How to tell if someone is controlling your PC
The real signs of a remote session, and the ones people worry about for nothing.
If the mouse is moving by itself right now, disconnect from the internet first and read this afterwards. Airplane mode, Wi-Fi off, or pull the cable. That ends a remote session straight away.
Signs that someone really is connected
A remote session is hard to hide completely, because the person on the other end is using your screen. These are the signs that actually mean something:
- The pointer moves, clicks or types while your hands are off the mouse and keyboard.
- Windows open and close on their own, or a program starts that you didn’t start.
- A remote-support window is on screen or in the taskbar: AnyDesk, TeamViewer, ScreenConnect, Quick Assist, RustDesk, UltraViewer and so on. Many show a small panel in a corner with a name or a number while someone is connected.
- The screen goes black, or shows a “please wait” message, while a caller says they’re working on it. Some of these tools can black out your screen so you can’t watch what’s happening. Genuine support rarely needs that.
- A caller describes what’s on your screen, or tells you exactly where to click before you’ve said anything.
Any one of these is reason enough to act. You don’t need all of them.
Things that usually don’t mean much
A lot of worry comes from things with ordinary explanations.
A slow computer is the classic one. Updates, a browser with forty tabs open, an old hard drive or a nearly full disk will all do it. Someone controlling your PC doesn’t usually slow it down in a way you’d notice.
A noisy fan or a busy disk light is normal too. So is a pop-up saying you’re infected, and that one needs a special mention. A warning that tells you to call a number isn’t a sign that anyone got in. It’s usually how the scam starts. Don’t call the number. Close the browser, using Task Manager if the page won’t let you.
How to check Windows for remote-access software
Keep the PC offline while you do this. It takes about five minutes.
Look next to the clock
Click the small ^ arrow at the bottom right of the taskbar. Remote-support programs often sit there while they run. Hover over anything you don’t recognize to see its name.
Check your installed apps
Open Start, then Settings, then Apps, then Installed apps. On Windows 10 it’s called Apps & features. Sort the list by install date. A remote-support tool installed on the same day as a strange call is exactly what you’re looking for.
Check what’s running, and what starts with Windows
Press Ctrl + Shift + Esc to open Task Manager. Look through the Processes tab for the same kind of names, then the Startup apps tab for anything new. Some tools install as a background service instead, so they keep running after you close their window. ScreenConnect works this way. In your installed apps it shows up as “ScreenConnect Client” followed by a code in brackets.
Names worth knowing: AnyDesk, TeamViewer, ScreenConnect (also sold as ConnectWise Control), UltraViewer, RustDesk, LogMeIn, Supremo, Zoho Assist and Splashtop. Quick Assist comes with Windows, so finding it doesn’t mean anything by itself.
Finding any of these isn’t proof of anything either. Your nephew may have put TeamViewer on years ago to help with the printer. What matters is whether you know who installed it, and why.
Check your accounts, not just the computer
If someone did get in, the computer was rarely what they were after. From a different device, look at:
- your bank and card accounts, for payments or new payees you don’t recognize
- your email, for sent messages you didn’t write, and forwarding rules or filters you didn’t set up
- recent sign-in activity, which Google, Microsoft and most banks will show you
If you find something
Uninstall the remote tool, run a full scan in Windows Security, and change your email and banking passwords from another device. If money or bank details were involved, call your bank on the number on your card. Our guide to what to do if someone remotely accessed your computer goes through it step by step.
Knowing for sure next time
Most people only work out that someone was connected afterwards. With Xcelcor Guardian on the PC, nobody connects quietly. Every new remote connection is held until the account holder approves it, and they get an email the moment one is asked for. If it’s a stranger, they refuse it, or just don’t answer, and the connection never opens.
Last updated