccessapp.com, and it only installs updates signed with RemoteAccessApp's key.
• You're asked first. Unless unattended access is on, the PC asks the person there to Allow each session and shows nothing until they do.
• Unattended access is switched on at the PC. Connecting without a click only works if it was turned on at that PC itself, never from somewhere else. Unattended access
• A banner for the whole session. It stays on the screen while anyone is connected and says when a command prompt is open. There's no hidden mode.
• Control stays at the PC. The person there can switch to view-only or quit at any time, and trusted consoles are listed on the PC, where removing one disconnects it at once.

More on what each person in a session can see is in remote desktop privacy: who can see what, and the details are on the security page.