Remote access trojan (ScreenConnect, AnyDesk, RustDesk, UltraViewer) tech support scam: pulling ethernet, killing services, and bank freeze¶

When a scammer convinces you to install a remote desktop tool or executes a remote monitoring agent on your computer, they gain live, unrestricted control over your mouse, keyboard, file system, and active browser sessions. While displaying a fake security scan or a black privacy curtain on your monitor, the operator silently drains checking accounts, harvests saved passwords, and installs persistent background services that survive standard reboots. This guide provides immediate steps to sever the attacker's data link, permanently eradicate unattended remote access services, and lock down your banking and credit infrastructure before funds clear the wire network.

Fai isto agora¶

1. Corta toda a conectividade a Internet de forma física e inmediata. Desenchufa o cable Ethernet da parte traseira do teu escritorio ou enrutador, xira o interruptor físico de wifi do teu portátil ou manteña premido o botón de acendido do enrutador wifi durante 10 segundos ata que todas as luces se escurezan. Non perdas o tempo intentando loitar contra o estafador polo control do cursor do rato para facer clic no botón de desconexión.
2. Forzar o apagado do ordenador comprometido se a pantalla está apagada. Se o atacante activou o "Monitor invitado en branco" ou bloqueou a entrada do teu teclado, mantén premido o botón de acendido físico do teu ordenador durante 10 segundos completos ata que a máquina se apague por completo. Déixao apagado mentres protexes as túas contas financeiras desde un dispositivo separado e limpo.
3. Chame ao departamento de fraude do teu banco desde un teléfono independente. Usa un teléfono móbil para chamar ao número oficial impreso no reverso da túa tarxeta de débito ou crédito, ou chama ao teu número de emerxencia local (911 nos Estados Unidos e Canadá, 112 en toda a Unión Europea, 999 no Reino Unido) se se está a producir unha ameaza de extorsión activa; ver números de emerxencia para contactos internacionais. Indíquelle ao banco que conxele de forma inmediata todas as contas correntes, de aforro e de liña de crédito, e solicite unha retirada de emerxencia de todas as transferencias de pago en tempo real, por cable ou en tempo real da Cámara de compensación automatizada (ACH).
4. Revoga as cookies de sesión activas e cambia os contrasinais dun teléfono intelixente limpo. Usando o teu teléfono en datos móbiles (non conectado á wifi da túa casa se o PC comprometido está de novo acendido), inicia sesión no teu correo electrónico principal, portais bancarios e contas de almacenamento na nube. Finaliza todas as sesións de inicio de sesión activas, revoga os dispositivos de autenticación multifactor (MFA) non recoñecidos e rota os teus contrasinais.
5. Inicia o ordenador infectado en modo seguro sen conexión en rede. Só volve aencender o ordenador comprometido mentres estea desconectado de Internet, entrando no modo seguro de Windows ou o modo seguro de macOS para inspeccionar e eliminar os servizos en segundo plano desatendidos (ScreenConnect Client, AnyDesk Service, RustDesk Service) antes de que o sistema operativo cargue controladores de rede de terceiros.

Comprender a anatomía dun RMM comercial e un ataque de escritorio remoto¶

Modern technical support scams, refund frauds, and bank impersonation attacks rarely rely on custom-written computer viruses. Instead, threat actors abuse legitimate, digitally signed Remote Monitoring and Management (RMM) software and commercial remote desktop tools. Because these executables carry valid cryptographic code-signing certificates from trusted software vendors, standard antivirus programs like Windows Defender or macOS XProtect do not block their installation.

How attackers weaponize legitimate remote support binaries¶

When a victim calls a toll-free number displayed on a fake browser pop-up, replies to an urgent invoice email, or follows instructions from a fake bank fraud investigator, the operator directs them to download an executable or MSI installer. The most heavily abused platforms include:

• ConnectWise ScreenConnect (formerly Control): Often deployed via a customized .msi ou .exe package hosted on an attacker-controlled server. Once executed, it installs as a persistent Windows System Service (ScreenConnect Client (xxxx)) running with NT AUTHORITY\SYSTEM privileges, granting silent, unattended access whenever the computer is online.
• AnyDesk (anydesk.exe): Frequently used in cross-platform scams targeting Windows, macOS, and mobile devices. Attackers instruct the victim to read aloud the 9-digit AnyDesk address, request administrative elevation, and set an "Unattended Access Password" to reconnect while the victim sleeps.
• RustDesk (rustdesk.exe): An open-source remote desktop tool favored by scam syndicates because they can self-host relay servers, bypassing vendor abuse takedowns.
• UltraViewer, TeamViewer, Zoho Assist, and SimpleHelp: Commonly chained together. A scammer connecting via UltraViewer or AnyDesk will often silently install a hidden ScreenConnect ou SimpleHelp package in the background as a backup backdoor.

Emergency workflow: severing the connection and triaging damage¶

Use the following operational flowchart to stop an active remote session, isolate the workstation, and determine whether the machine can be cleaned in Safe Mode or requires a complete operating system wipe.

flowchart TD
    A["Active or Recent Remote Access Scam Detected"] --> B["Physically Unplug Ethernet Cable and Power Off Wi-Fi Router"]
    B --> C{"Is Screen Blacked Out or Mouse Locked?"}
    C -- "Si" --> D["Hold PC Physical Power Button for 10 Seconds to Force Off"]
    C -- "Non" --> E["Switch Airplane Mode ON and Shut Down PC Normally"]
    D --> F["Use Clean Smartphone on Cellular Data to Call Bank Fraud Dept"]
    E --> F
    F --> G["Freeze Checking/Savings, Recall Wires/Zelle, Lock Credit Bureaus"]
    G --> H["From Clean Smartphone: Rotate Email/Bank Passwords & Kill Sessions"]
    H --> I{"Did Scammer Have Unattended Access or Run CMD/PowerShell?"}
    I -- "Yes (High Risk)" --> J["Boot PC Offline into Safe Mode to Rescue Personal Docs Only"]
    I -- "No (Brief Supervised Session)" --> K["Boot Offline into Safe Mode to Purge RMM Services and Certs"]
    J --> L["Perform Full Clean OS Reinstall via USB Media From Clean PC"]
    K --> M["Remove Services, Scheduled Tasks, AppData, and Audit Browser Extensions"]

Comparison of remote access tools abused by scammers¶

Before attempting to clean a machine or report the incident to your bank's forensic fraud team, identify which remote tool(s) were installed. Remember that scammers routinely install two or three different tools during a single session so that if you uninstall the visible desktop icon, their hidden secondary service remains active.

Step-by-step banking and financial triage (First 30 minutes)¶

In a remote access scam, the computer infection is only the delivery mechanism; the primary emergency is acute financial theft. Attackers use psychological and technical tricks, such as editing the HTML source code (Inspect Element) of your bank's webpage to simulate an accidental $40,000 overpayment instead of $400, to trick you into wiring money, buying gift cards, or depositing cash into a Bitcoin ATM. Even if you refused to send money, an attacker with remote access can initiate transfers directly while your screen is blacked out.

1. Place an immediate hard freeze and initiate transfer recalls¶

Call your financial institution's dedicated fraud department immediately using a clean phone. State clearly: "My computer was compromised by a remote access trojan during a tech support/bank impersonation scam. An unauthorized party had live access to my online banking session." Demand the following specific actions:

• Online Banking Profile Lockout: Have the bank disable your online and mobile banking login credentials entirely and invalidate all active OAuth tokens and session cookies.
• ACH, Wire, and RTP Recall (SWIFT / Fedwire / Faster Payments): Ask the representative to inspect your account for any pending or queued outbound Automated Clearing House (ACH) transfers, domestic/international wire transfers, Zelle / Venmo payments, or "Bill Pay" checks scheduled for future dates. Scammers often schedule a Bill Pay check or post-dated ACH transfer set to execute 3 to 5 days later hoping you will not notice.
• Substitución do número de conta: Debido a que o atacante probablemente viu os teus números de conta de verificación e enrutamento completos (ou descargou extractos bancarios en PDF do teu navegador), conxelar a tarxeta de débito só é insuficiente. Debe solicitar ao banco que peche os números de conta comprometidos e que transfira os seus saldos a números de conta novos con "Post No Débito" (PND) restricións nas contas antigas.
• Check for Hidden Internal Transfers or Cash Advances: Attackers frequently take a cash advance from your linked credit card or Home Equity Line of Credit (HELOC) and transfer it into your checking account first, either to make you believe they "accidentally over-refunded" you, or to pool maximum liquidity before wiring the combined balance offshore. Tell the bank fraud specialist to check if any intra-bank transfers occurred between your savings, credit card, or brokerage accounts.

2. Freeze credit bureaus and check for new loan applications¶

While connected to your PC, scammers routinely search your Downloads ou Documents folders for keywords like tax, 1040, W2, passport, license, ou password and exfiltrate your tax returns and ID scans.

1. Place a free Security Freeze at all major credit bureaus immediately using your clean smartphone:
2. In the United States: Freeze Equifax (1-888-298-0045), Experian (1-888-397-3742), TransUnion (1-800-916-8800), and ChexSystems (1-800-428-9687).
3. In the United Kingdom: Contact Experian, Equifax, and TransUnion, and register for Cifas Protective Registration.
4. In Canada: Place credit freezes or fraud alerts with Equifax Canada and TransUnion Canada.
5. In Australia: Request a credit ban through Equifax, Illion, and Experian.
6. Review your credit report immediately for hard inquiries made in the last 24 hours; scammers often apply for instant online personal loans in a background browser tab while talking to you.

Eradicating remote access services in Safe Mode (Windows and macOS)¶

If you decide to inspect the machine, preserve forensic logs for law enforcement, or rescue irreplaceable personal photos before wiping the hard drive, never boot the computer into normal mode while connected to the internet. The moment a normal boot completes with Wi-Fi active, a persistent ScreenConnect ou AnyDesk service will phone home to the scammer's console and alert them that your machine is back online.

Phase 1: Booting into Safe Mode Without Networking¶

En Windows 10 e Windows 11¶

1. Make sure the Ethernet cable is unplugged and your home Wi-Fi router is unplugged or Airplane Mode is active.
2. Power on the PC. At the Windows sign-in screen, hold down the Left Shift key while clicking Power -> Restart.
3. On the blue recovery screen, select Troubleshoot -> Advanced options -> Startup Settings -> Restart.
4. When the startup options list appears, press 4 or F4 (Enable Safe Mode). Do not press 5 (Safe Mode with Networking).

On macOS (Apple Silicon and Intel)¶

1. Turn off the Mac and turn off your Wi-Fi router.
2. Apple Silicon (M1/M2/M3/M4): Hold the Power button until "Loading startup options" appears. Select your startup disk, hold Shift, and click Continue in Safe Mode.
3. Intel Mac: Turn on the Mac and immediately hold the Shift key until the login window appears.

Phase 2: Hunting and terminating persistent Windows Services¶

Standard uninstallation via "Add or Remove Programs" often fails to remove customized ScreenConnect MSI builds because attackers strip the uninstaller entry from the Windows Registry or deploy multiple instances under randomized hexadecimal service names.

1. In Windows Safe Mode, press Win + R, tipo services.msc, and press Enter.
2. Click the Name column to sort alphabetically, and carefully inspect every service for the following names:
3. ScreenConnect Client (xxxxxxxxxxxxxxxx) (Note: There may be two or three separate ScreenConnect Client entries with different 16-character alphanumeric strings in parentheses, where each represents a different scammer server).
4. AnyDesk Service
5. RustDesk Service
6. UltraViewerService
7. TeamViewer
8. Zoho Assist - Unattended Agent ou SimpleHelp Remote Access
9. Para cada servizo sospeitoso que atopes, fai clic co botón dereito nel e selecciona Propiedades.
10. Lea atentamente o campo Camiño ao executable e escríbao (por exemplo, C:\Program Files (x86)\ScreenConnect Client (a1b2c3d4e5f6g7h8)\ScreenConnect.ClientService.exe).
11. Cambia o menú despregable Tipo de inicio a Desactivado, fai clic en Deter (se se está a executar) e fai clic en Aplicar e Aceptar.
12. Next, open an elevated Command Prompt (Win + X -> Terminal (Administrador) ou Símbolo do sistema (Administrador)) e elimine permanentemente os rexistros do servizo usando o nome exacto do servizo que aparece na xanela de propiedades:

sc stop "AnyDesk"
sc delete "AnyDesk"
sc stop "RustDesk"
sc delete "RustDesk"
sc stop "UltraViewerService"
sc delete "UltraViewerService"

For ScreenConnect, query all installed instances and delete each one by its exact service key name:

sc query state= all | findstr /I "ScreenConnect"
sc delete "ScreenConnect Client (a1b2c3d4e5f6g7h8)"

Phase 3: Purging Scheduled Tasks, Startup folders, and hidden directories¶

Even after a Windows Service is deleted, attackers often configure a scheduled task that re-downloads the remote agent via powershell.exe ou mshta.exe every time a user logs in.

1. Preme Win + R, tipo taskschd.msc, e prema Intro para abrir o Programador de tarefas.
2. Fai clic en Biblioteca do Programador de tarefas no panel esquerdo. Expande cada subcartafol e inspecciona a pestana Accións de cada tarefa programada. Elimina calquera tarefa que lance binarios desde C:\Users\<User>\AppData\, C:\ProgramData\, ou invoca curl, bitsadmin, powershell -WindowStyle Hidden, ou calquera executable de escritorio remoto.
3. Preme Win + R, tipo shell:startupe prema Intro. Elimina calquera atallo ou .bat / .vbs scripts placed in your user Startup folder. Repeat this by typing shell:common startup to inspect the system-wide Startup folder.
4. Enable viewing hidden files in File Explorer (View -> Show -> Hidden items) and manually delete the application directories and configuration caches for all remote tools:
5. C:\Program Files (x86)\ScreenConnect Client (*)
6. C:\ProgramData\ScreenConnect Client (*)
7. C:\Program Files (x86)\AnyDesk\ e C:\ProgramData\AnyDesk\
8. C:\Users\<YourUsername>\AppData\Roaming\AnyDesk\
9. C:\Program Files\RustDesk\ e C:\Users\<YourUsername>\AppData\Roaming\RustDesk\
10. C:\Program Files (x86)\UltraViewer\ e C:\Users\<YourUsername>\AppData\Roaming\UltraViewer\

Phase 4: Removing macOS LaunchDaemons, LaunchAgents, and Privacy Grants¶

On macOS, remote access tools establish persistence through LaunchDaemons (system-wide) and LaunchAgents (user-level), combined with macOS TCC (Transparency, Consent, and Control) permissions for Screen Recording and Accessibility.

1. While in macOS Safe Mode (offline), open Finder, press Cmd + Shift + G (Go to Folder), and inspect the following three directories one by one:
2. /Library/LaunchDaemons/
3. /Library/LaunchAgents/
4. /Users/<YourUsername>/Library/LaunchAgents/
5. Drag any .plist files containing connectwise, screenconnect, anydesk, rustdesk, teamviewer, zoho, ou simplehelp to the Trash.
6. Next, open /Applications/ e /Library/Application Support/ and move any corresponding remote access app bundles and support folders to the Trash.
7. Open System Settings -> Privacy & Security. Check two critical sections:
8. Screen & System Audio Recording: Select any remote support tool listed and click the minus (-) button to revoke its ability to view your display.
9. Accessibility: Select any remote support tool and click the minus (-) button to revoke its ability to control your mouse cursor and synthesize keystrokes.
10. Full Disk Access: Verify that no unknown application or terminal wrapper has been granted Full Disk Access.

Reversing Windows password locks and fake boot banners¶

Before disconnecting, vindictive scammers frequently lock victims out of their computers and demand a ransom for the password. They use three primary methods:

1. Changing your local Windows password (net user) or adding a rogue admin account¶

While their screen curtain is active, scammers often open an elevated Command Prompt and run net user <YourUsername> <NewPassword> or create a backdoor administrator account (net user SupportAdmin Pass123 /add && net localgroup administrators SupportAdmin /add). * How to check and fix: In Safe Mode, open an elevated Command Prompt (cmd.exe as Administrator) and type net user. If you see an unfamiliar account, delete it immediately with net user <RogueAccountName> /delete. If your local password was changed, boot from a Windows Installation USB into the Windows Recovery Environment (WinRE) to restore a prior System Restore Point, or sign in with your linked Microsoft Account after resetting your password on a clean smartphone.

2. Enabling a startup message banner via Registry (LegalNoticeCaption)¶

Scammers often modify HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System by setting LegalNoticeCaption e LegalNoticeText to display a fake Microsoft Security lockout phone number before login. * How to fix: This is purely a cosmetic text screen before the normal Windows login prompt. Click OK or press Enter to bypass it, open regedit in Safe Mode, go to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System, and clear the text inside LegalNoticeCaption e LegalNoticeText.

3. Safe Boot PIN lockouts (bcdedit)¶

Microsoft removed the legacy syskey.exe tool in Windows 10 version 1709. Today, scammers instead tick Safe boot inside msconfig and reboot your PC offline. Because Windows Hello PINs often fail on the Safe Mode login screen without network access, victims get trapped in a boot loop. * How to fix: Hold Shift + Restart at the login screen, select Troubleshoot -> Advanced options -> Command Prompt, and run:

bcdedit /deletevalue {current} safeboot

Restart the computer normally (keeping your internet router unplugged) so you can log in with your cached password or PIN and remove the remote software.

Why browser session theft and infostealers require a full OS wipe¶

Even if you delete the ScreenConnect, AnyDesk, ou RustDesk services in Safe Mode, you must evaluate whether the scammer deployed a secondary Infostealer (Lumma, RedLine, Vidar, Stealc) or copied your browser profile directory.

During an unattended remote session, it takes less than 8 seconds for an attacker to run a PowerShell script that copies your Google Chrome, Microsoft Edge, or Brave user data directory (C:\Users\<User>\AppData\Local\Google\Chrome\User Data\Default\) along with the local DPAPI master decryption key. With those files on their server, the attacker possesses:

1. Every password saved in your web browser's built-in password manager.
2. Active session cookies (Cookies e Network\Cookies SQLite databases): Even if your email or bank uses two-factor authentication (2FA), possessing your decrypted session token cookie allows the attacker to import your browser profile into an antidetect browser on their machine and access your Gmail, Outlook, Amazon, or cryptocurrency exchange account without needing a password or 2FA code.
3. Browser-based cryptocurrency wallet vaults (MetaMask, Phantom, Rabby): Encrypted vault files inside Local Extension Settings are exfiltrated for offline brute-forcing.

When you must perform a clean USB operating system reinstall¶

While Safe Mode service removal is sufficient if you caught the scammer within 10 seconds of installing AnyDesk and never gave them Administrator elevation or unattended access, you must wipe the drive and perform a clean OS installation from a USB stick if any of the following occurred:

• Your screen went black (Blank Guest Monitor) or your mouse/keyboard was locked.
• You saw a Command Prompt (cmd.exe) or PowerShell window flash on the screen.
• You left the computer unattended while the scammer ran a fake security scan.
• You installed ConnectWise ScreenConnect (which runs as SYSTEM by default and allows invisible background shell script execution).

Para realizar unha reinstalación segura: 1. While offline in Safe Mode, plug a brand-new USB flash drive into the compromised PC and copy only personal data files (.jpg, .pdf, .docx, .xlsx, family videos). Never copy .exe, .msi, .bat, .ps1, or browser profile folders. 2. Using a different, clean computer, download the official Windows Media Creation Tool from Microsoft (microsoft.com/software-download) or create a bootable macOS installer. 3. Boot the compromised PC from the clean USB installer, delete all existing partitions on the primary drive (Drive 0), and install a fresh copy of the operating system.

Preserving your legal right to bank reimbursement¶

Banks frequently attempt to deny fraud reimbursement claims in remote access scams by arguing that because you clicked "Download" on AnyDesk or ScreenConnect, you "authorized" the transactions or acted with gross negligence. Knowing how statutory consumer banking protections work in your jurisdiction is critical when speaking to your bank's fraud claim adjudicator.

In the United States: Electronic Fund Transfer Act (EFTA) e Regulation E (12 CFR § 1005)¶

Under the federal Electronic Fund Transfer Act (Regulation E), the Consumer Financial Protection Bureau (CFPB) has issued official supervisory guidance stating that: * Induced access is still an "Unauthorized Electronic Fund Transfer": Under 12 CFR § 1005.2(m), an electronic fund transfer initiated by a person who obtained access to a consumer's account through fraud or robbery is defined by law as an unauthorized EFT, even if the consumer was tricked into providing a password, a one-time passcode, or installing remote desktop software. * Negligence cannot be used to deny your claim: The CFPB's Official Interpretation of Regulation E (Comment 6(b)-2) states that consumer negligence (such as falling for a phishing pop-up or granting remote desktop access to a scammer) cannot be used by a bank to impose greater liability on the consumer than Regulation E allows ($50 maximum if reported within 2 business days; $500 maximum within 60 days). * Distinguish between Scammer-Clicked vs. Consumer-Clicked transfers: If the scammer moved the mouse and clicked "Send" behind a black screen during the AnyDesk/ScreenConnect session, it is an Unauthorized EFT covered by Regulation E. Tell the bank in writing: "I did not initiate, authorize, or click the button for this transfer; a criminal threat actor executed the transfer remotely using a Remote Access Trojan while locking my screen, which constitutes an unauthorized EFT under 12 CFR § 1005.2(m)." Attach your preserved connection_trace.txt log or Windows Event Viewer Service Control Manager logs (Event ID 7045 showing the exact minute the ScreenConnect ou AnyDesk service was installed) as forensic proof.

In the United Kingdom, European Union, Canada, and Australia¶

• ** Reino Unido (PSR & FOS):** If the scammer controlled your computer directly to move funds, report it as an Unauthorized Payment under the Payment Services Regulations 2017. If the scammer manipulated your screen (Inspect Element reembolso falso) para enganarlo para que autorice vostede mesmo un Pago máis rápido, infórmeo baixo o Regulador de Servizos de Pago (PSR) obrigatorio Pago Push Autorizado (APP) Regras de reembolso por fraude e escalar calquera denegación ao Servizo do Defensor do Pobo Financeiro (FOS).
• Unión Europea, Canadá e Australia: Informa do incidente inmediatamente ao teu banco e á policía nacional, facendo fincapé en que un troiano de acceso remoto executou ou manipulou a sesión. Escalar as disputas bancarias non resoltas ao Defensor de Servizos e Investimentos Bancarios (OBSI) en Canadá ou na Autoridade de Queixas Financeiras de Australia (AFCA) en Australia baixo o ePayments Code.

Post-incident remediation and reporting checklist¶

Complete todos os elementos desta lista de verificación antes de volver conectar a súa rede doméstica ou retomar a actividade bancaria en liña normal:

• Confirmado o illamento físico: Desconectouse fisicamente o ordenador comprometido de Ethernet e wifi antes de resolver máis problemas.
• Contas bancarias conxeladas e numeradas de novo: Todos os números de conta corrente, de aforro e HELOC que estaban visibles no ordenador pecháronse e volvéronse a emitir con novos números de conta.
• Purráronse as filas de pago de facturas programadas e ACH: Verificouse cun supervisor bancario de que non hai cheques de pago de facturas con data futura, ligazóns bancarias externas (Plaid), or standing wire instructions were added during the remote session.
• Conxelación de crédito activa: Conxelación de seguridade colocada con Equifax, Experian, TransUnion e ChexSystems.
• Regras de reenvío de correo electrónico auditadas: Iniciaches sesión en Gmail/Outlook/Yahoo desde un teléfono intelixente limpo e comprobou Configuración -> Reenvío e POP/IMAP e Regras/Filtros para as regras ocultas que eliminan ou reenvían automaticamente correos electrónicos que conteñan "Bank", "Fraud", "Wire", ou "Security Alert".
• Browser password vault rotated: Every password stored inside Chrome, Edge, Firefox, or Safari password managers has been changed from a clean device.
• Gardáronse rexistros forenses e arquiváronse informes oficiais: Arquiva informes co FBI IC3 (ic3.gov) e FTC (reportfraud.ftc.gov) in the US, Action Fraud (actionfraud.police.uk) no Reino Unido, o Centro Canadiense Antifraude ou Scamwatch (scamwatch.gov.au) in Australia. Also report the installer binary or connection ID to connectwise.com/company/trust/report-abuse ou anydesk.com/en/abuse.

Preguntas frecuentes¶

O estafador mostroume o meu Visor de eventos de Windows e netstat no símbolo do sistema e estaba cheo de miles de avisos, erros e conexións de "DIRECCIÓN ESTRANXEIRA". O meu ordenador foi realmente pirateado antes de chamalos?¶

No. Both `eventvwr` (Visor de eventos de Windows) e `netstat` are normal administrative utilities built into every copy of Windows, and scammers abuse them as psychological props. Every healthy Windows computer generates thousands of routine yellow Warning and red Error logs in Event Viewer during normal boot-ups and background updates, and `netstat` lists every normal background connection your browser and operating system make to cloud servers as a "Foreign Address." Your computer was completely safe until the moment you followed the caller's instructions to download and run their remote access tool.

How did the scammer make my real bank website show that they accidentally deposited $40,000 na miña conta corrente se non poden piratear o servidor do banco?¶

While connected to your computer via AnyDesk or ScreenConnect, the scammer blacks out your screen for 15 seconds, right-clicks your bank balance in your web browser, and clicks **"Inspect" (`Developer Tools`)**. This opens the local HTML text displayed in your browser tab. The scammer simply types `$45,200.00` sobre o teu real `$5,200.00` balance e engade unha lectura de liña de texto falsa `"ACH REFUND OVERPAYMENT +$40,000.00"` na súa pantalla. Esta edición só existe dentro da memoria temporal da pestana do teu navegador (`DOM`) and vanishes the instant you refresh the page (`F5`) or check your balance on your smartphone app. Alternatively, they transfer `$40,000` from your own savings account or credit line into your checking account and relabel the screen to trick you into wiring your own money to them.

If I uninstalled AnyDesk or UltraViewer from the Control Panel, am I safe to turn my Wi-Fi back on?¶

Usually not without inspecting Windows Services (`services.msc`) in Safe Mode first. Professional tech support scam call centers know that victims often uninstall AnyDesk or UltraViewer as soon as they hang up. Therefore, within the first two minutes of connecting to your PC, scammers routinely use silent file transfer to drop a secondary, hidden **ConnectWise ScreenConnect** (`ScreenConnect.ClientService.exe`) or **SimpleHelp** agent that does not create a desktop shortcut and hides inside `C:\Program Files (x86)\ScreenConnect Client (xxxx)`. Unless you verify in Safe Mode that no rogue `SYSTEM` services or scheduled tasks exist, or perform a full USB OS wipe, reconnecting to Wi-Fi can immediately hand control of your PC back to the attacker.

Can a scammer access other computers or smartphones on my home Wi-Fi network just because I installed AnyDesk on one laptop?¶

Installing AnyDesk or ScreenConnect compromises the specific computer where you ran the installer, not your phones or other laptops directly. However, if you use **Google Chrome, Microsoft Edge, or Apple iCloud password and session syncing** across your laptop and smartphone, any passwords the scammer steals or changes on the infected laptop will impact your shared cloud accounts. Also, while connected to your laptop, an attacker can log into your home router's admin page (`192.168.1.1`) if it still uses the default admin password and alter your router's `DNS` settings. After isolating the infected laptop, factory-reset your Wi-Fi router or verify its DNS settings and admin password from a clean device.

Guías relacionadas¶

• Estafa emerxente de soporte técnico e eliminación de escritorio remoto AnyDesk/TeamViewer
• Session cookie hijacking, infostealer malware, and passkey revocation
• CAPTCHA falso ClickFix PowerShell Win+R malware do portapapeis e corrección de Lumma Infostealer
• Authorized push payment (APP) app fraud: Zelle, Venmo, and Faster Payments impersonation and reimbursement rights
• Bank account breach
• Números de emerxencia por país

Fontes e orientacións oficiais¶

• Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), National Security Agency (NSA), & Multi-State Information Sharing and Analysis Center (MS-ISAC) (United States): Joint Cybersecurity Advisory (AA23-025A): Protecting Against Malicious Use of Remote Monitoring and Management (RMM) Software.
• Oficina de Protección Financeira do Consumidor (CFPB) (United States): Electronic Fund Transfers (Regulation E, 12 CFR Part 1005) Official Interpretations and FAQs on Unauthorized EFTs and Fraudulently Induced Access.
• Federal Trade Commission (FTC) (United States): How To Spot, Avoid, and Report Tech Support Scams.
• Centro Nacional de Ciberseguridad (NCSC) & Action Fraud (United Kingdom): Protecting Devices from Unauthorised Remote Access Tools and Screen-Sharing Fraud.
• ConnectWise Trust & Security Response Center: Identifying and Removing Rogue ScreenConnect (ConnectWise Control) Instancias do cliente.