Remote access trojan (ScreenConnect, AnyDesk, RustDesk, UltraViewer) tech support scam: pulling ethernet, killing services, and bank freeze¶

When a scammer convinces you to install a remote desktop tool or executes a remote monitoring agent on your computer, they gain live, unrestricted control over your mouse, keyboard, file system, and active browser sessions. While displaying a fake security scan or a black privacy curtain on your monitor, the operator silently drains checking accounts, harvests saved passwords, and installs persistent background services that survive standard reboots. This guide provides immediate steps to sever the attacker's data link, permanently eradicate unattended remote access services, and lock down your banking and credit infrastructure before funds clear the wire network.

Aw bɛ nin kɛ sisan¶

1. I ka ɛntɛrinɛti ɲɔgɔndan bɛɛ tigɛ farikolo la ani o yɔrɔnin bɛɛ. I ka Etɛrinɛti kabɔri bɔ i ka tabali walima i ka routeur kɔfɛ, ka Wi-Fi switch farikoloma wuli i ka ɔridinatɛri kan, walima ka i ka Wi-Fi routeur ka kuran butɔni digi k’a minɛ fo segin 10 fo yeelen bɛɛ ka dibi. Aw kana waati tiɲɛ k’a ɲini ka nanbarakɛla kɛlɛ walasa ka sosɛti kurufe kɔlɔsi walasa ka butɔni tigɛcogo digi.
2. Force-shutdown the compromised computer if the screen is blacked out. If the attacker has enabled "Blank Guest Monitor" or locked your keyboard input, press and hold your computer's physical power button for 10 full seconds until the machine powers off completely. Leave it powered off while you secure your financial accounts from a separate, clean device.
3. Call your bank's fraud department from an independent phone. Use a cellular phone to call the official number printed on the back of your debit or credit card, or call your local emergency number (911 in the United States and Canada, 112 across the European Union, 999 in the United Kingdom) if an active extortion threat is occurring; see kɔrɔtɔko nimɔrɔw for international contacts. Instruct the bank to place an immediate hard freeze on all checking, savings, and line-of-credit accounts, and demand an emergency recall on any pending Automated Clearing House (ACH), wire, or real-time payment transfers.
4. Revoke active session cookies and change passwords from a clean smartphone. Using your phone on cellular data (not connected to your home Wi-Fi if the compromised PC is back on), log into your primary email, banking portals, and cloud storage accounts. Terminate all active login sessions, revoke unrecognized Multi-Factor Authentication (MFA) devices, and rotate your passwords.
5. Boot the infected computer into Safe Mode Without Networking. Only turn the compromised computer back on while disconnected from the internet, entering Windows Safe Mode or macOS Safe Mode to inspect and strip out unattended background services (ScreenConnect Client, . AnyDesk Service, . RustDesk Service) before the operating system loads third-party network drivers.

--- .

Understanding the anatomy of a commercial RMM and remote desktop attack¶

Modern technical support scams, refund frauds, and bank impersonation attacks rarely rely on custom-written computer viruses. Instead, threat actors abuse legitimate, digitally signed Remote Monitoring and Management (RMM) software and commercial remote desktop tools. Because these executables carry valid cryptographic code-signing certificates from trusted software vendors, standard antivirus programs like Windows Defender or macOS XProtect do not block their installation.

How attackers weaponize legitimate remote support binaries¶

When a victim calls a toll-free number displayed on a fake browser pop-up, replies to an urgent invoice email, or follows instructions from a fake bank fraud investigator, the operator directs them to download an executable or MSI installer. The most heavily abused platforms include:

• ConnectWise ScreenConnect (formerly Control): Often deployed via a customized .msi walima .exe package hosted on an attacker-controlled server. Once executed, it installs as a persistent Windows System Service (ScreenConnect Client (xxxx)) running with NT AUTHORITY\SYSTEM privileges, granting silent, unattended access whenever the computer is online.
• AnyDesk (anydesk.exe): Frequently used in cross-platform scams targeting Windows, macOS, and mobile devices. Attackers instruct the victim to read aloud the 9-digit AnyDesk address, request administrative elevation, and set an "Unattended Access Password" to reconnect while the victim sleeps.
• RustDesk (rustdesk.exe): An open-source remote desktop tool favored by scam syndicates because they can self-host relay servers, bypassing vendor abuse takedowns.
• UltraViewer, TeamViewer, Zoho Assist, and SimpleHelp: Commonly chained together. A scammer connecting via UltraViewer or AnyDesk will often silently install a hidden ScreenConnect walima SimpleHelp package in the background as a backup backdoor.

--- .

Emergency workflow: severing the connection and triaging damage¶

Use the following operational flowchart to stop an active remote session, isolate the workstation, and determine whether the machine can be cleaned in Safe Mode or requires a complete operating system wipe.

flowchart TD
    A["Active or Recent Remote Access Scam Detected"] --> B["Physically Unplug Ethernet Cable and Power Off Wi-Fi Router"]
    B --> C{"Is Screen Blacked Out or Mouse Locked?"}
    C -- "Ɔwɔ" --> D["Hold PC Physical Power Button for 10 Seconds to Force Off"]
    C -- "Ayi" --> E["Switch Airplane Mode ON and Shut Down PC Normally"]
    D --> F["Use Clean Smartphone on Cellular Data to Call Bank Fraud Dept"]
    E --> F
    F --> G["Freeze Checking/Savings, Recall Wires/Zelle, Lock Credit Bureaus"]
    G --> H["From Clean Smartphone: Rotate Email/Bank Passwords & Kill Sessions"]
    H --> I{"Did Scammer Have Unattended Access or Run CMD/PowerShell?"}
    I -- "Yes (High Risk)" --> J["Boot PC Offline into Safe Mode to Rescue Personal Docs Only"]
    I -- "No (Brief Supervised Session)" --> K["Boot Offline into Safe Mode to Purge RMM Services and Certs"]
    J --> L["Perform Full Clean OS Reinstall via USB Media From Clean PC"]
    K --> M["Remove Services, Scheduled Tasks, AppData, and Audit Browser Extensions"]

--- .

Comparison of remote access tools abused by scammers¶

Before attempting to clean a machine or report the incident to your bank's forensic fraud team, identify which remote tool(s) were installed. Remember that scammers routinely install two or three different tools during a single session so that if you uninstall the visible desktop icon, their hidden secondary service remains active.

--- .

Step-by-step banking and financial triage (First 30 minutes)¶

In a remote access scam, the computer infection is only the delivery mechanism; the primary emergency is acute financial theft. Attackers use psychological and technical tricks, such as editing the HTML source code (Inspect Element) of your bank's webpage to simulate an accidental $40,000 overpayment instead of $400, to trick you into wiring money, buying gift cards, or depositing cash into a Bitcoin ATM. Even if you refused to send money, an attacker with remote access can initiate transfers directly while your screen is blacked out.

1. Place an immediate hard freeze and initiate transfer recalls¶

Call your financial institution's dedicated fraud department immediately using a clean phone. State clearly: "My computer was compromised by a remote access trojan during a tech support/bank impersonation scam. An unauthorized party had live access to my online banking session." Demand the following specific actions:

• Online Banking Profile Lockout: Have the bank disable your online and mobile banking login credentials entirely and invalidate all active OAuth tokens and session cookies.
• ACH, Wire, and RTP Recall (SWIFT / . Fedwire / . Faster Payments): Ask the representative to inspect your account for any pending or queued outbound Automated Clearing House (ACH) transfers, domestic/international wire transfers, Zelle / . Venmo payments, or "Bill Pay" checks scheduled for future dates. Scammers often schedule a Bill Pay check or post-dated ACH transfer set to execute 3 to 5 days later hoping you will not notice.
• Account Number Substitution: Because the attacker likely viewed your full routing and checking account numbers (or downloaded PDF bank statements from your browser), freezing the debit card alone is insufficient. You must request that the bank close the compromised account numbers and transition your balances into brand-new account numbers with "Post No Debits" (PND) restrictions on the old accounts.
• Check for Hidden Internal Transfers or Cash Advances: Attackers frequently take a cash advance from your linked credit card or Home Equity Line of Credit (HELOC) and transfer it into your checking account first, either to make you believe they "accidentally over-refunded" you, or to pool maximum liquidity before wiring the combined balance offshore. Tell the bank fraud specialist to check if any intra-bank transfers occurred between your savings, credit card, or brokerage accounts.

2. Freeze credit bureaus and check for new loan applications¶

While connected to your PC, scammers routinely search your Downloads walima Documents folders for keywords like tax, . 1040, . W2, . passport, . license, walima password and exfiltrate your tax returns and ID scans.

1. Place a free Security Freeze at all major credit bureaus immediately using your clean smartphone:
2. In the United States: Freeze Equifax (1-888-298-0045), Experian (1-888-397-3742), TransUnion (1-800-916-8800), and ChexSystems (1-800-428-9687).
3. In the United Kingdom: Contact Experian, Equifax, and TransUnion, and register for Cifas Protective Registration.
4. In Canada: Place credit freezes or fraud alerts with Equifax Canada and TransUnion Canada.
5. In Australia: Request a credit ban through Equifax, Illion, and Experian.
6. Review your credit report immediately for hard inquiries made in the last 24 hours; scammers often apply for instant online personal loans in a background browser tab while talking to you.

--- .

Eradicating remote access services in Safe Mode (Windows and macOS)¶

If you decide to inspect the machine, preserve forensic logs for law enforcement, or rescue irreplaceable personal photos before wiping the hard drive, never boot the computer into normal mode while connected to the internet. The moment a normal boot completes with Wi-Fi active, a persistent ScreenConnect walima AnyDesk service will phone home to the scammer's console and alert them that your machine is back online.

Phase 1: Booting into Safe Mode Without Networking¶

Windows 10 ani Windows 11 kan¶

1. Make sure the Ethernet cable is unplugged and your home Wi-Fi router is unplugged or Airplane Mode is active.
2. Power on the PC. At the Windows sign-in screen, hold down the Left Shift key while clicking Power -> Restart.
3. On the blue recovery screen, select Troubleshoot -> Advanced options -> Startup Settings -> Restart.
4. When the startup options list appears, press 4 or F4 (Enable Safe Mode). Do not press 5 (Safe Mode with Networking).

On macOS (Apple Silicon and Intel)¶

1. Turn off the Mac and turn off your Wi-Fi router.
2. Apple Silicon (M1/ .M2/ .M3/ .M4): Hold the Power button until "Loading startup options" appears. Select your startup disk, hold Shift, and click Continue in Safe Mode.
3. Intel Mac: Turn on the Mac and immediately hold the Shift key until the login window appears.

--- .

Phase 2: Hunting and terminating persistent Windows Services¶

Standard uninstallation via "Add or Remove Programs" often fails to remove customized ScreenConnect MSI builds because attackers strip the uninstaller entry from the Windows Registry or deploy multiple instances under randomized hexadecimal service names.

1. In Windows Safe Mode, press Win + R, suguya services.msc, and press Enter.
2. Click the Name column to sort alphabetically, and carefully inspect every service for the following names:
3. ScreenConnect Client (xxxxxxxxxxxxxxxx) (Note: There may be two or three separate ScreenConnect Client entries with different 16-character alphanumeric strings in parentheses, where each represents a different scammer server).
4. AnyDesk Service
5. RustDesk Service
6. UltraViewerService
7. TeamViewer
8. Zoho Assist - Unattended Agent walima SimpleHelp Remote Access
9. For every suspicious service you find, right-click it and select Properties.
10. Read the Path to executable field carefully and write it down (for example, C:\Program Files (x86)\ScreenConnect Client (a1b2c3d4e5f6g7h8)\ScreenConnect.ClientService.exe).
11. Change the Startup type dropdown to Disabled, click Stop (if running), and click Apply and OK.
12. Next, open an elevated Command Prompt (Win + X -> Terminal (Admin) or Command Prompt (Admin)) and permanently delete the service registrations using the exact service name listed in the properties window:

sc stop "AnyDesk"
sc delete "AnyDesk"
sc stop "RustDesk"
sc delete "RustDesk"
sc stop "UltraViewerService"
sc delete "UltraViewerService"

For ScreenConnect, query all installed instances and delete each one by its exact service key name:

sc query state= all | findstr /I "ScreenConnect"
sc delete "ScreenConnect Client (a1b2c3d4e5f6g7h8)"

--- .

Phase 3: Purging Scheduled Tasks, Startup folders, and hidden directories¶

Even after a Windows Service is deleted, attackers often configure a scheduled task that re-downloads the remote agent via powershell.exe walima mshta.exe every time a user logs in.

1. A digi Win + R, suguya taskschd.msc, and press Enter to open Task Scheduler.
2. Click Task Scheduler Library in the left pane. Expand every subfolder and inspect the Actions tab of each scheduled task. Delete any task that launches binaries from C:\Users\<User>\AppData\, . C:\ProgramData\, or invokes curl, . bitsadmin, . powershell -WindowStyle Hidden, or any remote desktop executable.
3. A digi Win + R, suguya shell:startup, and press Enter. Delete any shortcuts or .bat / . .vbs scripts placed in your user Startup folder. Repeat this by typing shell:common startup to inspect the system-wide Startup folder.
4. Enable viewing hidden files in File Explorer (View -> Show -> Hidden items) and manually delete the application directories and configuration caches for all remote tools:
5. C:\Program Files (x86)\ScreenConnect Client (*)
6. C:\ProgramData\ScreenConnect Client (*)
7. C:\Program Files (x86)\AnyDesk\ ani C:\ProgramData\AnyDesk\
8. C:\Users\<YourUsername>\AppData\Roaming\AnyDesk\
9. C:\Program Files\RustDesk\ ani C:\Users\<YourUsername>\AppData\Roaming\RustDesk\
10. C:\Program Files (x86)\UltraViewer\ ani C:\Users\<YourUsername>\AppData\Roaming\UltraViewer\

--- .

Phase 4: Removing macOS LaunchDaemons, LaunchAgents, and Privacy Grants¶

On macOS, remote access tools establish persistence through LaunchDaemons (system-wide) and LaunchAgents (user-level), combined with macOS TCC (Transparency, Consent, and Control) permissions for Screen Recording and Accessibility.

1. While in macOS Safe Mode (offline), open Finder, press Cmd + Shift + G (Go to Folder), and inspect the following three directories one by one:
2. /Library/LaunchDaemons/
3. /Library/LaunchAgents/
4. /Users/<YourUsername>/Library/LaunchAgents/
5. Drag any .plist files containing connectwise, . screenconnect, . anydesk, . rustdesk, . teamviewer, . zoho, walima simplehelp to the Trash.
6. Next, open /Applications/ ani /Library/Application Support/ and move any corresponding remote access app bundles and support folders to the Trash.
7. Open System Settings -> Privacy & Security. Check two critical sections:
8. Screen & System Audio Recording: Select any remote support tool listed and click the minus (-) button to revoke its ability to view your display.
9. Accessibility: Select any remote support tool and click the minus (-) button to revoke its ability to control your mouse cursor and synthesize keystrokes.
10. Full Disk Access: Verify that no unknown application or terminal wrapper has been granted Full Disk Access.

--- .

Reversing Windows password locks and fake boot banners¶

Before disconnecting, vindictive scammers frequently lock victims out of their computers and demand a ransom for the password. They use three primary methods:

1. Changing your local Windows password (net user) or adding a rogue admin account¶

While their screen curtain is active, scammers often open an elevated Command Prompt and run net user <YourUsername> <NewPassword> or create a backdoor administrator account (net user SupportAdmin Pass123 /add && net localgroup administrators SupportAdmin /add). * How to check and fix: In Safe Mode, open an elevated Command Prompt (cmd.exe as Administrator) and type net user. If you see an unfamiliar account, delete it immediately with net user <RogueAccountName> /delete. If your local password was changed, boot from a Windows Installation USB into the Windows Recovery Environment (WinRE) to restore a prior System Restore Point, or sign in with your linked Microsoft Account after resetting your password on a clean smartphone.

2. Enabling a startup message banner via Registry (LegalNoticeCaption) .¶

Scammers often modify HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System by setting LegalNoticeCaption ani LegalNoticeText to display a fake Microsoft Security lockout phone number before login. * How to fix: This is purely a cosmetic text screen before the normal Windows login prompt. Click OK or press Enter to bypass it, open regedit in Safe Mode, go to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System, and clear the text inside LegalNoticeCaption ani LegalNoticeText.

3. Safe Boot PIN lockouts (bcdedit) .¶

Microsoft removed the legacy syskey.exe tool in Windows 10 version 1709. Today, scammers instead tick Safe boot inside msconfig and reboot your PC offline. Because Windows Hello PINs often fail on the Safe Mode login screen without network access, victims get trapped in a boot loop. * How to fix: Hold Shift + Restart at the login screen, select Troubleshoot -> Advanced options -> Command Prompt, and run:

bcdedit /deletevalue {current} safeboot

Restart the computer normally (keeping your internet router unplugged) so you can log in with your cached password or PIN and remove the remote software.

--- .

Why browser session theft and infostealers require a full OS wipe¶

Even if you delete the ScreenConnect, . AnyDesk, walima RustDesk services in Safe Mode, you must evaluate whether the scammer deployed a secondary Infostealer (Lumma, . RedLine, . Vidar, . Stealc) or copied your browser profile directory.

During an unattended remote session, it takes less than 8 seconds for an attacker to run a PowerShell script that copies your Google Chrome, Microsoft Edge, or Brave user data directory (C:\Users\<User>\AppData\Local\Google\Chrome\User Data\Default\) along with the local DPAPI master decryption key. With those files on their server, the attacker possesses:

1. Every password saved in your web browser's built-in password manager.
2. Active session cookies (Cookies ani Network\Cookies SQLite databases): Even if your email or bank uses two-factor authentication (2FA), possessing your decrypted session token cookie allows the attacker to import your browser profile into an antidetect browser on their machine and access your Gmail, Outlook, Amazon, or cryptocurrency exchange account without needing a password or 2FA code.
3. Browser-based cryptocurrency wallet vaults (MetaMask, . Phantom, . Rabby): Encrypted vault files inside Local Extension Settings are exfiltrated for offline brute-forcing.

When you must perform a clean USB operating system reinstall¶

While Safe Mode service removal is sufficient if you caught the scammer within 10 seconds of installing AnyDesk and never gave them Administrator elevation or unattended access, you must wipe the drive and perform a clean OS installation from a USB stick if any of the following occurred:

• Your screen went black (Blank Guest Monitor) or your mouse/keyboard was locked.
• You saw a Command Prompt (cmd.exe) or PowerShell window flash on the screen.
• You left the computer unattended while the scammer ran a fake security scan.
• You installed ConnectWise ScreenConnect (which runs as SYSTEM by default and allows invisible background shell script execution).

To perform a safe reinstall: 1. While offline in Safe Mode, plug a brand-new USB flash drive into the compromised PC and copy only personal data files (.jpg, . .pdf, . .docx, . .xlsx, family videos). Never copy .exe, . .msi, . .bat, . .ps1, or browser profile folders. 2. Using a different, clean computer, download the official Windows Media Creation Tool from Microsoft (microsoft.com/software-download) or create a bootable macOS installer. 3. Boot the compromised PC from the clean USB installer, delete all existing partitions on the primary drive (Drive 0), and install a fresh copy of the operating system.

--- .

Preserving your legal right to bank reimbursement¶

Banks frequently attempt to deny fraud reimbursement claims in remote access scams by arguing that because you clicked "Download" on AnyDesk or ScreenConnect, you "authorized" the transactions or acted with gross negligence. Knowing how statutory consumer banking protections work in your jurisdiction is critical when speaking to your bank's fraud claim adjudicator.

In the United States: Electronic Fund Transfer Act (EFTA) ani Regulation E (12 CFR § 1005) .¶

Under the federal Electronic Fund Transfer Act (Regulation E), the Consumer Financial Protection Bureau (CFPB) has issued official supervisory guidance stating that: * Induced access is still an "Unauthorized Electronic Fund Transfer": Under 12 CFR § 1005.2(m), an electronic fund transfer initiated by a person who obtained access to a consumer's account through fraud or robbery is defined by law as an unauthorized EFT, even if the consumer was tricked into providing a password, a one-time passcode, or installing remote desktop software. * Negligence cannot be used to deny your claim: The CFPB's Official Interpretation of Regulation E (Comment 6(b)-2) states that consumer negligence (such as falling for a phishing pop-up or granting remote desktop access to a scammer) cannot be used by a bank to impose greater liability on the consumer than Regulation E allows ($50 maximum if reported within 2 business days; $500 maximum within 60 days). * Distinguish between Scammer-Clicked vs. Consumer-Clicked transfers: If the scammer moved the mouse and clicked "Send" behind a black screen during the AnyDesk/ScreenConnect session, it is an Unauthorized EFT covered by Regulation E. Tell the bank in writing: "I did not initiate, authorize, or click the button for this transfer; a criminal threat actor executed the transfer remotely using a Remote Access Trojan while locking my screen, which constitutes an unauthorized EFT under 12 CFR § 1005.2(m)." Attach your preserved connection_trace.txt log or Windows Event Viewer Service Control Manager logs (Event ID 7045 showing the exact minute the ScreenConnect walima AnyDesk service was installed) as forensic proof.

In the United Kingdom, European Union, Canada, and Australia¶

• Royaume-Uni (PSR & . FOS): If the scammer controlled your computer directly to move funds, report it as an Unauthorized Payment under the Payment Services Regulations 2017. If the scammer manipulated your screen (Inspect Element fake refund) to trick you into authorizing a Faster Payment yourself, report it under the Payment Services Regulator's (PSR) mandatory Authorized Push Payment (APP) Fraud reimbursement rules and escalate any denial to the Financial Ombudsman Service (FOS).
• European Union, Canada, and Australia: Report the incident immediately to your bank and national police, emphasizing that a remote access trojan executed or manipulated the session. Escalate unresolved bank disputes to the Ombudsman for Banking Services and Investments (OBSI) in Canada or the Australian Financial Complaints Authority (AFCA) in Australia under the ePayments Code.

--- .

Post-incident remediation and reporting checklist¶

Complete every item in this checklist before reconnecting your home network or resuming normal online banking:

• Physical isolation confirmed: Compromised computer was physically disconnected from Ethernet and Wi-Fi before any further troubleshooting.
• Bank accounts frozen and re-numbered: All checking, savings, and HELOC account numbers that were visible on the computer have been closed and re-issued with new account numbers.
• Scheduled Bill Pay and ACH queues purged: Verified with a bank supervisor that no future-dated Bill Pay checks, external bank links (Plaid), or standing wire instructions were added during the remote session.
• Credit freezes active: Security freezes placed with Equifax, Experian, TransUnion, and ChexSystems.
• Email forwarding rules audited: Logged into Gmail/Outlook/Yahoo from a clean smartphone and checked Settings -> Forwarding and POP/IMAP and Rules / Filters for hidden rules that auto-delete or forward emails containing "Bank", . "Fraud", . "Wire", walima "Security Alert".
• Browser password vault rotated: Every password stored inside Chrome, Edge, Firefox, or Safari password managers has been changed from a clean device.
• Forensic logs saved and official reports filed: File reports with the FBI IC3 (ic3.gov) and FTC (reportfraud.ftc.gov) in the US, Action Fraud (actionfraud.police.uk) in the UK, the Canadian Anti-Fraud Centre, or Scamwatch (scamwatch.gov.au) in Australia. Also report the installer binary or connection ID to connectwise.com/company/trust/report-abuse walima anydesk.com/en/abuse.

--- .

Ɲininkali minnu bɛ kɛ tuma caman na¶

The scammer showed me my Windows Event Viewer and netstat in Command Prompt kɔnɔ ani a tun falen bɛ lasɔmini ba caman na, filiw, ani "FOREIGN ADDRESS" ɲɔgɔndanw na. Yala ne ka ɔridinatɛri tiɲɛna tiɲɛ na sanni ne ka u wele wa?¶

Ayi, u fila bɛɛ `eventvwr` (Windows ka ko kɛlenw lajɛbaga) ani `netstat` ye marako nafamafɛnw ye minnu bɛ don Windows kopi kelen-kelen bɛɛ kɔnɔ, wa nanbarakɛlaw bɛ u tiɲɛ i n’a fɔ hakili ta fan fɛ fɛnw. Windows ɔridinatɛri kɛnɛman bɛɛ bɛ Ladilikan jɛman ni fili bilenman ba caman dilan minnu bɛ kɛ tuma bɛɛ Event Viewer kɔnɔ, a daminɛcogo nɔgɔmanw ni kɔkankow ladamuni waatiw la, ani `netstat` a bɛ kɔkanna jɛɲɔgɔnya nɔrɔlen bɛɛ lajɛlen i ka navigatɔrɔ ni baarakɛminɛnw kɛ sankaba sèrwɛriw la i n'a fɔ "Foreign Address." I ka ɔridinatɛri tun lakananen don pewu fo waati min na i ye welebaga ka cikanw labato walasa k’u ka yɔrɔjan sɔrɔminɛn telesarse ani k’a baara.

Cogo di nanbarakɛla ye n ka banki siti lakika kɛ k’a jira k’u ye wari bila bala la $40,000 ka don n ka jatebɔsɛbɛn kɔnɔ ni u tɛ se ka banki ka sèrwɛri hakɛ tiɲɛ?¶

Ni i bɛ i ka ɔridinatɛri kɔnɔ AnyDesk walima ScreenConnect fɛ, nanbarakɛla bɛ i ka ekran dibi segin 15 kɔnɔ, ka i ka banki balansi digi kinin fɛ i ka ɛntɛrinɛti yɔrɔ la, ka **"Inspect" digi (`Developer Tools`)**. O bɛ sigida HTML sɛbɛnni da wuli min bɛ jira i ka navigatɛri tab kɔnɔ. Namarakɛla bɛ sɛbɛnni kɛ dɔrɔn `$45,200.00` ka tɛmɛ i ka tiɲɛ kan `$5,200.00` balansi ani ka sɛbɛnni layini kalanni nkalonma dɔ fara a kan `"ACH REFUND OVERPAYMENT +$40,000.00"` i ka ekran kan. Nin sɛgɛsɛgɛli in bɛ kɛ i ka navigatɛri tab ka waati dɔɔnin hakilijagabɔlan kɔnɔ dɔrɔn (`DOM`) ani a bɛ tunun yɔrɔnin kelen i ye ɲɛ kura (`F5`) walima k’i ka balansi lajɛ i ka smartfon app kan. Ni o tɛ, u bɛ fɛn wɛrɛ bila yɔrɔ wɛrɛ la `$40,000` ka bɔ i yɛrɛ ka warimarayɔrɔ la walima i ka warimarayɔrɔ la ka don i ka jatebɔsɛbɛn kɔnɔ ani ka ekran tɔgɔ sɛbɛn kokura walasa k’i lafili k’i yɛrɛ ka wari ci u ma.

Ni ne ye AnyDesk walima UltraViewer bɔ Panneau de contrôle la, yala ne bɛ se ka n ka Wi-Fi daminɛ kokura wa?¶

A ka c’a la, a tɛ kɛ ni Windows Services (`services.msc`) ka Safe Mode kɔnɔ fɔlɔ. Professional tech support scam call centers b’a dɔn ko mɔgɔ minnu tɔɔrɔla, olu ka teli ka AnyDesk walima UltraViewer bɔ a kɔnɔ ni u ye telefɔni dabila dɔrɔn. O la sa, miniti fila fɔlɔ kɔnɔ, i kɛlen kɔ ka don i ka ɔridinatɛri la, nanbarakɛlaw bɛ to ka baara kɛ ni dosiyew cili ye makunlen ye walasa ka **ConnectWise ScreenConnect** filanan, dogolen dɔ fili (`ScreenConnect.ClientService.exe`) walima **SimpleHelp** ciden min tɛ tabali sira surun dɔ da ani min bɛ dogo a kɔnɔ `C:\Program Files (x86)\ScreenConnect Client (xxxx)`. Fo n'i y'a Sɛgɛsɛgɛ Safe Mode la ko no rogue `SYSTEM` baarakɛminɛnw walima baara bolodalenw bɛ yen, walima ka USB OS wipe dafalen kɛ, ka segin ka don Wi-Fi la, o bɛ se ka i ka ɔridinatɛri kunkanko bolo di o yɔrɔnin bɛɛ ka segin binkannikɛla ma.

Yala nanbarakɛla bɛ se ka se ka ɔridinatɛri walima telefɔni seleke naani wɛrɛw sɔrɔ ne ka so Wi-Fi réseau kɔnɔ dɔrɔn bawo ne ye AnyDesk sigi ɔridinatɛri kelen kan wa?¶

AnyDesk walima ScreenConnect sigili bɛ ɔridinatɛri kɛrɛnkɛrɛnnen tiɲɛ i ye installer baara yɔrɔ min na, i tɛ i ka telefɔniw walima ɔridinatɛri wɛrɛw bila k’a ɲɛsin i yɛrɛ ma. Nka, n’i bɛ baara kɛ ni **Google Chrome, Microsoft Edge, walima Apple iCloud tɔgɔlasɛbɛn ni session syncing** ye i ka ɔridinatɛri ni i ka telefɔni seleke naani kɔnɔ, nanbarakɛla bɛ tɔgɔlasɛbɛn minnu sonya walima k’u Changer ɔridinatɛri bananen kan, o bɛna nɔ bila i ka sankaba jatew tilalenw na. Ani fana, k’a sɔrɔ i bɛ i ka ɔridinatɛri kɔnɔ, binkannikɛla bɛ se ka don i ka so routeur ka admin page kɔnɔ (`192.168.1.1`) ni a bɛ baara kɛ hali bi ni admin tɔgɔlasɛbɛn ye ani k'i ka routeur ta caman Changer `DNS` settings. After isolating the infected laptop, factory-reset your Wi-Fi router or verify its DNS settings and admin password from a clean device.

--- .

Gafe minnu bɛ tali kɛ o ko la¶

• Tech dɛmɛni pop-up nanbara ani yɔrɔjan tabali AnyDesk/TeamViewer bɔli
• Session cookie hijacking, infostealer malware, and passkey revocation
• CAPTCHA nkalonma ClickFix PowerShell Win+R klipbɔri porogaramu jugu ani Lumma Infostealer ɲɛnabɔli
• Authorized push payment (APP) app fraud: Zelle, Venmo, and Faster Payments impersonation and reimbursement rights
• Bank account breach
• Kɔrɔtɔko nimɔrɔw ka kɛɲɛ ni jamana ye

--- .

Sosow ani ɲɛmɔgɔyaso ka bilasiralikan¶

• Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), National Security Agency (NSA), & Multi-State Information Sharing and Analysis Center (MS-ISAC) (United States): Joint Cybersecurity Advisory (AA23-025A): Protecting Against Malicious Use of Remote Monitoring and Management (RMM) Software.
• Baarakɛlaw ka nafolo lakanani biro (CFPB) (United States): Electronic Fund Transfers (Regulation E, . 12 CFR Part 1005) Official Interpretations and FAQs on Unauthorized EFTs and Fraudulently Induced Access.
• Federal Trade Commission (FTC) (United States): How To Spot, Avoid, and Report Tech Support Scams.
• Jamana ka Sibɛri Lakanali yɔrɔ (NCSC) & Action Fraud (United Kingdom): Protecting Devices from Unauthorised Remote Access Tools and Screen-Sharing Fraud.
• ConnectWise Trust & Security Response Center: Identifying and Removing Rogue ScreenConnect (ConnectWise Control) Client Instances (Kiliyanw ka misaliw*.