How to detect RAT (Remote Administration Tool) on your PC
---------------------------------------------------------

First close all browsers, messengers and anything else that may legitimately require internet access

Start -> Run -> type CMD -> press Enter key (this opens command prompt screen)

Now type in NETSTAT -ANO (then press enter Key)

This brings up a list of TCP ports - if they are not active they will be flagged as "LISTENING"

if any of them are flagged as "ESTABLISHED" that means they are active

to the right of "ESTABLISHED" there will be a PID number - make a note of that number

You need to check what it is - so close the Command prompt screen

Open Task Manager by pressing 3 keys at once:- Ctrl + Shift+ Esc


NB --- if you  have windows 7, please see Win 7 section at bottom of page
-------------------------------------------------------------------------


If you have Win 10 click on "Details" tab to show column of PID numbers (it helps to sort entries by PID)

Look for the number that you noted earlier - the name of that process is to the left of that number

If you do not recognise it, open a browser and Google that name - if it's legit leave it alone

If it's described as virus or malware or similar, then "End Process"

Dicky found the following on his PC

PID 1564 = avast! Service (antivirus)
PID 3316 = Windows Explorer
PID 1008 = Svchost.exe (Host Process for windows Services)

------------------------------------

WINDOWS 7 
----------

in Task Manager, you should be on "Processes" tab

Click on "View" (just above Processes tab)

Click "Select Columns" and tick the box next to PID, then click "OK"

Now select "Services" tab, and sort entries by PID number if you wish

Look for the number that you noted earlier - the name of that process is to the left of that number

If you do not recognise it, open a browser and Google that name - if it's legit leave it alone

If it's described as virus or malware or similar, then "End Process"

--- end of help file ---