There’s a remote-access program on this computer and nobody remembers installing it.
Remote-access programs are ordinary. A former IT person, a software vendor, or someone working from home left it behind, and mostly that is what it turns out to be. What changes the answer is whether anyone can say who set it up, when, and who holds the sign-in for it.
Your antivirus won’t settle that. CISA writes that “the use of RMM software generally does not trigger antivirus or antimalware defenses,” because it is the same software IT providers use every day.
Who normally leaves one behind
The last one is the case CISA, the NSA, and MS-ISAC documented in a 2023 advisory. Help-desk-themed phishing led people to download a legitimate remote tool, and the actors then ran a refund scam by altering the victim’s bank account summary to look like an overpayment.
- A previous IT provider or contractor who supported the computer.
- A software or equipment vendor that connected to fix a problem.
- A staff member who set it up to reach the office computer from home.
- A person who called or emailed about a refund, a subscription, or a computer problem and asked you to open something.
Where to look on the computer
- Open Settings, then Apps, and read the installed list for a remote-support or remote-desktop program. Sort by install date if the list offers it.
- In Settings, Apps, Startup, read what starts at sign-in. Task Manager’s Startup apps tab shows the same list with a startup impact rating.
- Open Task Manager (right-click Start) and read the Processes tab, including the background processes, for a remote-support program that is running now.
- Look at the taskbar tray for an icon you don’t recognize.
A program that isn’t on the list can still be running
CISA describes actors running these tools as portable executables: self-contained files that start in the user’s own session without installation. They need no administrator rights, and they can run where installation is audited or blocked. So an empty installed-apps list does not clear the computer. The processes list and the startup list matter as much.
Windows also includes Quick Assist, a remote-help feature. Microsoft’s guidance is to allow a helper to connect only if you started the contact. A session ends when either person selects Leave, and the one receiving help can end it at any time.
What a normal one looks like
A remote-support program that belongs there has a name someone can match to a person. Your current IT provider can tell you which tools it uses. A former provider can say whether theirs is still connected. A vendor can confirm whether theirs was meant to stay.
A program no one can attach to a person, a date, or a reason is the one to identify before anything else is done to it. CISA also advises limiting authorized remote access to approved paths and using application controls to block unauthorized remote tools from running. That is a decision for after the program is identified.
Write it down, then decide
Keep the program on the machine until it is identified. Removing it also removes the record of when it was added and what it connected to.
- Record the program’s name, publisher, and install date if shown. Photograph the screen.
- Ask each person who has supported this computer, including your current IT provider, which remote tools they use. CISA’s first recommendation is to audit remote access tools to identify which are authorized.
- Write down who contacted you before the program appeared and what they asked you to open or sign in to.
- If you signed in to a bank while someone else was connected, call the bank’s fraud line the same day.
What we check with you
The installed programs, what starts at sign-in, and what is running. Then the account the tool connects to, because the person who holds that sign-in is the person who can connect. We compare all of it with the list of tools you expect, and a person writes up what matched and what didn’t, with dates.
A remote-access program is a door, and the first thing to settle is who holds the key.
Related
Sources
Get answers about the computer you’re worried about.
The Reveal Scan shows every problem it finds, with no charge and no credit card needed. Step-by-step instructions for fixing them are in the detailed report, which is paid, and you’ll see its price before you buy. It reads one Windows computer at a time and can’t see a mailbox.
Rather talk to a person?
Call (•••) •••-••••
Kristina or Anne will answer. Available during US Eastern time.
Or ask for a call back. Tell us which computer or mailbox, and what you noticed.
Request a call back
Written by Craig Peterson, 35+ years successfully running IT and security for businesses. Last reviewed October 27, 2026.