Kugera kure Trojan (ScreenConnect, AnyDesk, RustDesk, UltraViewer) uburiganya bwo gutera inkunga tekinoroji: gukurura ethernet, serivisi zica, no guhagarika banki¶

Iyo abatekamutwe bakwemereye kwinjizamo ibikoresho bya kure bya desktop cyangwa gukora umukozi wo kurebera kure kuri mudasobwa yawe, bunguka ubuzima, butagabanijwe kugenzura imbeba yawe, clavier, sisitemu ya dosiye, hamwe nibikorwa bya mushakisha bikora. Mugihe werekana umutekano wibihimbano cyangwa umwenda wirabura wirabura kuri monitor yawe, uyikoresha akuramo bucece konti yo kugenzura, asarura ijambo ryibanga ryabitswe, kandi ashyiraho serivise zihoraho zikomeza kubaho reboots zisanzwe. Aka gatabo gatanga ingamba zihuse zo guca amakuru yibitero, kurandura burundu serivisi zitagera kure zitagerwaho, no gufunga ibikorwa remezo bya banki ninguzanyo mbere yuko amafaranga asiba umuyoboro.

Kora ubu¶

1. ** Kuraho umurongo wa enterineti yose mumubiri kandi ako kanya. Ntugatakaze umwanya ugerageza kurwanya abashuka kugenzura imbeba indanga kugirango ukande buto yo guhagarika.
2. ** Hagarika-guhagarika mudasobwa yangiritse niba ecran yijimye. ** Niba uwagabye igitero yarashoboje "Blank Guest Monitor" cyangwa agafunga clavier yawe, kanda kandi ufate buto ya power ya mudasobwa kumasegonda 10 yuzuye kugeza imashini izimye burundu. Kureka bigashiramo ingufu mugihe ubitse konti yimari yawe kubikoresho bitandukanye, bisukuye.
3. ** Hamagara ishami ry’uburiganya rya banki yawe kuri terefone yigenga. reba nimero yihutirwa kubitumanaho mpuzamahanga. Tegeka banki gushyira ibicuruzwa byihuse kuri konti zose, kuzigama, no kumurongo-w'inguzanyo, hanyuma usabe ko byihutirwa byihutirwa kuri Automated Clearing House (ACH), insinga, cyangwa amafaranga yoherejwe mugihe gikwiye.
4. ** Kuraho kuki ikora kandi uhindure ijambo ryibanga ukoresheje terefone isukuye. Kurangiza ibikorwa byose byinjira byinjira, kuvanaho ibikoresho bitamenyekana Multi-Factor Authentication (MFA), hanyuma uzenguruke ijambo ryibanga.
5. ** Hindura mudasobwa yanduye muburyo bwizewe udafite umuyoboro.ScreenConnect Client, AnyDesk Service, RustDesk Service) mbere yuko sisitemu y'imikorere itwara igice cya gatatu cyumushoferi.

Sobanukirwa na anatomy yubucuruzi RMM nubucuruzi bwa kure kuri desktop¶

Uburiganya bwa tekiniki bugezweho, uburiganya bwo gusubizwa, hamwe nibitero byigana banki ntibikunze gushingira kuri virusi ya mudasobwa yanditse. Ahubwo, abakora iterabwoba bakoresha nabi amategeko, yashyizweho umukono na Monitoring Monitoring and Management (RMM) software hamwe nibikoresho byubucuruzi bya kure. Kuberako aba bayobozi bitwaje kode yemewe yo gusinya ibyemezo byabashoramari bizewe, porogaramu zisanzwe za antivirus nka Windows Defender cyangwa macOS XProtect ntibibuza kwishyiriraho.

Ukuntu abateye bitwaje intwaro zemewe za kure¶

Iyo uwahohotewe ahamagaye nimero itishyurwa yerekanwe kuri mushakisha yimpimbano igaragara, agasubiza imeri ya fagitire yihutirwa, cyangwa agakurikiza amabwiriza yatanzwe niperereza ryibinyoma rya banki, uyikoresha abategeka gukuramo porogaramu ikora cyangwa MSI. Ihohoterwa rikoreshwa cyane harimo:

• ** ConnectWise ScreenConnect (yahoze igenzura): ** Akenshi yoherejwe hakoreshejwe uburyo bwihariye .msi cyangwa .exe paki yakiriwe kuri seriveri igenzurwa. Iyo bimaze gukorwa, ishyiraho nka serivisi ya Windows idahoraho (ScreenConnect Client (xxxx)) kwiruka hamwe NT AUTHORITY\SYSTEM amahirwe, gutanga uburenganzira bwo guceceka, kutitabwaho igihe cyose mudasobwa iri kumurongo.
• ** Icyaricyo cyose (anydesk.exe): ** Bikunze gukoreshwa muburiganya bwambukiranya porogaramu yibasira Windows, macOS, nibikoresho bigendanwa. Abagabye igitero bategeka uwahohotewe gusoma mu ijwi riranguruye imibare 9 ya aderesi ya AnyDesk, bagasaba kuzamurwa mu buyobozi, bagashyiraho "Ijambobanga ryinjira" ritongera guhura mu gihe uwahohotewe asinziriye.
• ** RustDesk (rustdesk.exe).
• ** UltraViewer, TeamViewer, Zoho Ifasha, na SimpleHelp: ** Mubisanzwe umunyururu hamwe. Abatekamutwe bahuza binyuze muri UltraViewer cyangwa AnyDesk bazahita bashiraho bucece ScreenConnect cyangwa SimpleHelp ipaki inyuma nkinyuma yinyuma.

Ibikorwa byihutirwa: gutandukanya ihuriro no kwangiza ibyangiritse¶

Koresha ibikorwa bikurikira bikurikira kugirango uhagarike ibikorwa bya kure bikora, gutandukanya aho ukorera, hanyuma umenye niba imashini ishobora gusukurwa muburyo bwizewe cyangwa bisaba guhanagura sisitemu yuzuye.

flowchart TD
    A["Igikorwa Cyakera Cyanyuma Kugera Kuriganya Byaragaragaye"] --> B["Kuramo insinga ya Ethernet Cable na Power Off Wi-Fi Router"]
    B --> C{"Mugaragaza Yirabura cyangwa Imbeba Ifunze?"}
    C -- "Yego" --> D["Fata PC Ifatika Yumubiri Button kumasegonda 10 kugirango uhagarike"]
    C -- "Oya" --> E["Switch Airplane Mode ON and Shut Down PC Normally"]
    D --> F["Use Clean Smartphone on Cellular Data to Call Bank Fraud Dept"]
    E --> F
    F --> G["Freeze Checking/Savings, Recall Wires/Zelle, Lock Credit Bureaus"]
    G --> H["From Clean Smartphone: Rotate Email/Bank Passwords & Kill Sessions"]
    H --> I{"Did Scammer Have Unattended Access or Run CMD/PowerShell?"}
    I -- "Yes (High Risk)" --> J["Boot PC Offline into Safe Mode to Rescue Personal Docs Only"]
    I -- "No (Brief Supervised Session)" --> K["Boot Offline into Safe Mode to Purge RMM Services and Certs"]
    J --> L["Perform Full Clean OS Reinstall via USB Media From Clean PC"]
    K --> M["Remove Services, Scheduled Tasks, AppData, and Audit Browser Extensions"]

Comparison of remote access tools abused by scammers¶

Mbere yo kugerageza koza imashini cyangwa kumenyesha ibyabaye itsinda ryanyu ryuburiganya bwa banki yawe, menya ibikoresho (ibikoresho) byashyizweho. Wibuke ko abatekamutwe basanzwe bashiraho ibikoresho bibiri cyangwa bitatu bitandukanye mugihe kimwe kugirango mugihe ukuyemo igishushanyo cya desktop igaragara, serivise yabo yihishe ikomeza gukora.

Step-by-step banking and financial triage (First 30 minutes)¶

In a remote access scam, the computer infection is only the delivery mechanism; the primary emergency is acute financial theft. Attackers use psychological and technical tricks, such as editing the HTML source code (Inspect Element) of your bank's webpage to simulate an accidental $40,000 overpayment instead of $400, to trick you into wiring money, buying gift cards, or depositing cash into a Bitcoin ATM. Even if you refused to send money, an attacker with remote access can initiate transfers directly while your screen is blacked out.

1. Place an immediate hard freeze and initiate transfer recalls¶

Call your financial institution's dedicated fraud department immediately using a clean phone. State clearly: "My computer was compromised by a remote access trojan during a tech support/bank impersonation scam. An unauthorized party had live access to my online banking session." Demand the following specific actions:

• Online Banking Profile Lockout: Have the bank disable your online and mobile banking login credentials entirely and invalidate all active OAuth tokens and session cookies.
• ACH, Wire, and RTP Recall (SWIFT / Fedwire / Faster Payments): Ask the representative to inspect your account for any pending or queued outbound Automated Clearing House (ACH) transfers, domestic/international wire transfers, Zelle / Venmo payments, or "Bill Pay" checks scheduled for future dates. Scammers often schedule a Bill Pay check or post-dated ACH transfer set to execute 3 to 5 days later hoping you will not notice.
• ** Gusimbuza nimero ya konti: ** Kuberako uwaguteye ashobora kuba yararebye inzira zawe zose hamwe no kugenzura nimero za konti (cyangwa gukuramo impapuro za banki ya PDF kuri mushakisha yawe), guhagarika ikarita yo kubikuza byonyine ntibihagije. Ugomba gusaba ko banki ifunga nimero ya konti yangiritse kandi ugahindura amafaranga yawe muri nimero nshya ya konti hamwe na "Post No Deniits" (PND) imipaka kuri konti zishaje.
• ** Reba kubyoherejwe byihishe imbere cyangwa amafaranga avansi: ** Abagizi ba nabi bakunze gufata avance yikarita yawe yinguzanyo cyangwa Home Equity Line of Credit (HELOC) hanyuma ubyohereze kuri konte yawe yo kugenzura mbere, haba kugirango wizere ko "bagusubije kubwimpanuka" wowe, cyangwa guhuriza hamwe ibintu byinshi mbere yo kwishura amafaranga asigaye hanze. Bwira inzobere mu buriganya bwa banki gusuzuma niba hari amafaranga yoherejwe muri banki yabaye hagati yo kuzigama, ikarita y'inguzanyo, cyangwa konti yawe.

2. Hagarika ibiro byinguzanyo hanyuma urebe ibyifuzo bishya byinguzanyo¶

Mugihe uhujwe na PC yawe, abatekamutwe bashakisha buri gihe Downloads cyangwa Documents ububiko bwijambo ryibanze nka tax, 1040, W2, passport, license, cyangwa password hanyuma ugaragaze imenyekanisha ryimisoro hamwe na scan ya ID.

1. Shira ubuntu ** Umutekano Freeze ** mubiro byose byinguzanyo uhita ukoresha terefone yawe isukuye:
2. ** Muri Amerika: ** Gukonjesha ** Equifax ** (1-888-298-0045), Experian (1-888-397-3742), TransUnion (1-800-916-8800), and ChexSystems (1-800-428-9687).
3. In the United Kingdom: Contact Experian, Equifax, and TransUnion, and register for Cifas Protective Registration.
4. In Canada: Place credit freezes or fraud alerts with Equifax Canada and TransUnion Canada.
5. In Australia: Request a credit ban through Equifax, Illion, and Experian.
6. Review your credit report immediately for hard inquiries made in the last 24 hours; scammers often apply for instant online personal loans in a background browser tab while talking to you.

Eradicating remote access services in Safe Mode (Windows and macOS)¶

If you decide to inspect the machine, preserve forensic logs for law enforcement, or rescue irreplaceable personal photos before wiping the hard drive, never boot the computer into normal mode while connected to the internet. The moment a normal boot completes with Wi-Fi active, a persistent ScreenConnect cyangwa AnyDesk service will phone home to the scammer's console and alert them that your machine is back online.

Phase 1: Booting into Safe Mode Without Networking¶

On Windows 10 and Windows 11¶

1. Make sure the Ethernet cable is unplugged and your home Wi-Fi router is unplugged or Airplane Mode is active.
2. Power on the PC. At the Windows sign-in screen, hold down the Left Shift key while clicking Power -> Restart.
3. On the blue recovery screen, select Troubleshoot -> Advanced options -> Startup Settings -> Restart.
4. When the startup options list appears, press 4 or F4 (Enable Safe Mode). Do not press 5 (Safe Mode with Networking).

On macOS (Apple Silicon and Intel)¶

1. Turn off the Mac and turn off your Wi-Fi router.
2. Apple Silicon (M1/M2/M3/M4): Hold the Power button until "Loading startup options" appears. Select your startup disk, hold Shift, and click Continue in Safe Mode.
3. Intel Mac: Turn on the Mac and immediately hold the Shift key until the login window appears.

Phase 2: Hunting and terminating persistent Windows Services¶

Standard uninstallation via "Add or Remove Programs" often fails to remove customized ScreenConnect MSI builds because attackers strip the uninstaller entry from the Windows Registry or deploy multiple instances under randomized hexadecimal service names.

1. In Windows Safe Mode, press Win + R, type services.msc, and press Enter.
2. Click the Name column to sort alphabetically, and carefully inspect every service for the following names:
3. ScreenConnect Client (xxxxxxxxxxxxxxxx) (Note: There may be two or three separate ScreenConnect Client entries with different 16-character alphanumeric strings in parentheses, where each represents a different scammer server).
4. AnyDesk Service
5. RustDesk Service
6. UltraViewerService
7. TeamViewer
8. Zoho Assist - Unattended Agent cyangwa SimpleHelp Remote Access
9. Kuri buri serivisi iteye inkeke ubonye, ​​kanda iburyo hanyuma uhitemo ** Ibyiza **.
10. Soma Inzira ** kugirango ikorwe ** umurima witonze hanyuma wandike (urugero, C:\Program Files (x86)\ScreenConnect Client (a1b2c3d4e5f6g7h8)\ScreenConnect.ClientService.exe).
11. Hindura ubwoko bwa ** Gutangira ** kumanuka kuri ** Abamugaye **, kanda ** Hagarika ** (niba ukora), hanyuma ukande ** Shyira ** na ** OK **.
12. Ibikurikira, fungura itegeko ryashyizwe hejuru ()Win + X -> ** Terminal (Admin) ** cyangwa ** Amabwiriza Yihutirwa (Admin) **) hanyuma usibe burundu kwiyandikisha kwa serivise ukoresheje izina rya serivisi ryanditse kurutonde rwumutungo:

sc stop "AnyDesk"
sc delete "AnyDesk"
sc stop "RustDesk"
sc delete "RustDesk"
sc stop "UltraViewerService"
sc delete "UltraViewerService"

For ScreenConnect, query all installed instances and delete each one by its exact service key name:

sc query state= all | findstr /I "ScreenConnect"
sc delete "ScreenConnect Client (a1b2c3d4e5f6g7h8)"

Icyiciro cya 3: Gukuraho Ibikorwa Byateganijwe, Ububiko bwo Gutangiza, nububiko bwihishe¶

Even after a Windows Service is deleted, attackers often configure a scheduled task that re-downloads the remote agent via powershell.exe cyangwa mshta.exe every time a user logs in.

1. Press Win + R, type taskschd.msc, and press Enter to open Task Scheduler.
2. Click Task Scheduler Library in the left pane. Expand every subfolder and inspect the Actions tab of each scheduled task. Delete any task that launches binaries from C:\Users\<User>\AppData\, C:\ProgramData\, or invokes curl, bitsadmin, powershell -WindowStyle Hidden, or any remote desktop executable.
3. Press Win + R, type shell:startup, and press Enter. Delete any shortcuts or .bat / .vbs scripts placed in your user Startup folder. Repeat this by typing shell:common startup to inspect the system-wide Startup folder.
4. Enable viewing hidden files in File Explorer (View -> Show -> Hidden items) and manually delete the application directories and configuration caches for all remote tools:
5. C:\Program Files (x86)\ScreenConnect Client (*)
6. C:\ProgramData\ScreenConnect Client (*)
7. C:\Program Files (x86)\AnyDesk\ na C:\ProgramData\AnyDesk\
8. C:\Users\<YourUsername>\AppData\Roaming\AnyDesk\
9. C:\Program Files\RustDesk\ na C:\Users\<YourUsername>\AppData\Roaming\RustDesk\
10. C:\Program Files (x86)\UltraViewer\ na C:\Users\<YourUsername>\AppData\Roaming\UltraViewer\

Phase 4: Removing macOS LaunchDaemons, LaunchAgents, and Privacy Grants¶

On macOS, remote access tools establish persistence through LaunchDaemons (system-wide) and LaunchAgents (user-level), combined with macOS TCC (Transparency, Consent, and Control) permissions for Screen Recording and Accessibility.

1. While in macOS Safe Mode (offline), open Finder, press Cmd + Shift + G (Go to Folder), and inspect the following three directories one by one:
2. /Library/LaunchDaemons/
3. /Library/LaunchAgents/
4. /Users/<YourUsername>/Library/LaunchAgents/
5. Drag any .plist files containing connectwise, screenconnect, anydesk, rustdesk, teamviewer, zoho, cyangwa simplehelp to the Trash.
6. Next, open /Applications/ na /Library/Application Support/ and move any corresponding remote access app bundles and support folders to the Trash.
7. Open System Settings -> Privacy & Security. Check two critical sections:
8. Screen & System Audio Recording: Select any remote support tool listed and click the minus (-) button to revoke its ability to view your display.
9. Accessibility: Select any remote support tool and click the minus (-) button to revoke its ability to control your mouse cursor and synthesize keystrokes.
10. Full Disk Access: Verify that no unknown application or terminal wrapper has been granted Full Disk Access.

Guhindura ijambo ryibanga rya Windows hamwe na banneri ya boot¶

Before disconnecting, vindictive scammers frequently lock victims out of their computers and demand a ransom for the password. They use three primary methods:

1. Guhindura ijambo ryibanga rya Windows ryaho (net user) or adding a rogue admin account¶

While their screen curtain is active, scammers often open an elevated Command Prompt and run net user <YourUsername> <NewPassword> or create a backdoor administrator account (net user SupportAdmin Pass123 /add && net localgroup administrators SupportAdmin /add). * How to check and fix: In Safe Mode, open an elevated Command Prompt (cmd.exe as Administrator) and type net user. If you see an unfamiliar account, delete it immediately with net user <RogueAccountName> /delete. If your local password was changed, boot from a Windows Installation USB into the Windows Recovery Environment (WinRE) to restore a prior System Restore Point, or sign in with your linked Microsoft Account after resetting your password on a clean smartphone.

2. Enabling a startup message banner via Registry (LegalNoticeCaption)¶

Scammers often modify HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System by setting LegalNoticeCaption na LegalNoticeText to display a fake Microsoft Security lockout phone number before login. * How to fix: This is purely a cosmetic text screen before the normal Windows login prompt. Click OK or press Enter to bypass it, open regedit in Safe Mode, go to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System, and clear the text inside LegalNoticeCaption na LegalNoticeText.

3. Safe Boot PIN lockouts (bcdedit)¶

Microsoft removed the legacy syskey.exe tool in Windows 10 version 1709. Today, scammers instead tick Safe boot inside msconfig and reboot your PC offline. Because Windows Hello PINs often fail on the Safe Mode login screen without network access, victims get trapped in a boot loop. * How to fix: Hold Shift + Restart at the login screen, select Troubleshoot -> Advanced options -> Command Prompt, and run:

bcdedit /deletevalue {current} safeboot

Restart the computer normally (keeping your internet router unplugged) so you can log in with your cached password or PIN and remove the remote software.

Why browser session theft and infostealers require a full OS wipe¶

Even if you delete the ScreenConnect, AnyDesk, cyangwa RustDesk services in Safe Mode, you must evaluate whether the scammer deployed a secondary Infostealer (Lumma, RedLine, Vidar, Stealc) or copied your browser profile directory.

During an unattended remote session, it takes less than 8 seconds for an attacker to run a PowerShell script that copies your Google Chrome, Microsoft Edge, or Brave user data directory (C:\Users\<User>\AppData\Local\Google\Chrome\User Data\Default\) along with the local DPAPI master decryption key. With those files on their server, the attacker possesses:

1. Every password saved in your web browser's built-in password manager.
2. Active session cookies (Cookies na Network\Cookies SQLite databases): Even if your email or bank uses two-factor authentication (2FA), possessing your decrypted session token cookie allows the attacker to import your browser profile into an antidetect browser on their machine and access your Gmail, Outlook, Amazon, or cryptocurrency exchange account without needing a password or 2FA code.
3. Browser-based cryptocurrency wallet vaults (MetaMask, Phantom, Rabby): Encrypted vault files inside Local Extension Settings are exfiltrated for offline brute-forcing.

Mugihe ugomba gukora sisitemu ikora ya USB isukuye¶

Mugihe gukuraho serivise ya Safe Mode birahagije niba wafashe abashuka mumasegonda 10 nyuma yo kwishyiriraho AnyDesk kandi ntiwigeze ubaha hejuru ya Administrateri cyangwa kwinjira bitagenzuwe, ** ugomba guhanagura disiki hanyuma ugakora OS isukuye kuri USB inkoni ** niba hari kimwe muri ibi bikurikira:

• Mugaragaza yawe yirabura (Blank Guest Monitor) cyangwa imbeba / clavier yawe yari ifunze.
• Wabonye itegeko ryihuta (cmd.exe) or PowerShell window flash on the screen.
• You left the computer unattended while the scammer ran a fake security scan.
• You installed ConnectWise ScreenConnect (which runs as SYSTEM Mburabuzi kandi yemerera imbonankubone igaragara yinyandiko yerekana).

Kugirango ukore neza: 1. Mugihe utari kumurongo muburyo bwizewe, shyiramo USB flash ya disiki nshya muri PC yangiritse hanyuma ukoporora ** gusa dosiye yamakuru yihariye ** (.jpg, .pdf, .docx, .xlsx, amashusho yumuryango). ** Ntukigere wandukura .exe, .msi, .bat, .ps1, cyangwa mushakisha ububiko bwububiko. ** 2. Ukoresheje ** mudasobwa itandukanye, isukuye **, kura igikoresho cyemewe cya Windows Media Media cyo gukora muri Microsoft (microsoft.com/software-download) cyangwa gukora bootable ya macOS. 3. Boot the compromised PC from the clean USB installer, delete all existing partitions on the primary drive (Drive 0), and install a fresh copy of the operating system.

Preserving your legal right to bank reimbursement¶

Banks frequently attempt to deny fraud reimbursement claims in remote access scams by arguing that because you clicked "Download" on AnyDesk or ScreenConnect, you "authorized" the transactions or acted with gross negligence. Knowing how statutory consumer banking protections work in your jurisdiction is critical when speaking to your bank's fraud claim adjudicator.

In the United States: Electronic Fund Transfer Act (EFTA) na Regulation E (12 CFR § 1005)¶

Under the federal Electronic Fund Transfer Act (Regulation E), the Consumer Financial Protection Bureau (CFPB) has issued official supervisory guidance stating that: * Induced access is still an "Unauthorized Electronic Fund Transfer": Under 12 CFR § 1005.2(m), an electronic fund transfer initiated by a person who obtained access to a consumer's account through fraud or robbery is defined by law as an unauthorized EFT, even if the consumer was tricked into providing a password, a one-time passcode, or installing remote desktop software. * Negligence cannot be used to deny your claim: The CFPB's Official Interpretation of Regulation E (Comment 6(b)-2) states that consumer negligence (such as falling for a phishing pop-up or granting remote desktop access to a scammer) cannot be used by a bank to impose greater liability on the consumer than Regulation E allows ($50 maximum if reported within 2 business days; $500 maximum within 60 days). * Distinguish between Scammer-Clicked vs. Consumer-Clicked transfers: If the scammer moved the mouse and clicked "Send" behind a black screen during the AnyDesk/ScreenConnect session, it is an Unauthorized EFT covered by Regulation E. Tell the bank in writing: "I did not initiate, authorize, or click the button for this transfer; a criminal threat actor executed the transfer remotely using a Remote Access Trojan while locking my screen, which constitutes an unauthorized EFT under 12 CFR § 1005.2(m)." Attach your preserved connection_trace.txt log or Windows Event Viewer Service Control Manager logs (Event ID 7045 showing the exact minute the ScreenConnect cyangwa AnyDesk service was installed) as forensic proof.

In the United Kingdom, European Union, Canada, and Australia¶

• United Kingdom (PSR & FOS): If the scammer controlled your computer directly to move funds, report it as an Unauthorized Payment under the Payment Services Regulations 2017. If the scammer manipulated your screen (Inspect Element fake refund) to trick you into authorizing a Faster Payment yourself, report it under the Payment Services Regulator's (PSR) mandatory Authorized Push Payment (APP) Fraud reimbursement rules and escalate any denial to the **Financial Ombudsman Service (FOS) **.
• European Union, Canada, and Australia: Report the incident immediately to your bank and national police, emphasizing that a remote access trojan executed or manipulated the session. Escalate unresolved bank disputes to the Ombudsman for Banking Services and Investments (OBSI) in Canada or the Australian Financial Complaints Authority (AFCA) in Australia under the ePayments Code.

Post-incident remediation and reporting checklist¶

Complete every item in this checklist before reconnecting your home network or resuming normal online banking:

• Physical isolation confirmed: Compromised computer was physically disconnected from Ethernet and Wi-Fi before any further troubleshooting.
• Bank accounts frozen and re-numbered: All checking, savings, and HELOC account numbers that were visible on the computer have been closed and re-issued with new account numbers.
• Scheduled Bill Pay and ACH queues purged: Verified with a bank supervisor that no future-dated Bill Pay checks, external bank links (Plaid), or standing wire instructions were added during the remote session.
• Credit freezes active: Security freezes placed with Equifax, Experian, TransUnion, and ChexSystems.
• Email forwarding rules audited: Logged into Gmail/Outlook/Yahoo from a clean smartphone and checked Settings -> Forwarding and POP/IMAP and Rules / Filters for hidden rules that auto-delete or forward emails containing "Bank", "Fraud", "Wire", cyangwa "Security Alert".
• Browser password vault rotated: Every password stored inside Chrome, Edge, Firefox, or Safari password managers has been changed from a clean device.
• Forensic logs saved and official reports filed: File reports with the FBI IC3 (ic3.gov) and FTC (reportfraud.ftc.gov) in the US, Action Fraud (actionfraud.police.uk) in the UK, the Canadian Anti-Fraud Centre, or Scamwatch (scamwatch.gov.au) in Australia. Also report the installer binary or connection ID to connectwise.com/company/trust/report-abuse cyangwa anydesk.com/en/abuse.

Ibibazo bikunze kubazwa¶

The scammer showed me my Windows Event Viewer and netstat muri Command Prompt kandi yari yuzuyemo ibihumbi n'ibihumbi byo kuburira, amakosa, hamwe na "IJAMBO RY'AMAHANGA". Mudasobwa yanjye yaba yaribwe mbere yuko mbahamagara?¶

Oya. Byombi `eventvwr` (Windows Ibireba Windows) na `netstat` nibikorwa bisanzwe byubuyobozi byubatswe muri buri kopi ya Windows, kandi abatekamutwe babakoresha nabi nkibitekerezo bya psychologiya. Buri mudasobwa nzima ya Windows itanga ibihumbi byumuhondo bisanzwe Kuburira no gutukura Ikosa ritukura muri Event Viewer mugihe gisanzwe cya boot-up hamwe namakuru agezweho, kandi `netstat` urutonde buri kintu gisanzwe gihuza mushakisha yawe na sisitemu y'imikorere ikora kuri seriveri ya seriveri nka "Aderesi Yamahanga." Mudasobwa yawe yari ifite umutekano rwose kugeza igihe ukurikiranye amabwiriza yo guhamagara gukuramo no gukoresha ibikoresho byabo bya kure.

Nigute abatekamutwe bakoze urubuga rwanjye rwa banki rwerekana ko babitsa kubwimpanuka $40,000 muri konti yanjye yo kugenzura niba badashobora kwiba seriveri ya banki?¶

Mugihe uhujwe na mudasobwa yawe ukoresheje AnyDesk cyangwa ScreenConnect, umutekamutwe yirabura ecran yawe kumasegonda 15, kanda iburyo-kanda banki yawe muri mushakisha y'urubuga, hanyuma ukande ** "Kugenzura" (`Developer Tools`) **. Ibi bifungura inyandiko ya HTML yaho igaragara muri tab ya mushakisha yawe. Abatekamutwe bandika gusa `$45,200.00` hejuru yukuri `$5,200.00` kuringaniza no kongeramo inyandiko yibinyoma gusoma `"ACH REFUND OVERPAYMENT +$40,000.00"` Kuri Mugaragaza. Ihindura ribaho gusa imbere ya mushakisha yawe ya memoire yigihe gito (`DOM`) hanyuma ikabura ako kanya uhindura page (`F5`) cyangwa urebe uburinganire bwawe kuri porogaramu ya terefone yawe. Ubundi, barimura `$40,000` uhereye kuri konte yawe yo kuzigama cyangwa umurongo winguzanyo muri konte yawe yo kugenzura hanyuma uhindure ecran kugirango ugushuke kugirango ubone amafaranga yawe kuri bo.

Niba narangije gukuramo AnyDesk cyangwa UltraViewer muri Panel Igenzura, Mfite umutekano wo gusubiza Wi-Fi yanjye inyuma?¶

Mubisanzwe ntabwo utabanje kugenzura serivisi za Windows (`services.msc`) muri Mode Yambere. Ubuhanga bwubuhanga bwubuhanga bwo guhamagarira ibigo byita kubimenyesha ko abahohotewe akenshi bakuramo AnyDesk cyangwa UltraViewer bakimara kumanika. Kubwibyo, muminota ibiri yambere yo guhuza PC yawe, abatekamutwe basanzwe bakoresha ihererekanyabubasha rya fayili kugirango bajugunye icyiciro cya kabiri, cyihishe ** ConnectWise ScreenConnect ** (`ScreenConnect.ClientService.exe`) cyangwa ** SimpleHelp ** umukozi udakora shortcut ya desktop kandi yihishe imbere `C:\Program Files (x86)\ScreenConnect Client (xxxx)`. Keretse niba ugenzuye muburyo bwizewe ko nta kigoryi `SYSTEM` serivisi cyangwa imirimo iteganijwe irahari, cyangwa gukora USB OS yose yohanagura, kongera guhuza Wi-Fi birashobora guhita bigenzura PC yawe igasubira kubatera.

Umushukanyi arashobora kubona izindi mudasobwa cyangwa terefone zigendanwa murugo rwanjye Wi-Fi kubera gusa ko nashyizeho AnyDesk kuri mudasobwa imwe?¶

Kwinjiza AnyDesk cyangwa ScreenConnect ibangamira mudasobwa yihariye aho wakoresheje ushyiraho, ntabwo terefone yawe cyangwa izindi mudasobwa zigendanwa. Ariko, niba ukoresheje ** Google Chrome, Microsoft Edge, cyangwa Apple iCloud ijambo ryibanga hamwe na sessisiyo ihuza ** kuri mudasobwa igendanwa na terefone yawe, ijambo ryibanga iryo ari ryo ryose abashuka bibye cyangwa impinduka kuri mudasobwa igendanwa yanduye bizagira ingaruka kuri konti yawe isanganywe. Na none, mugihe uhujwe na mudasobwa igendanwa, uwagabye igitero arashobora kwinjira murugo rwa page ya admin ya router (`192.168.1.1`) niba ikomeje gukoresha ijambo ryibanga rya admin risanzwe kandi rihindura router yawe `DNS` Igenamiterere. Nyuma yo gutandukanya mudasobwa igendanwa yanduye, shyira uruganda rwa Wi-Fi cyangwa ugenzure igenamiterere rya DNS hamwe nijambobanga rya admin bivuye mubikoresho bisukuye.

Kuyobora¶

• Tech support pop-up scam and remote desktop AnyDesk/TeamViewer removal
• Isomo rya kuki yibye, infostealer malware, hamwe no gukuraho passkey
• Fake CAPTCHA ClickFix PowerShell Win+R clipboard malware and Lumma Infostealer remediation
• Authorized push payment (APP) app fraud: Zelle, Venmo, and Faster Payments impersonation and reimbursement rights
• Kutubahiriza konti ya banki
• Imibare yihutirwa ukurikije igihugu

Inkomoko nubuyobozi¶

• Ikigo gishinzwe umutekano n’ibikorwa remezo (CISA), Biro ishinzwe iperereza (FBI), Ikigo cy'igihugu gishinzwe umutekano (NSA), & Multi-State Amakuru Gusangira no Gusesengura Ikigo (MS-ISAC) (Amerika): * Umujyanama uhuriweho n'umutekano wa interineti (AA23-025A): Kurinda Gukoresha nabi Gukurikirana no gucunga kure (RMM) Porogaramu *.
• Ibiro bishinzwe kurengera umutungo w’abaguzi (CFPB) (Amerika): * Kohereza Ikigega cya elegitoroniki (Regulation E, 12 CFR Part 1005) Ibisobanuro byemewe nibibazo kuri EFT itabifitiye uburenganzira no kwinjira muburiganya *.
• Federal Trade Commission (FTC).
• Ikigo cy'igihugu gishinzwe umutekano wa cyber (NCSC.
• ConnectWise Icyizere & Umutekano Igisubizo: * Kumenya no Gukuraho Rogue ScreenConnect (ConnectWise Control) Abakiriya *.