Remote access trojan (ScreenConnect, AnyDesk, RustDesk, UltraViewer) tech support scam: pulling ethernet, killing services, and bank freeze¶

When a scammer convinces you to install a remote desktop tool or executes a remote monitoring agent on your computer, they gain live, unrestricted control over your mouse, keyboard, file system, and active browser sessions. While displaying a fake security scan or a black privacy curtain on your monitor, the operator silently drains checking accounts, harvests saved passwords, and installs persistent background services that survive standard reboots. This guide provides immediate steps to sever the attacker's data link, permanently eradicate unattended remote access services, and lock down your banking and credit infrastructure before funds clear the wire network.

Naredi to zdaj¶

1. Fizično in takoj prekinite vse internetne povezave. Odklopite ethernetni kabel z zadnje strani namizja ali usmerjevalnika, obrnite fizično stikalo Wi-Fi na prenosniku ali pritisnite in držite gumb za vklop na usmerjevalniku Wi-Fi 10 sekund, dokler ne ugasnejo vse lučke. Ne izgubljajte časa, ko se poskušate boriti s prevarantom za nadzor nad kazalcem miške, da kliknete gumb za prekinitev povezave.
2. Prisilno zaustavite ogroženi računalnik, če je zaslon zatemnjen. Če je napadalec omogočil »Blank Guest Monitor« ali zaklenil vaš vnos s tipkovnico, pritisnite in držite fizični gumb za vklop računalnika 10 polnih sekund, dokler se stroj popolnoma ne izklopi. Pustite ga izklopljenega, medtem ko zavarujete svoje finančne račune z ločene, čiste naprave.
3. Pokličite oddelek vaše banke za goljufije z neodvisnega telefona. Uporabite mobilni telefon, da pokličete uradno številko, natisnjeno na zadnji strani vaše debetne ali kreditne kartice, ali pokličite svojo lokalno številko za klic v sili (911 v Združenih državah in Kanadi, 112 po vsej Evropski uniji, 999 v Združenem kraljestvu), če obstaja aktivna grožnja z izsiljevanjem; glej številke za klic v sili za mednarodne stike. Naročite banki, naj takoj močno zamrzne vse čekovne, varčevalne in kreditne račune ter zahteva nujni odpoklic za vse čakajoče avtomatizirane klirinške hiše (ACH), nakazila ali plačila v realnem času.
4. Prekličite piškotke aktivne seje in spremenite gesla s čistega pametnega telefona. S telefonom na mobilnih podatkih (brez povezave z domačim Wi-Fi, če je ogroženi računalnik znova vklopljen), se prijavite v svojo primarno e-pošto, bančne portale in račune za shranjevanje v oblaku. Prekinite vse aktivne seje prijave, prekličite neprepoznane naprave za večfaktorsko avtentikacijo (MFA) in zamenjajte svoja gesla.
5. Zaženite okuženi računalnik v varnem načinu brez povezovanja v omrežje. Ogroženi računalnik znova vklopite samo, ko ni povezan z internetom, vstopite v varen način Windows ali varen način macOS, da pregledate in odstranite nenadzorovane storitve v ozadju (ScreenConnect Client, AnyDesk Service, RustDesk Service), preden operacijski sistem naloži omrežne gonilnike drugih proizvajalcev.

Razumevanje anatomije komercialnega RMM in napada na oddaljeno namizje¶

Sodobne goljufije s tehnično podporo, goljufije z vračili denarja in napadi z lažnim predstavljanjem bank se le redko zanašajo na po meri napisane računalniške viruse. Namesto tega akterji groženj zlorabljajo zakonito, digitalno podpisano oddaljeno spremljanje in upravljanje (RMM) programska oprema in komercialna orodja za oddaljeno namizje. Ker te izvršljive datoteke vsebujejo veljavna potrdila za podpisovanje kriptografske kode zaupanja vrednih prodajalcev programske opreme, standardni protivirusni programi, kot sta Windows Defender ali macOS XProtect, ne blokirajo njihove namestitve.

Kako napadalci oborožijo zakonite binarne datoteke za oddaljeno podporo¶

Ko žrtev pokliče brezplačno številko, prikazano v lažnem pojavnem oknu brskalnika, odgovori na e-poštno sporočilo z nujnim računom ali sledi navodilom lažnega preiskovalca bančnih goljufij, ji operater naroči, naj prenese izvršljivo datoteko ali namestitveni program MSI. Najbolj zlorabljene platforme vključujejo:

• ConnectWise ScreenConnect (prej Control): Pogosto uveden prek prilagojenega .msi oz .exe paket gostuje na strežniku, ki ga nadzoruje napadalec. Ko se izvede, se namesti kot obstojna sistemska storitev Windows (ScreenConnect Client (xxxx)) tek z NT AUTHORITY\SYSTEM privilegije, ki omogočajo tihi, nenadzorovan dostop, ko je računalnik povezan.
• AnyDesk (anydesk.exe): Pogosto se uporablja pri prevarah na več platformah, ki ciljajo na Windows, macOS in mobilne naprave. Napadalci ukažejo žrtvi, naj na glas prebere 9-mestni naslov AnyDesk, zahteva administrativno povišanje in nastavi »Geslo za nenadzorovan dostop«, da se znova poveže, medtem ko žrtev spi.
• RustDesk (rustdesk.exe): Odprtokodno orodje za oddaljeno namizje, ki je priljubljeno pri prevarantskih sindikatih, ker lahko sami gostijo posredniške strežnike in se izognejo odstranitvi zaradi zlorabe prodajalca.
• UltraViewer, TeamViewer, Zoho Assist in SimpleHelp: Običajno povezani skupaj. Prevarant, ki se poveže prek UltraViewerja ali AnyDeska, bo pogosto tiho namestil skrito ScreenConnect oz SimpleHelp paket v ozadju kot rezervna stranska vrata.

Potek dela v nujnih primerih: prekinitev povezave in triagiranje poškodb¶

Uporabite naslednji diagram poteka delovanja, da zaustavite aktivno oddaljeno sejo, izolirate delovno postajo in ugotovite, ali je stroj mogoče očistiti v varnem načinu ali zahteva popolno brisanje operacijskega sistema.

flowchart TD
    A["Zaznana prevara z aktivnim ali nedavnim oddaljenim dostopom"] --> B["Fizično odklopite ethernetni kabel in izklopite Wi-Fi usmerjevalnik"]
    B --> C{"Je zaslon zatemnjen ali miška zaklenjena?"}
    C -- "ja" --> D["Za prisilni izklop držite gumb za fizični vklop računalnika 10 sekund"]
    C -- "št" --> E["VKLOPITE letalski način in običajno zaustavite računalnik"]
    D --> F["Uporabite čisti pametni telefon na mobilnih podatkih, da pokličete bančni oddelek za goljufije"]
    E --> F
    F --> G["Zamrznitev preverjanja/prihrankov, odpoklic nakazil/Zelle, zaklepanje kreditnih uradov"]
    G --> H["Iz čistega pametnega telefona: Zasukaj e-poštna/bančna gesla in uniči seje"]
    H --> I{"Ali je prevarant imel nenadzorovan dostop ali je zagnal CMD/PowerShell?"}
    I -- "Da (visoko tveganje)" --> J["Zagon računalnika brez povezave v varnem načinu samo za reševanje osebnih dokumentov"]
    I -- "Ne (kratka seja pod nadzorom)" --> K["Zagon brez povezave v varnem načinu za čiščenje storitev in potrdil RMM"]
    J --> L["Izvedite ponovno namestitev popolnoma čistega OS prek medija USB iz čistega računalnika"]
    K --> M["Odstranite storitve, načrtovana opravila, AppData in razširitve brskalnika Audit"]

Primerjava orodij za oddaljeni dostop, ki so jih zlorabili prevaranti¶

Preden poskusite očistiti stroj ali prijavite incident forenzični skupini za goljufije vaše banke, ugotovite, katera oddaljena orodja so bila nameščena. Ne pozabite, da prevaranti med eno sejo rutinsko namestijo dve ali tri različna orodja, tako da, če odstranite vidno ikono na namizju, njihova skrita sekundarna storitev ostane aktivna.

Bančna in finančna triaža po korakih (prvih 30 minut)¶

Pri prevari z oddaljenim dostopom je okužba računalnika le mehanizem dostave; primarna nujna situacija je akutna finančna kraja. Napadalci uporabljajo psihološke in tehnične trike, kot je urejanje izvorne kode HTML (Inspect Element) of your bank's webpage to simulate an accidental $40,000 overpayment instead of $400, to trick you into wiring money, buying gift cards, or depositing cash into a Bitcoin ATM. Even if you refused to send money, an attacker with remote access can initiate transfers directly while your screen is blacked out.

1. Place an immediate hard freeze and initiate transfer recalls¶

Call your financial institution's dedicated fraud department immediately using a clean phone. State clearly: "My computer was compromised by a remote access trojan during a tech support/bank impersonation scam. An unauthorized party had live access to my online banking session." Demand the following specific actions:

• Online Banking Profile Lockout: Have the bank disable your online and mobile banking login credentials entirely and invalidate all active OAuth tokens and session cookies.
• ACH, Wire, and RTP Recall (SWIFT / Fedwire / Faster Payments): Ask the representative to inspect your account for any pending or queued outbound Automated Clearing House (ACH) transfers, domestic/international wire transfers, Zelle / Venmo payments, or "Bill Pay" checks scheduled for future dates. Scammers often schedule a Bill Pay check or post-dated ACH transfer set to execute 3 to 5 days later hoping you will not notice.
• Account Number Substitution: Because the attacker likely viewed your full routing and checking account numbers (or downloaded PDF bank statements from your browser), freezing the debit card alone is insufficient. You must request that the bank close the compromised account numbers and transition your balances into brand-new account numbers with "Post No Debits" (PND) restrictions on the old accounts.
• Check for Hidden Internal Transfers or Cash Advances: Attackers frequently take a cash advance from your linked credit card or Home Equity Line of Credit (HELOC) and transfer it into your checking account first, either to make you believe they "accidentally over-refunded" you, or to pool maximum liquidity before wiring the combined balance offshore. Tell the bank fraud specialist to check if any intra-bank transfers occurred between your savings, credit card, or brokerage accounts.

2. Freeze credit bureaus and check for new loan applications¶

While connected to your PC, scammers routinely search your Downloads oz Documents folders for keywords like tax, 1040, W2, passport, license, oz password and exfiltrate your tax returns and ID scans.

1. Place a free Security Freeze at all major credit bureaus immediately using your clean smartphone:
2. In the United States: Freeze Equifax (1-888-298-0045), Experian (1-888-397-3742), TransUnion (1-800-916-8800), and ChexSystems (1-800-428-9687).
3. In the United Kingdom: Contact Experian, Equifax, and TransUnion, and register for Cifas Protective Registration.
4. In Canada: Place credit freezes or fraud alerts with Equifax Canada and TransUnion Canada.
5. In Australia: Request a credit ban through Equifax, Illion, and Experian.
6. Review your credit report immediately for hard inquiries made in the last 24 hours; scammers often apply for instant online personal loans in a background browser tab while talking to you.

Eradicating remote access services in Safe Mode (Windows and macOS)¶

If you decide to inspect the machine, preserve forensic logs for law enforcement, or rescue irreplaceable personal photos before wiping the hard drive, never boot the computer into normal mode while connected to the internet. The moment a normal boot completes with Wi-Fi active, a persistent ScreenConnect oz AnyDesk service will phone home to the scammer's console and alert them that your machine is back online.

Phase 1: Booting into Safe Mode Without Networking¶

V sistemih Windows 10 in Windows 11¶

1. Make sure the Ethernet cable is unplugged and your home Wi-Fi router is unplugged or Airplane Mode is active.
2. Power on the PC. At the Windows sign-in screen, hold down the Left Shift key while clicking Power -> Restart.
3. On the blue recovery screen, select Troubleshoot -> Advanced options -> Startup Settings -> Restart.
4. When the startup options list appears, press 4 or F4 (Enable Safe Mode). Do not press 5 (Safe Mode with Networking).

On macOS (Apple Silicon and Intel)¶

1. Turn off the Mac and turn off your Wi-Fi router.
2. Apple Silicon (M1/M2/M3/M4): Hold the Power button until "Loading startup options" appears. Select your startup disk, hold Shift, and click Continue in Safe Mode.
3. Intel Mac: Turn on the Mac and immediately hold the Shift key until the login window appears.

Phase 2: Hunting and terminating persistent Windows Services¶

Standard uninstallation via "Add or Remove Programs" often fails to remove customized ScreenConnect MSI builds because attackers strip the uninstaller entry from the Windows Registry or deploy multiple instances under randomized hexadecimal service names.

1. In Windows Safe Mode, press Win + R, vrsta services.msc, and press Enter.
2. Click the Name column to sort alphabetically, and carefully inspect every service for the following names:
3. ScreenConnect Client (xxxxxxxxxxxxxxxx) (Note: There may be two or three separate ScreenConnect Client entries with different 16-character alphanumeric strings in parentheses, where each represents a different scammer server).
4. AnyDesk Service
5. RustDesk Service
6. UltraViewerService
7. TeamViewer
8. Zoho Assist - Unattended Agent oz SimpleHelp Remote Access
9. Za vsako sumljivo storitev, ki jo najdete, jo kliknite z desno tipko miške in izberite Lastnosti.
10. Pozorno preberite polje Pot do izvedljive datoteke in ga zapišite (npr. C:\Program Files (x86)\ScreenConnect Client (a1b2c3d4e5f6g7h8)\ScreenConnect.ClientService.exe).
11. Spremenite spustni meni Vrsta zagona na Onemogočeno, kliknite Ustavi (če se izvaja) ter kliknite Uporabi in V redu.
12. Nato odprite povišan ukazni poziv (Win + X -> Terminal (Admin) ali Command Prompt (Admin)) in trajno izbrišite registracije storitev z uporabo točnega imena storitve, navedenega v oknu lastnosti:

sc stop "AnyDesk"
sc delete "AnyDesk"
sc stop "RustDesk"
sc delete "RustDesk"
sc stop "UltraViewerService"
sc delete "UltraViewerService"

Za ScreenConnect, poizvedite vse nameščene primerke in izbrišite vsakega z natančnim imenom servisnega ključa:

sc query state= all | findstr /I "ScreenConnect"
sc delete "ScreenConnect Client (a1b2c3d4e5f6g7h8)"

3. faza: Čiščenje načrtovanih opravil, zagonskih map in skritih imenikov¶

Even after a Windows Service is deleted, attackers often configure a scheduled task that re-downloads the remote agent via powershell.exe oz mshta.exe every time a user logs in.

1. Pritisnite Win + R, vrsta taskschd.msc, in pritisnite Enter, da odprete Razporejevalnik opravil.
2. Kliknite Task Scheduler Library v levem podoknu. Razširite vsako podmapo in preglejte zavihek Dejanja vsakega načrtovanega opravila. Izbrišite vse naloge, ki zaženejo binarne datoteke C:\Users\<User>\AppData\, C:\ProgramData\, ali prikliče curl, bitsadmin, powershell -WindowStyle Hidden, or any remote desktop executable.
3. Pritisnite Win + R, vrsta shell:startup, and press Enter. Delete any shortcuts or .bat / .vbs scripts placed in your user Startup folder. Repeat this by typing shell:common startup to inspect the system-wide Startup folder.
4. Enable viewing hidden files in File Explorer (View -> Show -> Hidden items) and manually delete the application directories and configuration caches for all remote tools:
5. C:\Program Files (x86)\ScreenConnect Client (*)
6. C:\ProgramData\ScreenConnect Client (*)
7. C:\Program Files (x86)\AnyDesk\ in C:\ProgramData\AnyDesk\
8. C:\Users\<YourUsername>\AppData\Roaming\AnyDesk\
9. C:\Program Files\RustDesk\ in C:\Users\<YourUsername>\AppData\Roaming\RustDesk\
10. C:\Program Files (x86)\UltraViewer\ in C:\Users\<YourUsername>\AppData\Roaming\UltraViewer\

Phase 4: Removing macOS LaunchDaemons, LaunchAgents, and Privacy Grants¶

On macOS, remote access tools establish persistence through LaunchDaemons (system-wide) and LaunchAgents (user-level), combined with macOS TCC (Transparency, Consent, and Control) permissions for Screen Recording and Accessibility.

1. While in macOS Safe Mode (offline), open Finder, press Cmd + Shift + G (Go to Folder), and inspect the following three directories one by one:
2. /Library/LaunchDaemons/
3. /Library/LaunchAgents/
4. /Users/<YourUsername>/Library/LaunchAgents/
5. Drag any .plist files containing connectwise, screenconnect, anydesk, rustdesk, teamviewer, zoho, oz simplehelp to the Trash.
6. Next, open /Applications/ in /Library/Application Support/ and move any corresponding remote access app bundles and support folders to the Trash.
7. Open System Settings -> Privacy & Security. Check two critical sections:
8. Screen & System Audio Recording: Select any remote support tool listed and click the minus (-), da prekličete možnost ogleda vašega zaslona.
9. Accessibility: Select any remote support tool and click the minus (-) button to revoke its ability to control your mouse cursor and synthesize keystrokes.
10. Full Disk Access: Verify that no unknown application or terminal wrapper has been granted Full Disk Access.

Reversing Windows password locks and fake boot banners¶

Before disconnecting, vindictive scammers frequently lock victims out of their computers and demand a ransom for the password. They use three primary methods:

1. Changing your local Windows password (net user) or adding a rogue admin account¶

While their screen curtain is active, scammers often open an elevated Command Prompt and run net user <YourUsername> <NewPassword> or create a backdoor administrator account (net user SupportAdmin Pass123 /add && net localgroup administrators SupportAdmin /add). * How to check and fix: In Safe Mode, open an elevated Command Prompt (cmd.exe as Administrator) and type net user. If you see an unfamiliar account, delete it immediately with net user <RogueAccountName> /delete. If your local password was changed, boot from a Windows Installation USB into the Windows Recovery Environment (WinRE) to restore a prior System Restore Point, or sign in with your linked Microsoft Account after resetting your password on a clean smartphone.

2. Enabling a startup message banner via Registry (LegalNoticeCaption)¶

Scammers often modify HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System by setting LegalNoticeCaption in LegalNoticeText to display a fake Microsoft Security lockout phone number before login. * How to fix: This is purely a cosmetic text screen before the normal Windows login prompt. Click OK or press Enter to bypass it, open regedit in Safe Mode, go to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System, and clear the text inside LegalNoticeCaption in LegalNoticeText.

3. Safe Boot PIN lockouts (bcdedit)¶

Microsoft removed the legacy syskey.exe tool in Windows 10 version 1709. Today, scammers instead tick Safe boot inside msconfig and reboot your PC offline. Because Windows Hello PINs often fail on the Safe Mode login screen without network access, victims get trapped in a boot loop. * How to fix: Hold Shift + Restart at the login screen, select Troubleshoot -> Advanced options -> Command Prompt, and run:

bcdedit /deletevalue {current} safeboot

Restart the computer normally (keeping your internet router unplugged) so you can log in with your cached password or PIN and remove the remote software.

Why browser session theft and infostealers require a full OS wipe¶

Even if you delete the ScreenConnect, AnyDesk, oz RustDesk services in Safe Mode, you must evaluate whether the scammer deployed a secondary Infostealer (Lumma, RedLine, Vidar, Stealc) or copied your browser profile directory.

During an unattended remote session, it takes less than 8 seconds for an attacker to run a PowerShell script that copies your Google Chrome, Microsoft Edge, or Brave user data directory (C:\Users\<User>\AppData\Local\Google\Chrome\User Data\Default\) along with the local DPAPI master decryption key. With those files on their server, the attacker possesses:

1. Every password saved in your web browser's built-in password manager.
2. Active session cookies (Cookies in Network\Cookies SQLite databases): Even if your email or bank uses two-factor authentication (2FA), possessing your decrypted session token cookie allows the attacker to import your browser profile into an antidetect browser on their machine and access your Gmail, Outlook, Amazon, or cryptocurrency exchange account without needing a password or 2FA kodo.
3. Trezorji denarnic za kriptovalute v brskalniku (MetaMask, Phantom, Rabby): Encrypted vault files inside Local Extension Settings so izgnani zaradi brutalnega vsiljevanja brez povezave.

When you must perform a clean USB operating system reinstall¶

While Safe Mode service removal is sufficient if you caught the scammer within 10 seconds of installing AnyDesk and never gave them Administrator elevation or unattended access, you must wipe the drive and perform a clean OS installation from a USB stick if any of the following occurred:

• Your screen went black (Blank Guest Monitor) or your mouse/keyboard was locked.
• You saw a Command Prompt (cmd.exe) or PowerShell window flash on the screen.
• You left the computer unattended while the scammer ran a fake security scan.
• You installed ConnectWise ScreenConnect (which runs as SYSTEM by default and allows invisible background shell script execution).

To perform a safe reinstall: 1. While offline in Safe Mode, plug a brand-new USB flash drive into the compromised PC and copy only personal data files (.jpg, .pdf, .docx, .xlsx, family videos). Never copy .exe, .msi, .bat, .ps1, or browser profile folders. 2. Using a different, clean computer, download the official Windows Media Creation Tool from Microsoft (microsoft.com/software-download) or create a bootable macOS installer. 3. Boot the compromised PC from the clean USB installer, delete all existing partitions on the primary drive (Drive 0), and install a fresh copy of the operating system.

Preserving your legal right to bank reimbursement¶

Banks frequently attempt to deny fraud reimbursement claims in remote access scams by arguing that because you clicked "Download" on AnyDesk or ScreenConnect, you "authorized" the transactions or acted with gross negligence. Knowing how statutory consumer banking protections work in your jurisdiction is critical when speaking to your bank's fraud claim adjudicator.

In the United States: Electronic Fund Transfer Act (EFTA) and Regulation E (12 CFR § 1005)¶

Under the federal Electronic Fund Transfer Act (Regulation E), the Consumer Financial Protection Bureau (CFPB) has issued official supervisory guidance stating that: * Induced access is still an "Unauthorized Electronic Fund Transfer": Under 12 CFR § 1005.2(m), an electronic fund transfer initiated by a person who obtained access to a consumer's account through fraud or robbery is defined by law as an unauthorized EFT, even if the consumer was tricked into providing a password, a one-time passcode, or installing remote desktop software. * Negligence cannot be used to deny your claim: The CFPB's Official Interpretation of Regulation E (Comment 6(b)-2) states that consumer negligence (such as falling for a phishing pop-up or granting remote desktop access to a scammer) cannot be used by a bank to impose greater liability on the consumer than Regulation E allows ($50 maximum if reported within 2 business days; $500 maximum within 60 days). * Distinguish between Scammer-Clicked vs. Consumer-Clicked transfers: If the scammer moved the mouse and clicked "Send" behind a black screen during the AnyDesk/ScreenConnect session, it is an Unauthorized EFT covered by Regulation E. Banki pisno povejte: "Nisem sprožil, odobril ali kliknil gumba za ta prenos; akter kriminalne grožnje je izvršil prenos na daljavo z uporabo trojanca za oddaljeni dostop, medtem ko je bil moj zaslon zaklenjen, kar predstavlja nepooblaščen EFT v skladu s 12 CFR § 1005.2(m)." Priložite ohranjeno connection_trace.txt log or Windows Event Viewer Service Control Manager logs (Event ID 7045 showing the exact minute the ScreenConnect oz AnyDesk service was installed) as forensic proof.

In the United Kingdom, European Union, Canada, and Australia¶

• Združeno kraljestvo (PSR & FOS): If the scammer controlled your computer directly to move funds, report it as an Unauthorized Payment under the Payment Services Regulations 2017. If the scammer manipulated your screen (Inspect Element fake refund) to trick you into authorizing a Faster Payment yourself, report it under the Payment Services Regulator's (PSR) mandatory Authorized Push Payment (APP) Fraud reimbursement rules and escalate any denial to the Financial Ombudsman Service (FOS).
• European Union, Canada, and Australia: Report the incident immediately to your bank and national police, emphasizing that a remote access trojan executed or manipulated the session. Escalate unresolved bank disputes to the Ombudsman for Banking Services and Investments (OBSI) in Canada or the Australian Financial Complaints Authority (AFCA) in Australia under the ePayments Code.

Kontrolni seznam za sanacijo in poročanje po incidentu¶

Complete every item in this checklist before reconnecting your home network or resuming normal online banking:

• Physical isolation confirmed: Compromised computer was physically disconnected from Ethernet and Wi-Fi before any further troubleshooting.
• Bank accounts frozen and re-numbered: All checking, savings, and HELOC account numbers that were visible on the computer have been closed and re-issued with new account numbers.
• Scheduled Bill Pay and ACH queues purged: Verified with a bank supervisor that no future-dated Bill Pay checks, external bank links (Plaid), or standing wire instructions were added during the remote session.
• Credit freezes active: Security freezes placed with Equifax, Experian, TransUnion, and ChexSystems.
• Email forwarding rules audited: Logged into Gmail/Outlook/Yahoo from a clean smartphone and checked Settings -> Forwarding and POP/IMAP and Rules / Filters for hidden rules that auto-delete or forward emails containing "Bank", "Fraud", "Wire", oz "Security Alert".
• Browser password vault rotated: Every password stored inside Chrome, Edge, Firefox, or Safari password managers has been changed from a clean device.
• Forensic logs saved and official reports filed: File reports with the FBI IC3 (ic3.gov) and FTC (reportfraud.ftc.gov) in the US, Action Fraud (actionfraud.police.uk) in the UK, the Canadian Anti-Fraud Centre, or Scamwatch (scamwatch.gov.au) in Australia. Also report the installer binary or connection ID to connectwise.com/company/trust/report-abuse oz anydesk.com/en/abuse.

Pogosta vprašanja¶

The scammer showed me my Windows Event Viewer and netstat in Command Prompt and it was full of thousands of warnings, errors, and "FOREIGN ADDRESS" connections. Was my computer actually hacked before I called them?¶

No. Both `eventvwr` (Windows Event Viewer) and `netstat` are normal administrative utilities built into every copy of Windows, and scammers abuse them as psychological props. Every healthy Windows computer generates thousands of routine yellow Warning and red Error logs in Event Viewer during normal boot-ups and background updates, and `netstat` lists every normal background connection your browser and operating system make to cloud servers as a "Foreign Address." Your computer was completely safe until the moment you followed the caller's instructions to download and run their remote access tool.

How did the scammer make my real bank website show that they accidentally deposited $40,000 into my checking account if they cannot hack the bank's server?¶

While connected to your computer via AnyDesk or ScreenConnect, the scammer blacks out your screen for 15 seconds, right-clicks your bank balance in your web browser, and clicks **"Inspect" (`Developer Tools`)**. This opens the local HTML text displayed in your browser tab. The scammer simply types `$45,200.00` over your real `$5,200.00` balance and adds a fake text line reading `"ACH REFUND OVERPAYMENT +$40,000.00"` on your screen. This edit exists only inside your browser tab's temporary memory (`DOM`) and vanishes the instant you refresh the page (`F5`) or check your balance on your smartphone app. Alternatively, they transfer `$40,000` z vašega lastnega varčevalnega računa ali kreditne linije na vaš tekoči račun in znova označite zaslon, da vas zavedejo, da jim nakažete svoj denar.

If I uninstalled AnyDesk or UltraViewer from the Control Panel, am I safe to turn my Wi-Fi back on?¶

Običajno ne brez pregleda storitev Windows (`services.msc`) in Safe Mode first. Professional tech support scam call centers know that victims often uninstall AnyDesk or UltraViewer as soon as they hang up. Therefore, within the first two minutes of connecting to your PC, scammers routinely use silent file transfer to drop a secondary, hidden **ConnectWise ScreenConnect** (`ScreenConnect.ClientService.exe`) or **SimpleHelp** agent that does not create a desktop shortcut and hides inside `C:\Program Files (x86)\ScreenConnect Client (xxxx)`. Unless you verify in Safe Mode that no rogue `SYSTEM` services or scheduled tasks exist, or perform a full USB OS wipe, reconnecting to Wi-Fi can immediately hand control of your PC back to the attacker.

Can a scammer access other computers or smartphones on my home Wi-Fi network just because I installed AnyDesk on one laptop?¶

Installing AnyDesk or ScreenConnect compromises the specific computer where you ran the installer, not your phones or other laptops directly. However, if you use **Google Chrome, Microsoft Edge, or Apple iCloud password and session syncing** across your laptop and smartphone, any passwords the scammer steals or changes on the infected laptop will impact your shared cloud accounts. Also, while connected to your laptop, an attacker can log into your home router's admin page (`192.168.1.1`) if it still uses the default admin password and alter your router's `DNS` settings. After isolating the infected laptop, factory-reset your Wi-Fi router or verify its DNS settings and admin password from a clean device.

Sorodni vodniki¶

• Prevara s pojavnimi okni tehnične podpore in odstranitev oddaljenega namizja AnyDesk/TeamViewer
• Session cookie hijacking, infostealer malware, and passkey revocation
• Lažna CAPTCHA ClickFix PowerShell zlonamerna programska oprema odložišča Win+R in popravek Lumma Infostealer
• Prevare v aplikacijah za avtorizirana potisna plačila (APP): Zelle, Venmo in Faster Payments lažno predstavljanje in pravice do povračila
• Bank account breach
• Številke za klic v sili po državah

Viri in uradna navodila¶

• Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), National Security Agency (NSA), & Multi-State Information Sharing and Analysis Center (MS-ISAC) (United States): Joint Cybersecurity Advisory (AA23-025A): Protecting Against Malicious Use of Remote Monitoring and Management (RMM) Software.
• Urad za finančno zaščito potrošnikov (CFPB) (United States): Electronic Fund Transfers (Regulation E, 12 CFR Part 1005) Official Interpretations and FAQs on Unauthorized EFTs and Fraudulently Induced Access.
• Zvezna komisija za trgovino (FTC) (United States): How To Spot, Avoid, and Report Tech Support Scams.
• Nacionalni center za kibernetsko varnost (NCSC) & Action Fraud (United Kingdom): Protecting Devices from Unauthorised Remote Access Tools and Screen-Sharing Fraud.
• ConnectWise Trust & Security Response Center: Identifying and Removing Rogue ScreenConnect (ConnectWise Control) Client Instances.