[RAT](https://en.wikipedia.org/wiki/Remote_administration_software) (Remote Access Tool, e.g. [Sub7](https://en.wikipedia.org/wiki/Sub7)) are considered malicious by Antivirus software. How can it distinguish between such patches and a client application for commercial software like [NetSupport School](http://www.netsupportschool.com/)?!