Nnweta trojan dịpụrụ adịpụ (ScreenConnect, AnyDesk, RustDesk, UltraViewer) aghụghọ nkwado teknụzụ: ịdọta ethernet, ọrụ igbu mmadụ, na ifriizi ụlọ akụ.¶

Mgbe onye scammer kwenye gị ka ịwụnye ngwa desktọpụ dịpụrụ adịpụ ma ọ bụ mebie onye na-ahụ maka ihe nleba anya na kọmputa gị, ha na-enweta ndụ, njikwa na-enweghị njedebe na òké gị, keyboard, sistemụ faịlụ na oge ihe nchọgharị na-arụ ọrụ. Mgbe ị na-egosipụta nyocha nchekwa adịgboroja ma ọ bụ ákwà mgbochi ojii na nleba anya gị, onye na-ahụ maka ọrụ na-ewepụ ọnụ ọgụgụ ndekọ ego, na-ewekọta okwuntughe echekwara, ma wụnye ọrụ ndabere na-adịgide adịgide nke na-adịgide ndụ nrụgharị ọkọlọtọ. Ntuziaka a na-enye usoro ozugbo iji kụwaa njikọ data nke onye mwakpo ahụ, kpochapụ ọrụ ịnweta ohere na-adịghị ahụ anya, ma kpọchie ụlọ akụ gị na akụrụngwa kredit tupu ego kpochapụ netwọk waya.

Mee nke a ugbu a¶

1. ** Kwụsị njikọ ịntanetị niile n'anụ ahụ ozugbo.** Wepụ eriri Ethernet n'azụ desktọpụ ma ọ bụ rawụta gị, tụgharịa Wi-Fi mgba ọkụ na laptọọpụ gị, ma ọ bụ pịa ma jide bọtịnụ ike na rawụta Wi-Fi gị maka sekọnd iri ruo mgbe ọkụ niile ga-agba ọchịchịrị. Egbula oge na-agbalị ịlụ ọgụ scammer maka njikwa nke òké cursor ka ịpị bọtịnụ nkwụsị.
2. Manye mechie kọmpụta ahụ mebiri emebi ma ọ bụrụ na ihuenyo agbachiela. Ọ bụrụ na onye mwakpo ahụ enyerela "Blank Guest Monitor" ma ọ bụ kpọchie ndenye ahụigodo gị, pịa ma jide bọtịnụ ike anụ ahụ nke kọmputa gị maka nkeji iri zuru oke ruo mgbe igwe kwụsịrị kpamkpam. Hapụ ya ka ọ gbanyụọ ka ị na-echekwa akaụntụ ego gị site na ngwaọrụ dị iche, dị ọcha.
3. Kpọọ ngalaba aghụghọ nke ụlọ akụ gị site na ekwentị nọọrọ onwe ya. Jiri ekwentị mkpanaka kpọọ nọmba gọọmentị ebipụta n'azụ debit ma ọ bụ kaadị kredit gị, ma ọ bụ kpọọ nọmba mberede mpaghara gị (911 na United States na Canada, 112 gafee European Union, 999 na United Kingdom) ma ọ bụrụ na iyi egwu ịpụnaara mmadụ na-eme; hụ nọmba mberede maka kọntaktị mba ụwa. Kụzie ụlọ akụ ka ha tinye nkwụsi ike ozugbo na nlele, nchekwa ego na akaụntụ kredit niile, wee rịọ maka ncheta ihe mberede na ụlọ mkpochapụ Automated ọ bụla (ACH), waya, ma ọ bụ nnyefe ịkwụ ụgwọ ozugbo.
4. Kagbuo kuki nnọkọ nọ n'ọrụ wee gbanwee okwuntughe site na ama dị ọcha. Iji ekwentị gị na data cellular (anaghị ejikọrọ na Wi-Fi ụlọ gị ma ọ bụrụ na PC etinyerela azụ), banye na email mbụ gị, ọnụ ụzọ ụlọ akụ na akaụntụ nchekwa igwe ojii. Kwụsị oge nbanye niile na-arụ ọrụ, kagbuo ngwaọrụ Multi-Factor Authentication (MFA), ma tụgharịa okwuntughe gị.
5. Bụgharịa kọmpụta nke butere ọrịa ahụ ka ọ bụrụ Ọnọdụ Nchekwa na-enweghị ịkparịta ụka n'Ịntanet. Naanị gbanye kọmputa ahụ mebiri emebi mgbe ị kwụsịrị na ịntanetị, na-abanye na ọnọdụ nchekwa Windows ma ọ bụ ọnọdụ nchekwa macOS iji nyochaa ma wepụ ọrụ ndabere na-adịghị ele anya.ScreenConnect Client, AnyDesk Service, RustDesk Service) tupu sistemụ arụ ọrụ ebugo ndị ọkwọ ụgbọ ala netwọkụ ndị ọzọ.

Ịghọta nhazi ahụ nke RMM azụmahịa yana ọgụ desktọpụ dịpụrụ adịpụ¶

Aghụghọ na-akwado teknụzụ ọgbara ọhụrụ, wayo nkwụghachi, na mwakpo ịre ahịa ụlọ akụ anaghị adaberekarị na nje kọmputa edere ahaziri. Kama nke ahụ, ndị na-eme ihe egwu na-eme ihe n'ụzọ ziri ezi, nleba anya na njikwa ime obodo bịanyere aka na ya n'ụdị dijitalụ.RMM) ngwanrọ na ngwa desktọpụ dịpụrụ adịpụ azụmahịa. N'ihi na ndị a na-arụ ọrụ na-ebu asambodo ntinye koodu cryptographic ziri ezi sitere n'aka ndị na-ere ngwanrọ tụkwasịrị obi, mmemme antivirus dị ka Windows Defender ma ọ bụ macOS XProtect anaghị egbochi nrụnye ha.

Otu ndị na-awakpo na-esi eji ọnụọgụ abụọ nkwado dịpụrụ adịpụ ngwa ọgụ¶

Mgbe onye a tara ahụhụ kpọrọ nọmba akwụghị ụgwọ egosipụtara na mmapụta ihe nchọgharị adịgboroja, zara email akwụkwọ ọnụahịa ngwa ngwa, ma ọ bụ soro ntuziaka sitere na onye nyocha aghụghọ ụlọ akụ adịgboroja, onye ọrụ na-eduzi ha ka ha budata ihe nrụnye ma ọ bụ ihe nrụnye MSI. Usoro ikpo okwu kacha emejọ gụnyere:

• ConnectWise ScreenConnect (nke bụbu njikwa): A na-ebutekarị ya site na ahaziri ahazi .msi ma ọ bụ .exe ngwugwu akwadoro na ihe nkesa na-achịkwa onye mwakpo. Ozugbo e gbuchara ya, ọ na-arụnye ka ọrụ Windows System na-adịgide adịgide (ScreenConnect Client (xxxx)) na-agba ọsọ NT AUTHORITY\SYSTEM ihe ùgwù, na-enye ohere ịgbachi nkịtị, na-anaghị ele ya anya mgbe ọ bụla kọmputa dị n'ịntanetị.
• Desk ọ bụla (anydesk.exe): A na-ejikarị eme ihe n'ụzọ aghụghọ n'ikpo okwu na-achọ Windows, macOS na ngwaọrụ mkpanaka. Ndị na-awakpo ahụ na-agwa onye ahụ ka ọ gụpụta adreesị AnyDesk nke nwere ọnụọgụ 9, rịọ maka nkwalite nhazi, wee tọọ “Password Access unattended” ka ọ jikọọ ọzọ mgbe onye ahụ na-ehi ụra.
• ** RustDesk (rustdesk.exe):** Ngwá ọrụ desktọpụ dịpụrụ adịpụ nke mepere emepe nke ndị scam syndicates kwadoro n'ihi na ha nwere ike iji sava relay na-anabata onwe ha, na-agabiga mkparị ndị na-ere ere.
• UltraViewer, TeamViewer, Zoho Assist, and SimpleHelp: A na-ekekọta ọnụ. Onye scammer na-ejikọta site na UltraViewer ma ọ bụ AnyDesk ga-etinyekarị ihe zoro ezo na nzuzo ScreenConnect ma ọ bụ SimpleHelp ngwugwu dị n'azụ dị ka ndabere azụ azụ.

Usoro ọrụ mberede: ikewa njikọ na imebi mmebi¶

Jiri eserese ọrụ na-esote iji kwụsị nnọkọ dịpụrụ adịpụ na-arụ ọrụ, kewapụ ebe a na-arụ ọrụ, wee chọpụta ma enwere ike ihicha igwe ahụ na Ọnọdụ Nchekwa ma ọ bụ chọọ ihichapụ sistemụ arụmọrụ zuru oke.

flowchart TD
    A["Achọpụtara ojoro ohere ime anya na-arụ ọrụ ma ọ bụ na nso nso a"] --> B["Wepụ eriri Ethernet n'anụ ahụ yana gbanyụọ Wi-Fi Router"]
    B --> C{"Ihuenyo agbachiela ma ọ bụ akpọchie òké?"}
    C -- "Ee" --> D["Jide bọtịnụ ike anụ ahụ PC maka sekọnd 10 ka ịgbanyụ"]
    C -- "Mba" --> E["Gbanwee ọnọdụ ụgbọ elu ma mechie PC ọ bụla"]
    D --> F["Jiri Smartphone dị ọcha na data cellular iji kpọọ Dept Fraud Bank"]
    E --> F
    F --> G["Nlele/nchekwa n'efu, cheta waya/Zelle, ụlọ ọrụ kredit mkpọchi"]
    G --> H["Site na ekwentị dị ọcha: tụgharịa okwuntughe email/ụlọ akụ wee gbuo oge"]
    H --> I{"Ndi Scammer nwere ohere na-adịghị ele anya ma ọ bụ gbaa CMD/PowerShell?"}
    I -- "Ee (Egwu dị elu)" --> J["Bugharịa PC na-anọghị n'ịntanetị ka ọ bụrụ ọnọdụ nchekwa iji napụta naanị Docs nkeonwe"]
    I -- "Mba (Nnọkọ a na-elekọta nkenke)" --> K["Bugharịa na-anọghị n'ịntanetị ka ọ bụrụ ọnọdụ nchekwa iji kpochapụ ọrụ RMM na asambodo"]
    J --> L["Megharịa OS dị ọcha zuru oke site na mgbasa ozi USB site na PC dị ọcha"]
    K --> M["Wepu Ọrụ, Ọrụ ahazi, AppData, yana ndọtị ihe nchọgharị nyocha"]

Tụnyere ngwaọrụ ịnweta ohere dịpụrụ adịpụ nke ndị aghụghọ na-emegbu¶

Tupu ị na-anwa ihicha igwe ma ọ bụ kọọ ihe merenụ n'aka ndị otu ụlọ akụ na-ahụ maka wayo nke ụlọ akụ gị, chọpụta ngwa (s) dịpụrụ adịpụ arụnyere. Cheta na ndị scammers na-etinyekarị ngwaọrụ abụọ ma ọ bụ atọ dị iche iche n'otu oge ka ọ bụrụ na ị wepụ akara ngosi desktọpụ a na-ahụ anya, ọrụ nke abụọ zoro ezo ka na-arụ ọrụ.

Nhazi ụlọ akụ na usoro ego (nkeji 30 mbụ)¶

N'ime ojoro ohere dịpụrụ adịpụ, ọrịa kọmputa bụ naanị usoro nnyefe; Ihe mberede mbụ bụ nnukwu izu ohi ego. Ndị na-awakpo na-eji aghụghọ mmụọ na nka nka, dị ka edezi koodu isi mmalite HTML (Inspect Element) nke webụsaịtị ụlọ akụ gị ka ịmee ihe mberede $40,000 ngafe ugwo kama $400, iji ghọgbuo gị n'ime ego wiring, ịzụrụ kaadị onyinye, ma ọ bụ itinye ego n'ime ATM Bitcoin. Ọbụlagodi na ị jụrụ izipu ego, onye na-awakpo nwere ohere dịpụrụ adịpụ nwere ike ibido mbufe ozugbo mgbe ihuenyo gị kwụsịrị.

1. Debe oyiri siri ike ozugbo wee malite ncheta mbufe¶

Jiri ekwentị dị ọcha kpọọ ngalaba wayo raara onwe ya nye ụlọ ọrụ ego gị ozugbo. Kwupụta n'ụzọ doro anya: "Trojan dịpụrụ adịpụ mebiri kọmputa m n'oge a na-akwado teknụzụ/mkpụrụ aghụghọ n'ụlọ akụ. Ndị otu na-enyeghị ikike nwere ohere ịnweta nnọkọ ụlọ akụ m n'ịntanetị." Chọrọ ihe ndị a akọwapụtara:

• Mkpọchi profaịlụ ụlọ akụ n'ịntanetị: Mee ka ụlọ akụ gbanyụọ nzere nbanye gị n'ịntanetị na ụlọ akụ ekwentị kpamkpam wee mebie akara OAuth niile na-arụ ọrụ na kuki nnọkọ.
• ** ACH, Waya, na RTP Ncheta (SWIFT / Fedwire / Faster Payments:** Rịọ onye nnọchi anya ka ọ nyochaa akaụntụ gị maka ụlọ mkpochapụ ọ bụla na-echere ma ọ bụ kwụ n'ahịrị na-apụ apụ (Automated Clearing House).ACH) nnyefe, nnyefe waya ụlọ / mba ụwa, Zelle / Venmo ịkwụ ụgwọ, ma ọ bụ ndenye ego "Ịkwụ ụgwọ ụgwọ" ahaziri maka ụbọchị n'ọdịnihu. Ndị scammers na-ahazi oge nlele ụgwọ ụgwọ ụgwọ ma ọ bụ nyefe ACH ga-eme ụbọchị 3 ruo 5 ka e mesịrị na-atụ anya na ị gaghị achọpụta.
• ** Ngbanwe Nọmba Akaụntụ:** N'ihi na o yikarịrị ka onye mwakpo ahụ lere ụzọ njem gị na ịlele nọmba akaụntụ gị (ma ọ bụ nkwupụta ụlọ akụ PDF ebudatara site na ihe nchọgharị gị), idebe kaadị debit naanị ezughi oke. Ị ga-arịọrịrị ka ụlọ akụ ahụ mechie nọmba akaụntụ ndị mebiri emebi ma were "Post No Debits" ("Post No Debits") gbanwee ego gị ka ọ bụrụ nọmba akaụntụ ọhụrụ.PND) mmachi na akaụntụ ochie.
• ** Lelee maka mbufe n'ime ezoro ezo ma ọ bụ ọganihu ego:** Ndị na-awakpo na-ebukarị ụzọ ego site na kaadị kredit gị jikọtara ma ọ bụ Line Equity Line of CreditHELOC) ma bufee ya na akaụntụ nlele gị nke mbụ, ma ọ bụ mee ka ị kwenye na ha "na-akwụghachi gị na mberede" ma ọ bụ tinye ego kachasị elu tupu ị jikọọ nguzozi n'akụkụ osimiri. Gwa onye ọkachamara wayo ụlọ akụ ka ọ lelee ma ọ bụrụ nfefe n'ime ụlọ akụ ọ bụla mere n'etiti ego ego, kaadị kredit, ma ọ bụ akaụntụ ịzụ ahịa.

2. Kredit bureaus ma lelee maka ngwa mbinye ego ọhụrụ¶

Mgbe ejikọrọ na PC gị, ndị scammers na-achọgharị gị oge niile Downloads ma ọ bụ Documents nchekwa maka isiokwu dị ka tax, 1040, W2, passport, license, ma ọ bụ password ma wepụ ụtụ isi gị na nyocha ID gị.

1. Debe ** Nchekwa Freeze *** n'efu na nnukwu ụlọ ọrụ kredit ozugbo iji ekwentị gị dị ọcha:
2. Na United States: Ifriizi Equifax (1-888-298-0045), ** ọkachamara *** (1-888-397-3742), TransUnion (1-800-916-8800), na ChexSystems (1-800-428-9687).
3. Na United Kingdom: Kpọtụrụ ** Experian , ** Equifax, na TransUnion, debanye aha maka ** Ndebanye aha Nchedo Cifas*.
4. Na Canada: Tinye kredit kredit ma ọ bụ ọkwa aghụghọ na Equifax Canada na TransUnion Canada.
5. N'Australia: Rịọ mmachibido iwu kredit site na Equifax, Illion na Experian.
6. Nyochaa akụkọ kredit gị ozugbo maka ajụjụ siri ike emere n'ime awa 24 gara aga; Ndị wayo na-etinyekarị akwụkwọ maka mbinye ego n'ịntanetị ozugbo na taabụ nchọgharị ndabere ka ha na-agwa gị okwu.

Na-ekpochapụ ọrụ ịnweta ohere na ọnọdụ nchekwa (Windows na macOS)¶

Ọ bụrụ n’ikpebie inyocha igwe, chekwaa ndekọ maka ndị mmanye iwu, ma ọ bụ napụta foto nkeonwe na-enweghị ike dochie tupu ihichapụ draịvụ ike, ** ebula kọmpụta ahụ n'ọnọdụ nkịtị mgbe ejikọtara na ịntanetị. Oge akpụkpọ ụkwụ nkịtị na-eji Wi-Fi arụ ọrụ, ọ na-adịgide adịgide ScreenConnect ma ọ bụ AnyDesk Ọrụ ga-ekweta n'ụlọ na consoles scammer ma mee ka ha mara na igwe gị alọghachila n'ịntanetị.

Usoro 1: Ịbanye n'ime ọnọdụ nchekwa na-enweghị netwọk¶

Na Windows 10 na Windows 11¶

1. Gbaa mbọ hụ na ewepụghị eriri Ethernet na ewepụghị rawụta Wi-Fi ụlọ gị ma ọ bụ ọnọdụ ụgbọ elu na-arụ ọrụ.
2. Ike na PC. Na ihuenyo nbanye Windows, jituo igodo ekpe Shift ka ị na-pịa Ike -> Malitegharịa ekwentị.
3. Na ihuenyo mgbake na-acha anụnụ anụnụ, họrọ Nchọpụta nsogbu -> Nhọrọ dị elu -> Ntọala mmalite -> Malitegharịa ekwentị.
4. Mgbe ndepụta nhọrọ mmalite gosipụtara, pịa 4 ma ọ bụ F4 (Enable Safe Mode). ** Apịla 5 (Safe Mode with Networking)**

Na MacOS (Apple Silicon na Intel)¶

1. Gbanyụọ Mac ma gbanyụọ rawụta Wi-Fi gị.
2. ** Silicon apụl (M1/M2/M3/M4):** Jide bọtịnụ ike ruo mgbe "nhọrọ mmalite mmalite" pụtara. Họrọ diski mmalite gị, jide Shift, wee pịa Gaa n'ihu na ọnọdụ nchekwa.
3. Intel Mac: Gbanyụọ Mac wee jide igodo ** Shift ozugbo ruo mgbe windo nbanye pụtara.

Usoro 2: Ịchụ nta na ịkwụsị ọrụ Windows na-adịgide adịgide¶

Mwepu ọkọlọtọ site na "Tinye ma ọ bụ Wepu Mmemme" anaghị ewepụkarị ahaziri ScreenConnect MSI na-ewuli elu n'ihi na ndị na-awakpo ahụ na-ewepụ ntinye uninstaller na ndekọ Windows ma ọ bụ bufee ọtụtụ oge n'okpuru aha ọrụ hexadecimal na-enweghị usoro.

1. Na ọnọdụ Nchekwa Windows, pịa Win + R, ụdị services.msc, wee pịa Tinye.
2. Pịa kọlụm ** Aha *** iji hazie n'ụzọ mkpụrụedemede, wee jiri nlezianya lelee ọrụ ọ bụla maka aha ndị a:
3. ScreenConnect Client (xxxxxxxxxxxxxxxx) (Rịba ama: Enwere ike ịbụ abụọ ma ọ bụ atọ dị iche iche ScreenConnect Client ndenye nwere eriri mkpụrụedemede 16 dị iche iche n'ime mbo, ebe nke ọ bụla na-anọchi anya sava scammer dị iche).
4. AnyDesk Service
5. RustDesk Service
6. UltraViewerService
7. TeamViewer
8. Zoho Assist - Unattended Agent ma ọ bụ SimpleHelp Remote Access
9. Maka ọrụ ọ bụla na-enyo enyo ịchọta, pịa aka nri ya wee họrọ ** Njirimara **.
10. Gụọ mpaghara ** Ụzọ iji rụọ ọrụ nke ọma wee dee ya (dịka ọmụmaatụ, C:\Program Files (x86)\ScreenConnect Client (a1b2c3d4e5f6g7h8)\ScreenConnect.ClientService.exe).
11. Gbanwee ihe ndọpụta ** ụdị mmalite ** ka ọ bụrụ ** nkwarụ , pịa ** Kwụsị (ọ bụrụ na ọ na-agba ọsọ), wee pịa ** Tinye** na ** OK**.
12. Na-esote, mepee Command Prompt dị elu (Win + X -> ** Terminal (Admin)** ma ọ bụ ** Ngwa ngwa ngwa (Admin)**) wee hichapụ ndebanye aha ọrụ kpamkpam site na iji aha ọrụ edepụtara na windo akụrụngwa:

sc stop "AnyDesk"
sc delete "AnyDesk"
sc stop "RustDesk"
sc delete "RustDesk"
sc stop "UltraViewerService"
sc delete "UltraViewerService"

Maka ScreenConnect, jụọ ajụjụ niile arụnyere wee hichapụ nke ọ bụla site na aha igodo ọrụ ya:

sc query state= all | findstr /I "ScreenConnect"
sc delete "ScreenConnect Client (a1b2c3d4e5f6g7h8)"

Nkeji 3: ihichapụ ọrụ akwadoro, nchekwa mmalite na akwụkwọ ndekọ aha zoro ezo¶

Ọbụlagodi mgbe ehichapụrụ Ọrụ Windows, ndị na-awakpo na-ahazikarị ọrụ a haziri nke na-ebughachi ndị nnọchite anya site na powershell.exe ma ọ bụ mshta.exe oge ọ bụla onye ọrụ na-abanye.

1. Pịa Win + R, ụdị taskschd.msc, wee pịa Tinye imepe ** Onye nhazi ọrụ**.
2. Pịa ** Ọbá akwụkwọ nhazi ọrụ ** n'akụkụ aka ekpe. Gbasaa folda nchekwa ọ bụla wee lelee taabụ ** Omume ** nke ọrụ ọ bụla ahaziri. Hichapụ ọrụ ọ bụla na-ebupụta ọnụọgụ abụọ site na C:\Users\<User>\AppData\, C:\ProgramData\, ma ọ bụ na-akpọku curl, bitsadmin, powershell -WindowStyle Hidden, ma ọ bụ ihe ọ bụla dịpụrụ adịpụ desktọpụ.
3. Pịa Win + R, ụdị shell:startup, wee pịa Tinye. Hichapụ ụzọ mkpirisi ọ bụla ma ọ bụ .bat / .vbs scripts etinye n'ime nchekwa mmalite onye ọrụ gị. Tinyegharịa nke a site na ịpị shell:common startup inyocha nchekwa mmalite mmalite sistemụ.
4. Kwado ikiri faịlụ ezoro ezo na File Explorer (Lee -> Gosi -> Ihe ezoro ezo) wee jiri aka hichapụ akwụkwọ ndekọ aha ngwa na cache nhazi maka ngwaọrụ niile dịpụrụ adịpụ:
5. C:\Program Files (x86)\ScreenConnect Client (*)
6. C:\ProgramData\ScreenConnect Client (*)
7. C:\Program Files (x86)\AnyDesk\ na C:\ProgramData\AnyDesk\
8. C:\Users\<YourUsername>\AppData\Roaming\AnyDesk\
9. C:\Program Files\RustDesk\ na C:\Users\<YourUsername>\AppData\Roaming\RustDesk\
10. C:\Program Files (x86)\UltraViewer\ na C:\Users\<YourUsername>\AppData\Roaming\UltraViewer\

Usoro 4: Wepụ MacOS LaunchDaemons, LaunchAgents, na Onyinye Nzuzo¶

Na macOS, ngwaọrụ ịnweta ohere dịpụrụ adịpụ na-emepụta nnọgidesi ike site na LaunchDaemons (site n'obosara) na LaunchAgents (ọkwa onye ọrụ), jikọtara ya na macOS TCC Ikikere (nhapu, nkwenye, na njikwa) maka ** Ndekọ ihuenyo ** na ** nnweta ***.

1. Mgbe nọ na ọnọdụ nchekwa macOS (anọghị n'ịntanetị), mepee ** Finder **, pịa Cmd + Shift + G (Go to Folder), ma lelee akwụkwọ ndekọ aha atọ ndị a n'otu n'otu:
2. /Library/LaunchDaemons/
3. /Library/LaunchAgents/
4. /Users/<YourUsername>/Library/LaunchAgents/
5. Dọrọ nke ọ bụla .plist faịlụ nwere connectwise, screenconnect, anydesk, rustdesk, teamviewer, zoho, ma ọ bụ simplehelp gaa na ahịhịa.
6. Ọzọ, mepee /Applications/ na /Library/Application Support/ ma bugharịa ngwugwu ngwa ohere ime ime ọ bụla kwekọrọ na nchekwa nkwado na ahịhịa.
7. Mepee ** Ntọala sistemụ -> Nzuzo & Nchekwa**. Lelee ngalaba abụọ dị egwu:
8. ** Ihuenyo & Sistemu Audio Recording:** Họrọ ngwa ọrụ nkwado ọ bụla edepụtara wee pịa mwepu (-) bọtịnụ kagbuo ikike ilele ihe ngosi gị.
9. Nweta: Họrọ ngwa ọrụ nkwado ọ bụla wee pịa mwepu (-) bọtịnụ kagbuo ikike ya ịchịkwa cursor òké gị yana megharịa igodo igodo gị.
10. ** Nweta diski zuru oke:** Chọpụta na ọ nweghị ngwa amabeghị ma ọ bụ ihe mkpuchi ọnụ enyerela ohere ịnweta diski zuru oke.

Na-atụgharị mkpọchi paswọọdụ Windows na ọkọlọtọ buut adịgboroja¶

Tupu ha akwụsị njikọ, ndị ohi na-emegbu mmadụ na-ekpochikarị ndị o metụtara na kọmputa ha wee na-achọ ihe mgbapụta maka paswọọdụ ha. Ha na-eji ụzọ atọ bụ isi:

1. Ịgbanwe paswọọdụ Windows mpaghara gị (net user) ma ọ bụ gbakwunye akaụntụ nchịkwa rogue¶

Mgbe ákwà mgbochi ihuenyo ha na-arụ ọrụ, ndị scammers na-emeghekarị Command Prompt ma na-agba ọsọ net user <YourUsername> <NewPassword> ma ọ bụ mepụta akaụntụ nchịkwa azụ azụ (net user SupportAdmin Pass123 /add && net localgroup administrators SupportAdmin /add). * ** Otu esi elele na idozi:** Na ọnọdụ nchekwa, mepee ngwa ngwa iwu dị elu (cmd.exe dị ka Administrator) na ụdị net user. Ọ bụrụ na ịhụ akaụntụ ị maghị, hichapụ ya ozugbo net user <RogueAccountName> /delete. Ọ bụrụ na agbanwere okwuntughe mpaghara gị, buut site na USB nwụnye Windows n'ime gburugburu mgbake Windows (WinRE) iji weghachi ebe mbụ weghachi Sistemu, ma ọ bụ jiri Akaụntụ Microsoft gị ejikọrọ wee banye mgbe ịtọgharịa paswọọdụ gị na ekwentị dị ọcha.

2. Na-eme ka ọkọlọtọ ozi mmalite site na ndekọ aha (LegalNoticeCaption)¶

Ndị wayo na-agbanwekarị HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System site na ịtọ ntọala LegalNoticeCaption na LegalNoticeText iji gosi nọmba ekwentị mkpọchi Nchedo Microsoft adịgboroja tupu nbanye. * ** Otu esi edozi:** Nke a bụ naanị ihuenyo ederede ịchọ mma tupu ngwa nbanye Windows nkịtị. Pịa OK ma ọ bụ pịa Tinye ka ịgafe ya, mepee regedit na Ọnọdụ Nchekwa, gaa na HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System, and clear the text inside LegalNoticeCaption na LegalNoticeText.

3. Mkpọchi PIN akpụkpọ ụkwụ dị mma (bcdedit)¶

Microsoft wepụrụ ihe nketa ahụ syskey.exe tool in Windows 10 version 1709. Today, scammers instead tick Safe boot inside msconfig wee malitegharịa PC gị na-anọghị n'ịntanetị. N'ihi na Windows Ndewo PIN na-adakarị na ihuenyo nbanye Ọnọdụ Nchekwa na-enweghị ohere netwọkụ, ndị a tara ahụhụ na-adaba n'ime loop buut. * How to fix: Hold Shift + Restart at the login screen, select Troubleshoot -> Advanced options -> Command Prompt, and run:

bcdedit /deletevalue {current} safeboot

Restart the computer normally (keeping your internet router unplugged) so you can log in with your cached password or PIN and remove the remote software.

Why browser session theft and infostealers require a full OS wipe¶

Even if you delete the ScreenConnect, AnyDesk, ma ọ bụ RustDesk services in Safe Mode, you must evaluate whether the scammer deployed a secondary Infostealer (Lumma, RedLine, Vidar, Stealc) or copied your browser profile directory.

During an unattended remote session, it takes less than 8 seconds for an attacker to run a PowerShell script that copies your Google Chrome, Microsoft Edge, or Brave user data directory (C:\Users\<User>\AppData\Local\Google\Chrome\User Data\Default\) along with the local DPAPI master decryption key. With those files on their server, the attacker possesses:

1. Every password saved in your web browser's built-in password manager.
2. Active session cookies (Cookies na Network\Cookies SQLite databases): Even if your email or bank uses two-factor authentication (2FA), possessing your decrypted session token cookie allows the attacker to import your browser profile into an antidetect browser on their machine and access your Gmail, Outlook, Amazon, or cryptocurrency exchange account without needing a password or 2FA code.
3. Browser-based cryptocurrency wallet vaults (MetaMask, Phantom, Rabby): Encrypted vault files inside Local Extension Settings a na-ebupụ ya maka ịmanye mkparị na-anọghị n'ịntanetị.

When you must perform a clean USB operating system reinstall¶

Ọ bụ ezie na mwepụ ọrụ nchekwa nchekwa zuru oke ma ọ bụrụ na ijide onye scammer n'ime 10 sekọnd nke ịwụnye AnyDesk na enyeghị ha ọkwa nchịkwa ma ọ bụ ohere a na-atụghị anya ya, ** ị ga-ehichapụ draịva ahụ wee rụọ ọrụ OS dị ọcha site na eriri USB ** ma ọ bụrụ na nke ọ bụla n'ime ihe ndị a mere:

• Ihuenyo gị gbara oji (Blank Guest Monitor) or your mouse/keyboard was locked.
• You saw a Command Prompt (cmd.exe) or PowerShell window flash on the screen.
• You left the computer unattended while the scammer ran a fake security scan.
• You installed ConnectWise ScreenConnect (which runs as SYSTEM by default and allows invisible background shell script execution).

To perform a safe reinstall: 1. While offline in Safe Mode, plug a brand-new USB flash drive into the compromised PC and copy only personal data files (.jpg, .pdf, .docx, .xlsx, family videos). Never copy .exe, .msi, .bat, .ps1, or browser profile folders. 2. Using a different, clean computer, download the official Windows Media Creation Tool from Microsoft (microsoft.com/software-download) or create a bootable macOS installer. 3. Boot the compromised PC from the clean USB installer, delete all existing partitions on the primary drive (Drive 0), and install a fresh copy of the operating system.

Ichekwa ikike gị nke iwu kwadoro ịkwụghachi ụlọ akụ¶

Banks frequently attempt to deny fraud reimbursement claims in remote access scams by arguing that because you clicked "Download" on AnyDesk or ScreenConnect, you "authorized" the transactions or acted with gross negligence. Knowing how statutory consumer banking protections work in your jurisdiction is critical when speaking to your bank's fraud claim adjudicator.

Na United States: Iwu nnyefe ego eletrọnịkị (EFTA) na Regulation E (12 CFR § 1005)¶

Under the federal Electronic Fund Transfer Act (Regulation E), the Consumer Financial Protection Bureau (CFPB) has issued official supervisory guidance stating that: * Induced access is still an "Unauthorized Electronic Fund Transfer": Under 12 CFR § 1005.2(m), an electronic fund transfer initiated by a person who obtained access to a consumer's account through fraud or robbery is defined by law as an unauthorized EFT, even if the consumer was tricked into providing a password, a one-time passcode, or installing remote desktop software. * Negligence cannot be used to deny your claim: The CFPB's Official Interpretation of Regulation E (Comment 6(b)-2) states that consumer negligence (such as falling for a phishing pop-up or granting remote desktop access to a scammer) cannot be used by a bank to impose greater liability on the consumer than Regulation E allows ($50 maximum if reported within 2 business days; $500 maximum within 60 days). * Distinguish between Scammer-Clicked vs. Consumer-Clicked transfers: If the scammer moved the mouse and clicked "Send" behind a black screen during the AnyDesk/ScreenConnect session, it is an Unauthorized EFT covered by Regulation E. Tell the bank in writing: "I did not initiate, authorize, or click the button for this transfer; a criminal threat actor executed the transfer remotely using a Remote Access Trojan while locking my screen, which constitutes an unauthorized EFT under 12 CFR § 1005.2(m)." Attach your preserved connection_trace.txt log or Windows Event Viewer Service Control Manager logs (Event ID 7045 showing the exact minute the ScreenConnect ma ọ bụ AnyDesk service was installed) as forensic proof.

In the United Kingdom, European Union, Canada, and Australia¶

• ** United Kingdom (PSR & FOS):** If the scammer controlled your computer directly to move funds, report it as an Unauthorized Payment under the Payment Services Regulations 2017. If the scammer manipulated your screen (Inspect Element fake refund) to trick you into authorizing a Faster Payment yourself, report it under the Payment Services Regulator's (PSR) mandatory Authorized Push Payment (APP) Fraud reimbursement rules and escalate any denial to the Financial Ombudsman Service (FOS).
• European Union, Canada, and Australia: Report the incident immediately to your bank and national police, emphasizing that a remote access trojan executed or manipulated the session. Escalate unresolved bank disputes to the Ombudsman for Banking Services and Investments (OBSI) in Canada or the Australian Financial Complaints Authority (AFCA) in Australia under the ePayments Code.

Ndozigharị ihe mere mgbe ihe omume gasịrị na ndepụta nlele akụkọ¶

Complete every item in this checklist before reconnecting your home network or resuming normal online banking:

• Physical isolation confirmed: Compromised computer was physically disconnected from Ethernet and Wi-Fi before any further troubleshooting.
• Bank accounts frozen and re-numbered: All checking, savings, and HELOC account numbers that were visible on the computer have been closed and re-issued with new account numbers.
• Scheduled Bill Pay and ACH queues purged: Verified with a bank supervisor that no future-dated Bill Pay checks, external bank links (Plaid), or standing wire instructions were added during the remote session.
• Credit freezes active: Security freezes placed with Equifax, Experian, TransUnion, and ChexSystems.
• Email forwarding rules audited: Logged into Gmail/Outlook/Yahoo from a clean smartphone and checked Settings -> Forwarding and POP/IMAP and Rules / Filters for hidden rules that auto-delete or forward emails containing "Bank", "Fraud", "Wire", ma ọ bụ "Security Alert".
• Browser password vault rotated: Every password stored inside Chrome, Edge, Firefox, or Safari password managers has been changed from a clean device.
• Forensic logs saved and official reports filed: File reports with the FBI IC3 (ic3.gov) and FTC (reportfraud.ftc.gov) in the US, Action Fraud (actionfraud.police.uk) in the UK, the Canadian Anti-Fraud Centre, or Scamwatch (scamwatch.gov.au) in Australia. Also report the installer binary or connection ID to connectwise.com/company/trust/report-abuse ma ọ bụ anydesk.com/en/abuse.

Ajụjụ a na-ajụkarị¶

The scammer showed me my Windows Event Viewer and netstat in Command Prompt and it was full of thousands of warnings, errors, and "FOREIGN ADDRESS" connections. Was my computer actually hacked before I called them?¶

No. Both `eventvwr` (Windows Event Viewer) and `netstat` are normal administrative utilities built into every copy of Windows, and scammers abuse them as psychological props. Every healthy Windows computer generates thousands of routine yellow Warning and red Error logs in Event Viewer during normal boot-ups and background updates, and `netstat` lists every normal background connection your browser and operating system make to cloud servers as a "Foreign Address." Your computer was completely safe until the moment you followed the caller's instructions to download and run their remote access tool.

How did the scammer make my real bank website show that they accidentally deposited $40,000 into my checking account if they cannot hack the bank's server?¶

While connected to your computer via AnyDesk or ScreenConnect, the scammer blacks out your screen for 15 seconds, right-clicks your bank balance in your web browser, and clicks **"Inspect" (`Developer Tools`)**. This opens the local HTML text displayed in your browser tab. The scammer simply types `$45,200.00` over your real `$5,200.00` balance and adds a fake text line reading `"ACH REFUND OVERPAYMENT +$40,000.00"` on your screen. This edit exists only inside your browser tab's temporary memory (`DOM`) and vanishes the instant you refresh the page (`F5`) ma ọ bụ lelee nguzozi gị na ngwa ekwentị gị. Nhọrọ, ha na-ebufe `$40,000` site na akaụntụ nchekwa gị ma ọ bụ akara kredit gị n'ime akaụntụ nlele gị wee degharịa ihuenyo iji ghọgbuo gị n'iji ego nke aka gị na ha.

Ọ bụrụ na m wepụrụ AnyDesk ma ọ bụ UltraViewer site na Control Panel, ọ dị m mma ịgbanye Wi-Fi m azụ?¶

Usually not without inspecting Windows Services (`services.msc`) in Safe Mode first. Professional tech support scam call centers know that victims often uninstall AnyDesk or UltraViewer as soon as they hang up. Therefore, within the first two minutes of connecting to your PC, scammers routinely use silent file transfer to drop a secondary, hidden **ConnectWise ScreenConnect** (`ScreenConnect.ClientService.exe`) or **SimpleHelp** agent that does not create a desktop shortcut and hides inside `C:\Program Files (x86)\ScreenConnect Client (xxxx)`. Unless you verify in Safe Mode that no rogue `SYSTEM` ọrụ ma ọ bụ ọrụ akwadoro dị, ma ọ bụ rụọ ọrụ ihichapụ USB zuru ezu, ijikọ na Wi-Fi nwere ike inyeghachi onye na-awakpo ya njikwa PC gị ozugbo.

Onye scammer nwere ike ịnweta kọmputa ndị ọzọ ma ọ bụ smartphones na netwọk Wi-Fi nke ụlọ m naanị n'ihi na etinyere m AnyDesk na otu laptọọpụ?¶

Ịwụnye AnyDesk ma ọ bụ ScreenConnect na-emebi kọmpụta a kapịrị ọnụ ebe ị na-agba ọsọ installer, ọ bụghị ekwentị gị ma ọ bụ laptọọpụ ndị ọzọ ozugbo. Agbanyeghị, ọ bụrụ na iji ** Google Chrome, Microsoft Edge, ma ọ bụ Apple iCloud paswọọdụ na ịmekọrịta nnọkọ ** n'ofe laptọọpụ gị na ama, okwuntughe ọ bụla onye scammer na-ezu ohi ma ọ bụ gbanwee na laptọọpụ nje ahụ ga-emetụta akaụntụ igwe ojii nkekọrịta gị. Ọzọkwa, mgbe ejikọrọ na laptọọpụ gị, onye na-awakpo nwere ike ịbanye n'ime ibe admin router gị (`192.168.1.1`) if it still uses the default admin password and alter your router's `DNS` settings. After isolating the infected laptop, factory-reset your Wi-Fi router or verify its DNS settings and admin password from a clean device.

Ntuziaka emetụtara¶

• Tech na-akwado ojoro mmapụta na desktọọpụ AnyDesk/TeamViewer dịpụrụ adịpụ
• Session cookie hijacking, infostealer malware, and passkey revocation
• CAPTCHA adịgboroja ClickFix PowerShell 'Win+R' clipboard malware na nrụzi Lumma Infostealer
• Ịkwụ ụgwọ ịkwụ ụgwọ ikike ikike (APP) ngwa aghụghọ: Zelle, Venmo na ịkwụ ụgwọ ngwa ngwa na ikike nkwụghachi ụgwọ
• Bank account breach
• Nọmba mberede site na obodo

Isi mmalite na nduzi ọchịchị¶

• Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), National Security Agency (NSA), & Multi-State Information Sharing and Analysis Center (MS-ISAC) (United States): Joint Cybersecurity Advisory (AA23-025A): Protecting Against Malicious Use of Remote Monitoring and Management (RMM) Software.
• Ụlọ ọrụ nchekwa ego nke ndị ahịa (CFPB) (United States): Electronic Fund Transfers (Regulation E, 12 CFR Part 1005) Official Interpretations and FAQs on Unauthorized EFTs and Fraudulently Induced Access.
• Federal Trade Commission (FTC) (United States): How To Spot, Avoid, and Report Tech Support Scams.
• Ebe nchekwa cyber nke mba (NCSC) & Action Fraud (United Kingdom): Protecting Devices from Unauthorised Remote Access Tools and Screen-Sharing Fraud.
• ConnectWise Trust & Security Response Center: Identifying and Removing Rogue ScreenConnect (ConnectWise Control) Client Instances.