Remote access trojan (ScreenConnect, AnyDesk, RustDesk, UltraViewer) tech support scam: pulling ethernet, killing services, and bank freeze¶

When a scammer convinces you to install a remote desktop tool or executes a remote monitoring agent on your computer, they gain live, unrestricted control over your mouse, keyboard, file system, and active browser sessions. While displaying a fake security scan or a black privacy curtain on your monitor, the operator silently drains checking accounts, harvests saved passwords, and installs persistent background services that survive standard reboots. This guide provides immediate steps to sever the attacker's data link, permanently eradicate unattended remote access services, and lock down your banking and credit infrastructure before funds clear the wire network.

Fai nei loa¶

1. Sever all internet connectivity physically and immediately. Unplug the Ethernet cable from the back of your desktop or router, flip the physical Wi-Fi switch on your laptop, or press and hold the power button on your Wi-Fi router for 10 seconds until all lights go dark. Do not waste time trying to fight the scammer for control of the mouse cursor to click the disconnect button.
2. Force-shutdown the compromised computer if the screen is blacked out. If the attacker has enabled "Blank Guest Monitor" or locked your keyboard input, press and hold your computer's physical power button for 10 full seconds until the machine powers off completely. Leave it powered off while you secure your financial accounts from a separate, clean device.
3. Call your bank's fraud department from an independent phone. Use a cellular phone to call the official number printed on the back of your debit or credit card, or call your local emergency number (911 in the United States and Canada, 112 across the European Union, 999 in the United Kingdom) if an active extortion threat is occurring; see numera fa'afuase'i for international contacts. Instruct the bank to place an immediate hard freeze on all checking, savings, and line-of-credit accounts, and demand an emergency recall on any pending Automated Clearing House (ACH), wire, or real-time payment transfers.
4. Revoke active session cookies and change passwords from a clean smartphone. Using your phone on cellular data (not connected to your home Wi-Fi if the compromised PC is back on), log into your primary email, banking portals, and cloud storage accounts. Terminate all active login sessions, revoke unrecognized Multi-Factor Authentication (MFA) devices, and rotate your passwords.
5. Boot the infected computer into Safe Mode Without Networking. Only turn the compromised computer back on while disconnected from the internet, entering Windows Safe Mode or macOS Safe Mode to inspect and strip out unattended background services (ScreenConnect Client, AnyDesk Service, RustDesk Service) before the operating system loads third-party network drivers.

Understanding the anatomy of a commercial RMM and remote desktop attack¶

Modern technical support scams, refund frauds, and bank impersonation attacks rarely rely on custom-written computer viruses. Instead, threat actors abuse legitimate, digitally signed Remote Monitoring and Management (RMM) software and commercial remote desktop tools. Because these executables carry valid cryptographic code-signing certificates from trusted software vendors, standard antivirus programs like Windows Defender or macOS XProtect do not block their installation.

How attackers weaponize legitimate remote support binaries¶

When a victim calls a toll-free number displayed on a fake browser pop-up, replies to an urgent invoice email, or follows instructions from a fake bank fraud investigator, the operator directs them to download an executable or MSI installer. The most heavily abused platforms include:

• ConnectWise ScreenConnect (formerly Control): Often deployed via a customized .msi pe .exe package hosted on an attacker-controlled server. Once executed, it installs as a persistent Windows System Service (ScreenConnect Client (xxxx)) running with NT AUTHORITY\SYSTEM privileges, granting silent, unattended access whenever the computer is online.
• AnyDesk (anydesk.exe): Frequently used in cross-platform scams targeting Windows, macOS, and mobile devices. Attackers instruct the victim to read aloud the 9-digit AnyDesk address, request administrative elevation, and set an "Unattended Access Password" to reconnect while the victim sleeps.
• RustDesk (rustdesk.exe): An open-source remote desktop tool favored by scam syndicates because they can self-host relay servers, bypassing vendor abuse takedowns.
• UltraViewer, TeamViewer, Zoho Assist, and SimpleHelp: Commonly chained together. A scammer connecting via UltraViewer or AnyDesk will often silently install a hidden ScreenConnect pe SimpleHelp package in the background as a backup backdoor.

Emergency workflow: severing the connection and triaging damage¶

Use the following operational flowchart to stop an active remote session, isolate the workstation, and determine whether the machine can be cleaned in Safe Mode or requires a complete operating system wipe.

flowchart TD
    A["Active or Recent Remote Access Scam Detected"] --> B["Physically Unplug Ethernet Cable and Power Off Wi-Fi Router"]
    B --> C{"Is Screen Blacked Out or Mouse Locked?"}
    C -- "Ioe" --> D["Hold PC Physical Power Button for 10 Seconds to Force Off"]
    C -- "Leai" --> E["Switch Airplane Mode ON and Shut Down PC Normally"]
    D --> F["Use Clean Smartphone on Cellular Data to Call Bank Fraud Dept"]
    E --> F
    F --> G["Fa'aaisa Siaki/Teuga, Toe Fa'amanatu Uaea/Zelle, Loka Ofisa Fa'aaitalafu"]
    G --> H["Mai le Telefoni Mama: Su'e Imeli/Fa'auupega Fa'atupe & Fasi'i Sauniga"]
    H --> I{"Na maua e le Scammer le avanoa e le'i va'aia pe fa'agaoioi le CMD/PowerShell?"}
    I -- "Ioe (Tulaga Tulaga Maualuga)" --> J["Fa'afou le PC Offline i le Safe Mode e laveai ai na'o Docs Personal"]
    I -- "No (Brief Supervised Session)" --> K["Boot Offline into Safe Mode to Purge RMM Services and Certs"]
    J --> L["Perform Full Clean OS Reinstall via USB Media From Clean PC"]
    K --> M["Remove Services, Scheduled Tasks, AppData, and Audit Browser Extensions"]

Comparison of remote access tools abused by scammers¶

A'o le'i taumafai e fa'amama se masini pe lipoti atu le mea na tupu i le 'au fa'asese a lau faletupe, fa'ailoa po'o fea mea faigaluega mamao na fa'apipi'iina. Manatua e masani ona faʻapipiʻi e le au faʻatauvaʻa ni meafaigaluega eseese se lua pe tolu i le taimi e tasi ina ia e aveese le ata vaaia o le desktop, e tumau pea le malosi o la latou auaunaga lona lua.

Step-by-step banking and financial triage (First 30 minutes)¶

In a remote access scam, the computer infection is only the delivery mechanism; the primary emergency is acute financial theft. Attackers use psychological and technical tricks, such as editing the HTML source code (Inspect Element) of your bank's webpage to simulate an accidental $40,000 overpayment instead of $400, e fa'a'ole'ole ai oe e fa'alili tupe, fa'atau pepa meaalofa, po'o le teuina o tinoitupe ile Bitcoin ATM. E tusa lava pe e te musu e lafo se tupe, e mafai e le tagata osofaʻi ma le avanoa mamao ona amata saʻo fesiitaiga aʻo pogisa lau lau.

1. Fa'amalo vave ma amata le toe fa'afo'i¶

Fa'afeso'ota'i le matagaluega fa'atauva'a fa'apitoa a lau fa'alapotopotoga fa'apitoa e fa'aaoga se telefoni mama. Fa'ailoa manino: *"O la'u komipiuta na fa'afefeteina e se trojan avanoa mamao i le taimi o se tech support/bank impersonation scam. O se pati e le'i fa'atagaina na maua sa'o i la'u sauniga teugatupe i luga ole laiga.

• Online Banking Profile Lockout: Have the bank disable your online and mobile banking login credentials entirely and invalidate all active OAuth tokens and session cookies.
• ACH, Wire, and RTP Recall (SWIFT / Fedwire / Faster Payments): Ask the representative to inspect your account for any pending or queued outbound Automated Clearing House (ACH) transfers, domestic/international wire transfers, Zelle / Venmo payments, or "Bill Pay" checks scheduled for future dates. Scammers often schedule a Bill Pay check or post-dated ACH transfer set to execute 3 to 5 days later hoping you will not notice.
• Account Number Substitution: Because the attacker likely viewed your full routing and checking account numbers (or downloaded PDF bank statements from your browser), freezing the debit card alone is insufficient. You must request that the bank close the compromised account numbers and transition your balances into brand-new account numbers with "Post No Debits" (PND) restrictions on the old accounts.
• Check for Hidden Internal Transfers or Cash Advances: Attackers frequently take a cash advance from your linked credit card or Home Equity Line of Credit (HELOC) and transfer it into your checking account first, either to make you believe they "accidentally over-refunded" you, or to pool maximum liquidity before wiring the combined balance offshore. Tell the bank fraud specialist to check if any intra-bank transfers occurred between your savings, credit card, or brokerage accounts.

2. Freeze credit bureaus and check for new loan applications¶

A'o fa'afeso'ota'i i lau PC, e masani ona su'e e tagata fa'akomepiuta lau Downloads pe Documents folders for keywords like tax, 1040, W2, passport, license, pe password and exfiltrate your tax returns and ID scans.

1. Place a free Security Freeze at all major credit bureaus immediately using your clean smartphone:
2. I le Iunaite Setete: Fa'a'aisa Equifax (1-888-298-0045), Su'esu'ega (1-888-397-3742), TransUnion (1-800-916-8800), and ChexSystems (1-800-428-9687).
3. In the United Kingdom: Contact Experian, Equifax, and TransUnion, and register for Cifas Protective Registration.
4. In Canada: Place credit freezes or fraud alerts with Equifax Canada and TransUnion Canada.
5. In Australia: Request a credit ban through Equifax, Illion, and Experian.
6. Review your credit report immediately for hard inquiries made in the last 24 hours; scammers often apply for instant online personal loans in a background browser tab while talking to you.

Eradicating remote access services in Safe Mode (Windows and macOS)¶

If you decide to inspect the machine, preserve forensic logs for law enforcement, or rescue irreplaceable personal photos before wiping the hard drive, never boot the computer into normal mode while connected to the internet. The moment a normal boot completes with Wi-Fi active, a persistent ScreenConnect pe AnyDesk service will phone home to the scammer's console and alert them that your machine is back online.

Phase 1: Booting into Safe Mode Without Networking¶

I luga o le Windows 10 ma le Windows 11¶

1. Make sure the Ethernet cable is unplugged and your home Wi-Fi router is unplugged or Airplane Mode is active.
2. Power on the PC. At the Windows sign-in screen, hold down the Left Shift key while clicking Power -> Restart.
3. On the blue recovery screen, select Troubleshoot -> Advanced options -> Startup Settings -> Restart.
4. When the startup options list appears, press 4 or F4 (Enable Safe Mode). Do not press 5 (Safe Mode with Networking).

On macOS (Apple Silicon and Intel)¶

1. Turn off the Mac and turn off your Wi-Fi router.
2. Apple Silicon (M1/M2/M3/M4): Hold the Power button until "Loading startup options" appears. Select your startup disk, hold Shift, and click Continue in Safe Mode.
3. Intel Mac: Turn on the Mac and immediately hold the Shift key until the login window appears.

Phase 2: Hunting and terminating persistent Windows Services¶

Standard uninstallation via "Add or Remove Programs" often fails to remove customized ScreenConnect MSI builds because attackers strip the uninstaller entry from the Windows Registry or deploy multiple instances under randomized hexadecimal service names.

1. In Windows Safe Mode, press Win + R, ituaiga services.msc, and press Enter.
2. Click the Name column to sort alphabetically, and carefully inspect every service for the following names:
3. ScreenConnect Client (xxxxxxxxxxxxxxxx) (Note: There may be two or three separate ScreenConnect Client entries with different 16-character alphanumeric strings in parentheses, where each represents a different scammer server).
4. AnyDesk Service
5. RustDesk Service
6. UltraViewerService
7. TeamViewer
8. Zoho Assist - Unattended Agent pe SimpleHelp Remote Access
9. For every suspicious service you find, right-click it and select Properties.
10. Read the Path to executable field carefully and write it down (for example, C:\Program Files (x86)\ScreenConnect Client (a1b2c3d4e5f6g7h8)\ScreenConnect.ClientService.exe).
11. Change the Startup type dropdown to Disabled, click Stop (if running), and click Apply and OK.
12. Next, open an elevated Command Prompt (Win + X -> Terminal (Admin) or Command Prompt (Admin)) and permanently delete the service registrations using the exact service name listed in the properties window:

sc stop "AnyDesk"
sc delete "AnyDesk"
sc stop "RustDesk"
sc delete "RustDesk"
sc stop "UltraViewerService"
sc delete "UltraViewerService"

Mo ScreenConnect, fesili uma mea fa'apipi'i ma tape mea ta'itasi i lona igoa sa'o tautua:

sc query state= all | findstr /I "ScreenConnect"
sc delete "ScreenConnect Client (a1b2c3d4e5f6g7h8)"

Vaega 3: Faʻamamāina o Galuega Faʻatulagaina, Faʻamatalaga amata, ma faʻamaumauga natia¶

E tusa lava pe ua uma ona tapeina se Windows Service, e masani ona faʻapipiʻi e tagata osofaʻi se galuega faʻatulagaina e toe sii mai ai le sui mamao e ala i powershell.exe pe mshta.exe o taimi uma e saini ai se tagata fa'aoga.

1. Tusitala Win + R, ituaiga taskschd.msc, ma fetaomi Enter e tatala ai Task Scheduler.
2. Kiliki Task Scheduler Library i le itu tauagavale. Fa'alautele so'o faila laiti ma siaki le Actions tab o galuega fa'atulagaina ta'itasi. Ave'ese so'o se galuega e fa'alauiloa ai binaries mai C:\Users\<User>\AppData\, C:\ProgramData\, po o valaau curl, bitsadmin, powershell -WindowStyle Hidden, or any remote desktop executable.
3. Tusitala Win + R, ituaiga shell:startup, and press Enter. Delete any shortcuts or .bat / .vbs scripts placed in your user Startup folder. Repeat this by typing shell:common startup to inspect the system-wide Startup folder.
4. Enable viewing hidden files in File Explorer (View -> Show -> Hidden items) and manually delete the application directories and configuration caches for all remote tools:
5. C:\Program Files (x86)\ScreenConnect Client (*)
6. C:\ProgramData\ScreenConnect Client (*)
7. C:\Program Files (x86)\AnyDesk\ ma C:\ProgramData\AnyDesk\
8. C:\Users\<YourUsername>\AppData\Roaming\AnyDesk\
9. C:\Program Files\RustDesk\ ma C:\Users\<YourUsername>\AppData\Roaming\RustDesk\
10. C:\Program Files (x86)\UltraViewer\ ma C:\Users\<YourUsername>\AppData\Roaming\UltraViewer\

Phase 4: Removing macOS LaunchDaemons, LaunchAgents, and Privacy Grants¶

On macOS, remote access tools establish persistence through LaunchDaemons (system-wide) and LaunchAgents (user-level), combined with macOS TCC (Transparency, Consent, and Control) permissions for Screen Recording and Accessibility.

1. While in macOS Safe Mode (offline), open Finder, press Cmd + Shift + G (Go to Folder), and inspect the following three directories one by one:
2. /Library/LaunchDaemons/
3. /Library/LaunchAgents/
4. /Users/<YourUsername>/Library/LaunchAgents/
5. Drag any .plist files containing connectwise, screenconnect, anydesk, rustdesk, teamviewer, zoho, pe simplehelp to the Trash.
6. Sosoo ai, tatala /Applications/ ma /Library/Application Support/ and move any corresponding remote access app bundles and support folders to the Trash.
7. Tatala ** Fa'atonu Fa'atonu -> Fa'alilolilo & Puipuiga**. Siaki vaega taua e lua:
8. ** Va'aiga & Fa'amaumauga Fa'alogo:** Filifili so'o se meafaigaluega lagolago mamao o lo'o lisiina ma kiliki le fa'amau (-) button to revoke its ability to view your display.
9. Accessibility: Select any remote support tool and click the minus (-) button to revoke its ability to control your mouse cursor and synthesize keystrokes.
10. Full Disk Access: Verify that no unknown application or terminal wrapper has been granted Full Disk Access.

Reversing Windows password locks and fake boot banners¶

Before disconnecting, vindictive scammers frequently lock victims out of their computers and demand a ransom for the password. They use three primary methods:

1. Changing your local Windows password (net user) or adding a rogue admin account¶

While their screen curtain is active, scammers often open an elevated Command Prompt and run net user <YourUsername> <NewPassword> or create a backdoor administrator account (net user SupportAdmin Pass123 /add && net localgroup administrators SupportAdmin /add). * How to check and fix: In Safe Mode, open an elevated Command Prompt (cmd.exe as Administrator) and type net user. If you see an unfamiliar account, delete it immediately with net user <RogueAccountName> /delete. If your local password was changed, boot from a Windows Installation USB into the Windows Recovery Environment (WinRE) to restore a prior System Restore Point, or sign in with your linked Microsoft Account after resetting your password on a clean smartphone.

2. Enabling a startup message banner via Registry (LegalNoticeCaption)¶

Scammers often modify HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System by setting LegalNoticeCaption ma LegalNoticeText to display a fake Microsoft Security lockout phone number before login. * How to fix: This is purely a cosmetic text screen before the normal Windows login prompt. Click OK or press Enter to bypass it, open regedit in Safe Mode, go to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System, and clear the text inside LegalNoticeCaption ma LegalNoticeText.

3. Safe Boot PIN lockouts (bcdedit)¶

Microsoft removed the legacy syskey.exe tool in Windows 10 version 1709. Today, scammers instead tick Safe boot inside msconfig and reboot your PC offline. Because Windows Hello PINs often fail on the Safe Mode login screen without network access, victims get trapped in a boot loop. * How to fix: Hold Shift + Restart at the login screen, select Troubleshoot -> Advanced options -> Command Prompt, and run:

bcdedit /deletevalue {current} safeboot

Restart the computer normally (keeping your internet router unplugged) so you can log in with your cached password or PIN and remove the remote software.

Why browser session theft and infostealers require a full OS wipe¶

Even if you delete the ScreenConnect, AnyDesk, pe RustDesk services in Safe Mode, you must evaluate whether the scammer deployed a secondary Infostealer (Lumma, RedLine, Vidar, Stealc) or copied your browser profile directory.

During an unattended remote session, it takes less than 8 seconds for an attacker to run a PowerShell script that copies your Google Chrome, Microsoft Edge, or Brave user data directory (C:\Users\<User>\AppData\Local\Google\Chrome\User Data\Default\) along with the local DPAPI master decryption key. With those files on their server, the attacker possesses:

1. Every password saved in your web browser's built-in password manager.
2. ** Kuki o le sauniga gaio'i (Cookies ma Network\Cookies SQLite databases):** Even if your email or bank uses two-factor authentication (2FA), o le umiaina o lau kuki fa'ailoga sauniga e mafai ai e le tagata osofa'i ona fa'aulufale mai lau fa'amatalaga su'esu'e i totonu o se su'esu'ega antidetect i luga o la latou masini ma maua ai lau Gmail, Outlook, Amazon, po'o le cryptocurrency exchange account e aunoa ma le mana'omia o se fa'aupuga po'o 2FA code.
3. Browser-based cryptocurrency wallet vaults (MetaMask, Phantom, Rabby): Encrypted vault files inside Local Extension Settings are exfiltrated for offline brute-forcing.

When you must perform a clean USB operating system reinstall¶

While Safe Mode service removal is sufficient if you caught the scammer within 10 seconds of installing AnyDesk and never gave them Administrator elevation or unattended access, you must wipe the drive and perform a clean OS installation from a USB stick if any of the following occurred:

• Your screen went black (Blank Guest Monitor) or your mouse/keyboard was locked.
• You saw a Command Prompt (cmd.exe) or PowerShell window flash on the screen.
• You left the computer unattended while the scammer ran a fake security scan.
• You installed ConnectWise ScreenConnect (lea e tamoe e pei o SYSTEM by default and allows invisible background shell script execution).

Ina ia faia se toe fa'apipi'i saogalemu: 1. While offline in Safe Mode, plug a brand-new USB flash drive into the compromised PC and copy only personal data files (.jpg, .pdf, .docx, .xlsx, family videos). Never copy .exe, .msi, .bat, .ps1, or browser profile folders. 2. Using a different, clean computer, download the official Windows Media Creation Tool from Microsoft (microsoft.com/software-download) or create a bootable macOS installer. 3. Boot the compromised PC from the clean USB installer, delete all existing partitions on the primary drive (Drive 0), and install a fresh copy of the operating system.

Preserving your legal right to bank reimbursement¶

Banks frequently attempt to deny fraud reimbursement claims in remote access scams by arguing that because you clicked "Download" on AnyDesk or ScreenConnect, you "authorized" the transactions or acted with gross negligence. Knowing how statutory consumer banking protections work in your jurisdiction is critical when speaking to your bank's fraud claim adjudicator.

In the United States: Electronic Fund Transfer Act (EFTA) and Regulation E (12 CFR § 1005)¶

Under the federal Electronic Fund Transfer Act (Regulation E), the Consumer Financial Protection Bureau (CFPB) has issued official supervisory guidance stating that: * Induced access is still an "Unauthorized Electronic Fund Transfer": Under 12 CFR § 1005.2(m), an electronic fund transfer initiated by a person who obtained access to a consumer's account through fraud or robbery is defined by law as an unauthorized EFT, even if the consumer was tricked into providing a password, a one-time passcode, or installing remote desktop software. * Negligence cannot be used to deny your claim: The CFPB's Official Interpretation of Regulation E (Comment 6(b)-2) states that consumer negligence (such as falling for a phishing pop-up or granting remote desktop access to a scammer) cannot be used by a bank to impose greater liability on the consumer than Regulation E allows ($50 maximum if reported within 2 business days; $500 maualuga i totonu ole 60 aso). * ** Fa'ailoga i le va o Scammer-Clicked vs. Consumer-Clicked transfers:** Afai e fa'agaoioi e le tagata fa'atauva'a le isumu ma kiliki "Auina" i tua o se lau uliuli i le taimi o le AnyDesk/ScreenConnect session, o le EFT e le'i faatagaina e ufiufi e Regulation E. Tell the bank in writing: "I did not initiate, authorize, or click the button for this transfer; a criminal threat actor executed the transfer remotely using a Remote Access Trojan while locking my screen, which constitutes an unauthorized EFT under 12 CFR § 1005.2(m)." Attach your preserved connection_trace.txt log or Windows Event Viewer Service Control Manager logs (Event ID 7045 fa'aalia le minute tonu le ScreenConnect pe AnyDesk service was installed) as forensic proof.

In the United Kingdom, European Union, Canada, and Australia¶

• United Kingdom (PSR & FOS): If the scammer controlled your computer directly to move funds, report it as an Unauthorized Payment under the Payment Services Regulations 2017. If the scammer manipulated your screen (Inspect Element fake refund) to trick you into authorizing a Faster Payment yourself, report it under the Payment Services Regulator's (PSR) mandatory Authorized Push Payment (APP) Fraud reimbursement rules and escalate any denial to the Financial Ombudsman Service (FOS).
• European Union, Canada, and Australia: Report the incident immediately to your bank and national police, emphasizing that a remote access trojan executed or manipulated the session. Escalate unresolved bank disputes to the Ombudsman for Banking Services and Investments (OBSI) in Canada or the Australian Financial Complaints Authority (AFCA) in Australia under the ePayments Code.

Post-incident remediation and reporting checklist¶

Complete every item in this checklist before reconnecting your home network or resuming normal online banking:

• Physical isolation confirmed: Compromised computer was physically disconnected from Ethernet and Wi-Fi before any further troubleshooting.
• Bank accounts frozen and re-numbered: All checking, savings, and HELOC account numbers that were visible on the computer have been closed and re-issued with new account numbers.
• Scheduled Bill Pay and ACH queues purged: Verified with a bank supervisor that no future-dated Bill Pay checks, external bank links (Plaid), po'o fa'atonuga uaea tu sa fa'aopoopoina i le taimi o le sauniga mamao.
• Fa'aisa fa'aaitalafu fa'aagaioia: Fa'agata saogalemu tu'u ile Equifax, Experian, TransUnion, ma ChexSystems.
• Email forwarding rules audited: Logged into Gmail/Outlook/Yahoo from a clean smartphone and checked Settings -> Forwarding and POP/IMAP and Rules / Filters for hidden rules that auto-delete or forward emails containing "Bank", "Fraud", "Wire", pe "Security Alert".
• Su'esu'e upu fa'apolokalame vault fesuia'i: O uputatala uma o lo'o teuina i totonu o Chrome, Edge, Firefox, po'o Safari fa'aupuga fa'atonu pule ua suia mai se masini mama.
• ** Ogalaau mo su'esu'ega fa'afoma'i na fa'asaoina ma fa'aulu lipoti aloa'ia:** Fa'aulu lipoti i le FBI IC3 (ic3.gov) and FTC (reportfraud.ftc.gov) in the US, Action Fraud (actionfraud.police.uk) i Peretania, le Canadian Anti-Fraud Centre, po o le Scamwatch (scamwatch.gov.au) in Australia. Also report the installer binary or connection ID to connectwise.com/company/trust/report-abuse pe anydesk.com/en/abuse.

Fesili e fai soo¶

The scammer showed me my Windows Event Viewer and netstat in Command Prompt and it was full of thousands of warnings, errors, and "FOREIGN ADDRESS" connections. Was my computer actually hacked before I called them?¶

Leai `eventvwr` (Windows Event Viewer) ma `netstat` are normal administrative utilities built into every copy of Windows, and scammers abuse them as psychological props. O komipiuta Windows soifua maloloina uma e gaosia le faitau afe o Lapataiga samasama masani ma le mumu Error logs i Event Viewer i taimi masani faʻaoso-ups ma faʻafouga talaaga, ma `netstat` lists every normal background connection your browser and operating system make to cloud servers as a "Foreign Address." Sa saogalemu atoatoa lau komepiuta se'ia o'o i le taimi na e mulimuli ai i le fa'atonuga a le tagata vala'au e la'u mai ma fa'agaoioi le latou meafaigaluega avanoa mamao.

How did the scammer make my real bank website show that they accidentally deposited $40,000 into my checking account if they cannot hack the bank's server?¶

Aʻo faʻafesoʻotaʻi i lau komepiuta e ala i AnyDesk poʻo le ScreenConnect, e faʻapipiʻi e le scammer lau mata mo le 15 sekone, kiliki-saʻo lau paleni faletupe i lau 'upega tafaʻilagi, ma kiliki **"Inspect" (`Developer Tools`)**. This opens the local HTML text displayed in your browser tab. O le tagata taufaavalea na o le fa'akomipiuta `$45,200.00` i luga o lou moni `$5,200.00` faapaleni ma fa'aopoopo i ai se faitau laina o tusitusiga pepelo `"ACH REFUND OVERPAYMENT +$40,000.00"` i luga o lau lau. This edit exists only inside your browser tab's temporary memory (`DOM`) and vanishes the instant you refresh the page (`F5`) pe siaki lau paleni i lau telefoni feaveaʻi. I le isi itu, latou te fesiitai `$40,000` from your own savings account or credit line into your checking account and relabel the screen to trick you into wiring your own money to them.

If I uninstalled AnyDesk or UltraViewer from the Control Panel, am I safe to turn my Wi-Fi back on?¶

Usually not without inspecting Windows Services (`services.msc`) i le Safe Mode muamua. Professional tech support scam call centers know that victims often uninstall AnyDesk or UltraViewer as soon as they hang up. O le mea lea, i totonu o le lua minute muamua o le faʻafesoʻotaʻi i lau PC, e masani ona faʻaogaina e tagata faʻatauvaʻa le faʻaogaina o faila le leoa e faʻaumatia ai se lua, natia **ConnectWise ScreenConnect** (`ScreenConnect.ClientService.exe`) or **SimpleHelp** agent that does not create a desktop shortcut and hides inside `C:\Program Files (x86)\ScreenConnect Client (xxxx)`. Se'i vagana ua e fa'amaonia ile Safe Mode e leai se rogue `SYSTEM` 'au'aunaga po'o galuega fa'atulagaina o lo'o i ai, po'o le faia o se solo atoa USB OS, toe fa'afeso'ota'i i le Wi-Fi e mafai ona toe tu'u vave atu lau PC i le tagata osofa'i.

Can a scammer access other computers or smartphones on my home Wi-Fi network just because I installed AnyDesk on one laptop?¶

Installing AnyDesk or ScreenConnect compromises the specific computer where you ran the installer, not your phones or other laptops directly. Ae peita'i, afai e te fa'aogaina le **Google Chrome, Microsoft Edge, po'o le Apple iCloud password ma le session syncing** i luga o lau komepiuta feavea'i ma le telefonipoto, so'o se uputatala e gaoia pe suia e le sikola i luga o le komepiuta feavea'i o le a a'afia ai au tala fa'asoa ao. Also, while connected to your laptop, an attacker can log into your home router's admin page (`192.168.1.1`) if it still uses the default admin password and alter your router's `DNS` faatulagaga. A maeʻa ona faʻaesea le komepiuta feaveaʻi, falegaosimea-toe setiina lau router Wi-Fi poʻo le faʻamaonia o ona faʻamautu DNS ma admin password mai se masini mama.

Taiala fa'atatau¶

• Tech support pop-up scam and remote desktop AnyDesk/TeamViewer removal
• O le faoa o kuki o sauniga, fa'amatalaga fa'akomepiuta, ma le soloia o passkey
• Fake CAPTCHA ClickFix PowerShell Win+R clipboard malware ma Lumma Infostealer toe faaleleia
• Authorized push payment (APP) app fraud: Zelle, Venmo, and Faster Payments impersonation and reimbursement rights
• Soliga tupe a le faletupe
• Numera o fa'alavelave fa'afuase'i ile atunu'u

Punavai ma ta'iala aloa'ia¶

• Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), National Security Agency (NSA), & Multi-State Information Sharing and Analysis Center (MS-ISAC) (United States): Joint Cybersecurity Advisory (AA23-025A): Protecting Against Malicious Use of Remote Monitoring and Management (RMM) Software.
• Consumer Financial Protection Bureau (CFPB) (United States): Electronic Fund Transfers (Regulation E, 12 CFR Part 1005) Official Interpretations and FAQs on Unauthorized EFTs and Fraudulently Induced Access.
• Federal Trade Commission (FTC) (United States): How To Spot, Avoid, and Report Tech Support Scams.
• National Cyber ​​Security Center (NCSC) & Action Fraud (United Kingdom): Protecting Devices from Unauthorised Remote Access Tools and Screen-Sharing Fraud.
• ConnectWise Trust & Security Response Center: Identifying and Removing Rogue ScreenConnect (ConnectWise Control) Client Instances.