20 minutes ago, it appeared that someone had illegal remote access.

Question

Two weeks ago a Microsoft CSR had remote access RE laptop sound defect--not fixed after 1 hour. I had been restarting my device in order to hear/listen to videos, webinars, etc.

I just accessed RAT/Remote Access Toggle and there was nothing connected, along with a Red Message in settings that Microsoft Windows 11 does not support RAT (see attached).

I have two VPNs and one went crazy to connect.

What is my next step to protect my pc and my information. This appears to be more than Key Stroke Logger.

Thanks for your immediate help to move forward into deeper protections.

Answer 1

Hi! Let me help you.

Since the remote access settings showed no active connection, the next step is to double-check if anything unusual was installed on your computer. You can review your installed apps and sort them by installation date to see if any unfamiliar programs appeared around the time the issue started. If you find something you don’t recognize, it’s best to look it up or uninstall it.

You should also check the security history in Microsoft Defender Antivirus to see if anything was recently detected or blocked. Another helpful place to check is the system logs in Windows 11 through Event Viewer, which may show unusual login or remote session activity.

Since a Microsoft support agent previously accessed your device, you can also open Windows Quick Assist to confirm that no session is active. These support sessions usually end once the code expires and cannot be reconnected automatically.

And, because you mentioned having two VPNs, try running only one at a time. Multiple VPNs can sometimes conflict with each other and cause strange connection behavior. For extra peace of mind, you may also run a second scan using Malwarebytes to check for anything suspicious.

Answer 2

Take the following steps to protect the PC and data after suspected unauthorized remote access:

1. Disconnect and close everything suspicious

• Disconnect from the internet (turn off Wi‑Fi or unplug Ethernet) if any suspicious remote session or VPN behavior is still active.
• Close the browser or app that showed any unexpected remote-control prompt or pop‑up.

2. Remove anything a scammer or untrusted party may have installed

• Uninstall any remote-access tools, screen‑sharing apps, or other software that were installed at the request of a support person or that are not clearly recognized.
• For detailed steps, see the guidance to Repair or remove programs in Windows.

3. Consider resetting the device if access was granted If an untrusted person had control of the device (mouse moving on its own, they could open files, etc.), the safest option can be to reset Windows:

• Follow the steps in Recovery options in Windows.
• A reset is more time‑consuming but is recommended if fake error messages or suspicious behavior keep appearing or if it is unclear what was changed.

4. Run a full malware scan

• Open Windows Security (Microsoft Defender Antivirus is built in and on by default in Windows 11).
• Run a full scan or advanced scan to check for malware or unwanted remote‑access tools. See stay protected with the Windows Security app for how to run an advanced scan.

5. Apply all security updates

• Go to Settings > Update & Security > Windows Update and install all available updates. Keeping Windows and other software current is one of the main protections against attacks. See Update Windows.

6. Change important passwords Because keystrokes or credentials may have been captured:

• Change the Microsoft account password and any other important passwords (email, banking, social media). Use strong, unique passwords. See change your Microsoft account password.

7. Be alert for tech support scams

• Microsoft will not call unexpectedly to report a problem with the computer or ask to install remote‑access tools unless a support request was initiated.
• If pop‑ups or callers claim to be “Windows support” and demand remote access or payment, close the browser or hang up. See Protect yourself from tech support scams.

8. Use built‑in protections going forward

• Keep Microsoft Defender Antivirus on and updated.
• Keep Windows 11 updated using Windows Update.
• Avoid opening suspicious attachments or links and avoid untrusted downloads or pirated content.
• Use a modern browser such as Microsoft Edge and consider an ad blocker to reduce malicious pop‑ups.

If any unauthorized charges were made while the device was compromised, contact the card provider to contest the charges and request replacement cards.

---

References:

• Stay protected on Windows 11 with smart security features
• Keep your computer secure at home
• What's new in Windows Security
• Protect yourself from tech support scams