A remote access trojan (RAT), sometimes called a remote administration tool, is malware that gives an attacker remote control of a computer. This article shows one manual way to look for a RAT on Windows.

Antivirus software detects many RATs, but not all of them. If you suspect a RAT that your antivirus has not found, you can check manually by looking for unknown programs with open network connections.

Find suspicious network connections

1. Click the Start menu.
2. Search for cmd and open the Command Prompt.
3. Type netstat -ano and press Enter.
   
4. The output lists network connections. Look at those with the state ESTABLISHED: these are active connections. Look for any connection that stands out from the others, such as an unfamiliar remote address or port.
   
5. Note the process ID (PID) in the last column. In this example, the PID is 8412.
   

Identify the process

6. Press Ctrl+Shift+Esc to open Task Manager.
   
7. Click Processes.
   
8. Open Select Columns.
   
9. Tick PID.
   
10. Task Manager now shows the PID of every process.
    
11. Find the PID you noted (8412 in this example) and check which program it belongs to. Search for the program name if you do not recognise it.
    
12. If you are confident the process is not legitimate, end it: right-click, choose End Process, and confirm.
    
13. The process is now closed.
    

Stop it starting again

14. Open the Start menu.
    
15. Search for msconfig.exe and open it.
    
16. Check the startup entries for any unknown program.
    
17. If you find one, clear its check box, click Apply, then OK.
    

On Windows 10 and 11, startup programs are managed on the Startup tab of Task Manager instead of in msconfig.

Important

• Ending a process does not remove the malware. After these steps, run a full scan with up-to-date anti-malware software.
• Change your passwords from a different, clean device.
• If the computer holds sensitive data, consider reinstalling the operating system.
• Do not end processes you cannot identify without checking first; many legitimate Windows services have network connections.

Frequently asked questions

What is a RAT?

A remote access trojan is malware that gives an attacker remote control of a computer, often without the user noticing.

What should I do if I find one?

Disconnect the machine from the network, run a trusted anti-malware scan, change passwords from a clean device, and consider reinstalling the system.

Related: Preventing information disclosure: .git, .env, backups and source maps · Login and password security best practices