Fake Tech Support Pop-Up Scams and Removing Unauthorized Remote Access Tools¶

When your computer screen suddenly locks into a blaring, full-screen red or blue alert claiming "Windows Defender Security Center: Trojan.Spyware Detected, Call Microsoft Support Immediately at 1-800-..." (or an Apple macOS equivalent claiming your iCloud and bank accounts are under attack), you are looking at a Fake Tech Support Pop-Up Scam. Even though the screen flashes official logos, plays a loud siren or robotic voice through your speakers, and freezes your mouse cursor so you cannot click the X button, your computer does not have a virus. It is simply a malicious webpage abusing your browser's Full-Screen API (F11), Pointer Lock API, and Web Audio loop to panic you into calling a criminal call center.

However, the danger becomes real the moment you call the phone number on screen and allow the "technician" to install a legitimate commercial Remote Monitoring and Management (RMM) or remote desktop tool, such as AnyDesk, TeamViewer, ConnectWise ScreenConnect, UltraViewer, RustDesk, LogMeIn Rescue, Zoho Assist, or Quick Assist. Once inside your computer, scammers black out your monitor ("installing a security patch"), open your saved browser passwords and online banking sessions, manipulate your bank webpage HTML to make it look like they accidentally "over-refunded" you 40,000 dollars, and install persistent Unattended Access Windows Services so they can log back into your computer at 3:00 AM after you hang up. This guide shows you how to break out of the frozen browser screen in 5 seconds, sever active remote connections immediately, purge hidden RMM background services, and lock down your financial accounts.

Fai nei loa¶

1. UNPLUG your Ethernet cable, turn OFF Wi-Fi on your computer, or unplug your home Wi-Fi router from the wall power outlet right now. If you already called the phone number or let someone connect to your computer, do not waste time arguing with the scammer on the phone or trying to close their window with your mouse (they can lock your mouse and black out your screen). Physically pulling the plug on your Wi-Fi router or holding your computer's physical power button down for 10 seconds until it powers off severs their remote control session instantly.
2. If you HAVE NOT called the number and are only stuck on the loud, flashing "Virus Alert" screen, press and hold Alt + F4 (or Ctrl + Shift + Esc to kill the browser in Task Manager) on Windows, or press Command + Option + Escape to Force Quit Safari/Chrome on a Mac. You have not been hacked yet. The alarm is just a web browser tab running in full-screen kiosk mode. Once you force-quit the browser, re-open it and DO NOT click "Restore Pages", and your computer is 100 percent clean.
3. If you DID let the caller connect to your computer or smartphone, call your bank, credit union, and brokerage fraud departments from a separate phone immediately. Even if you did not type your bank password while they were watching, scammers run automated scripts over AnyDesk/ScreenConnect file-transfer channels that copy your browser's Login Data saved passwords and active session cookies in under 10 seconds, or initiate invisible ACH/Zelle/Wire transfers behind a blacked-out "Windows Update" curtain screen. Follow our bank account breach guide right now.
4. Boot your computer with Wi-Fi and Ethernet COMPLETELY DISCONNECTED (or in Windows Safe Mode) before uninstalling AnyDesk, TeamViewer, ScreenConnect, or UltraViewer. Simply clicking the X on AnyDesk or TeamViewer does not remove the scammer's access if they configured "Unattended Access" or installed a silent ConnectWise ScreenConnect (ScreenConnect.ClientService) Windows background service. Keep the computer offline while you uninstall every remote tool created today and disable its Windows Service / macOS LaunchDaemon using the steps below.
5. Never buy gift cards, withdraw physical cash, deposit checks, or send cryptocurrency or wire transfers to "reverse an accidental overpayment refund." A signature trick of tech support scammers is to press F12 (Browser Developer Tools) while logged into your bank account, edit the HTML text of your checking balance from $2,500 to $42,500, and cry in panic claiming they "accidentally typed $40,000 instead of $400 on your refund form and will be fired unless you wire or mail back the extra $39,600." Not a single cent was actually deposited into your account; they either edited the numbers on your screen or transferred $40,000 from your own savings/HELOC account into your checking account.
6. If a scammer claims they are sending "federal agents" or a "courier" to your house to pick up cash or gold bars, call the police immediately. Moving from phone manipulation to sending a physical money mule courier to your front door is an active felony crime in progress. Lock your doors and call your local emergency number (911 in the United States and Canada, 112 across the European Union, 999 in the United Kingdom, or see our numera fa'afuase'i directory).

Tech support scam & remote access containment decision tree¶

flowchart TD
    Root["Encountered Tech Support Pop-Up, Fake Invoice Email, or Remote Access Scam"] --> DidConnect{"Did You Call the Number or Let Someone Connect to Your Computer/Phone?"}

    DidConnect -->|"NO: Only saw the loud flashing pop-up screen in browser"| BrowserKill["1. Windows: Press Ctrl+Shift+Esc -> End Task on Chrome/Edge/Firefox<br/>2. Mac: Press Cmd+Option+Esc -> Force Quit Safari/Chrome<br/>3. Reopen browser WITHOUT clicking 'Restore Pages' -> Clear cache & block site notifications<br/>(Zero malware installed; you are 100% safe)"]

    DidConnect -->|"YES: Installed software, typed a 9-digit code, or entered a URL they gave me"| CutNet["STEP 1: IMMEDIATELY Disconnect Wi-Fi & Unplug Ethernet Cable (or Unplug Router)"]

    CutNet --> BankLock["STEP 2: From a clean phone, call your Bank/Brokerage Fraud Dept to freeze accounts, cancel cards, and block wires"]

    BankLock --> PurgeRMM["STEP 3: While PC is OFFLINE, uninstall AnyDesk, TeamViewer, UltraViewer, RustDesk AND kill hidden ScreenConnect / GoTo services"]

    PurgeRMM --> AuditSys["STEP 4: Delete rogue Windows Admin users ('net user'), remove startup tasks, undo 'syskey' or BitLocker traps, and run Defender Offline Scan"]

    AuditSys --> RotateCreds["STEP 5: From a clean device, rotate Email, Bank, and Password Manager passwords & click 'Sign Out of All Sessions'"]

Phase 1: How to close a frozen, full-screen "Virus Alert" pop-up (If you did NOT call them)¶

Why does the fake Microsoft or Apple warning lock up your mouse cursor and refuse to let you click the close button? When you accidentally clicked on a typo-squatted domain (like youtbe.com pe espnn.com) or a malicious ad network redirect, the webpage triggered three legitimate HTML5 browser APIs in a rapid 10-millisecond loop: 1. Element.requestFullscreen(): Stretches the webpage over your entire monitor, hiding your Windows taskbar, Mac Dock, and browser tabs. 2. Element.requestPointerLock(): Captures your mouse cursor inside an invisible 1-pixel box (originally designed for 3D browser games like Minecraft), making it appear that your mouse is frozen. 3. window.onbeforeunload + window.print() dialog loops: Pops up endless dialog boxes so clicking Esc immediately re-triggers full screen.

How to kill the pop-up in 10 seconds on Windows, macOS, Chromebook, and iPad¶

1. On Windows 10 and Windows 11:
2. Press Ctrl + Shift + Esc on your keyboard (this opens Windows Task Manager directly over top of the frozen browser).
3. (If your mouse cursor is still trapped, use the Down Arrow key on your keyboard to highlight Google Chrome, Microsoft Edge, or Mozilla Firefox, and press the Delete key or Alt + E to click End Task).
4. Important step when reopening your browser: When you open Chrome or Edge again, a small bubble in the top-right corner will ask: " Chrome didn't shut down correctly. [Restore]". DO NOT click Restore (clicking Restore reopens the malicious tab). Click the X to dismiss the bubble.
5. On Apple macOS (MacBook / iMac):
6. Press Command (⌘) + Option (⌥) + Escape on your keyboard to open the Force Quit Applications window.
7. Select Safari or Google Chrome and click Force Quit.
8. Hold down the Shift key on your keyboard while clicking the Safari or Chrome icon in your Dock to launch it. Holding Shift during launch forces macOS to open a clean blank window without restoring the previous session's locked tabs.
9. Eliminate Recurring Desktop Notification Pop-Ups ("McAfee: 5 Viruses Found" in bottom-right corner):
10. If you are seeing virus warnings slide out of the bottom-right corner of your Windows taskbar (or top-right corner of your Mac screen) even when you are on a normal website, you accidentally clicked "Allow" on a browser Push Notification prompt days ago.
11. In Chrome: Copy and paste chrome://settings/content/notifications into the address bar. Look under the "Allowed to send notifications" list, click the three dots (⋮) next to every unfamiliar website, and select Remove / Block.
12. In Microsoft Edge: Open edge://settings/content/notifications and remove all unrecognized sites under Allow.
13. In Apple Safari (macOS): Open Safari > Settings > Websites > Notifications and select Deny or Remove for every unfamiliar website.

Phase 2: Complete removal of scammer Remote Access Tools (RMM Purge Protocol)¶

If you called the scammer and followed their instructions to visit a website (such as anydesk.com, ultraviewer.net, help.me, fastsupport.com, or a custom link like support247.screenconnect.com) and ran a downloaded file, keep your computer completely disconnected from the internet (Wi-Fi OFF, Ethernet unplugged) while you audit and remove every remote access backdoor.

Why scammers install two or three different remote access tools at once¶

As soon as a scammer connects to your PC via AnyDesk or Windows Quick Assist, their very first silent background move (while distracting you on the phone) is to install a second, invisible enterprise Remote Monitoring & Management (RMM) agent, most commonly ConnectWise ScreenConnect (ScreenConnect Client), Atera, Syncro, MeshCentral, SimpleHelp, or Tactical RMM. - Why? Because even if you get suspicious, hang up the phone, and uninstall AnyDesk from your desktop, ScreenConnect runs as a hidden NT AUTHORITY\SYSTEM Windows background service (ScreenConnect Client (xxxx)) with no desktop icon. The moment your PC reconnects to Wi-Fi, the scammer still has 100 percent silent, unattended root access to your machine.

Master lookup table of Remote Access & RMM tools abused by scammers¶

Step-by-step PowerShell script to detect, stop, and eradicate all hidden RMM services (Windows)¶

While your Windows PC is offline, right-click the Start button -> click Terminal (Admin) or PowerShell (Admin), and run this diagnostic and neutralization script to reveal and disable every remote access service installed on your computer:

# 1. List all running or installed Windows Services matching common RMM / Remote Access tools:
Get-Service | Where-Object {
    $_.DisplayName -match "AnyDesk|TeamViewer|ScreenConnect|ConnectWise|UltraViewer|RustDesk|Zoho|LogMeIn|GoTo|Supremo|SimpleHelp|Mesh Agent|Atera|Syncro|Splashtop" -or
    $_.Name -match "AnyDesk|TeamViewer|ScreenConnect|UltraViewer|RustDesk|Zoho|LMI|GoTo"
} | Select-Object Status, Name, DisplayName

# 2. Immediately STOP and DISABLE every matched remote access service so it can never start again:
Get-Service | Where-Object {
    $_.DisplayName -match "AnyDesk|TeamViewer|ScreenConnect|ConnectWise|UltraViewer|RustDesk|Zoho|LogMeIn|GoTo|Supremo|SimpleHelp|Mesh Agent|Atera|Syncro|Splashtop"
} | ForEach-Object {
    Stop-Service -Name $_.Name -Force -ErrorAction SilentlyContinue
    Set-Service -Name $_.Name -StartupType Disabled -ErrorAction SilentlyContinue
    Write-Host "Stopped and Disabled Service: $($_.DisplayName)"
}

# 3. Check for any software or folders created or modified in the last 72 hours in Program Files & ProgramData:
Get-ChildItem -Path "C:\Program Files", "C:\Program Files (x86)", "C:\ProgramData", "$env:APPDATA", "$env:LOCALAPPDATA" -Directory -Force -ErrorAction SilentlyContinue |
  Where-Object { $_.CreationTime -gt (Get-Date).AddDays(-3) } |
  Select-Object CreationTime, FullName

After stopping the services in PowerShell: 1. Press Win + R, type appwiz.cpl, and press Enter to open the classic Programs and Features control panel. 2. Click the "Installed On" column header to sort all installed programs from Newest to Oldest. 3. Uninstall every program installed on the date of the scam (including AnyDesk, TeamViewer, UltraViewer, RustDesk, ScreenConnect Client, Zoho Assist, GoTo Opener, or fake " antivirus / driver cleaners"). 4. Delete leftover ScreenConnect & AnyDesk folders: In File Explorer, delete C:\Program Files (x86)\ScreenConnect Client*, C:\ProgramData\AnyDesk, ma %APPDATA%\AnyDesk (deleting C:\ProgramData\AnyDesk\service.conf destroys the scammer's saved unattended password hash and AnyDesk ID).

Step-by-step removal of Remote Access LaunchDaemons on Apple macOS¶

On a Mac (with Wi-Fi turned OFF), scammers install persistent background agents inside /Library/LaunchDaemons ma /Library/LaunchAgents. Open Terminal (Applications > Utilities > Terminal) and run:

# 1. Inspect all third-party background LaunchDaemons and LaunchAgents for remote access tools:
ls -la /Library/LaunchDaemons /Library/LaunchAgents ~/Library/LaunchAgents

# 2. Unload and delete any ScreenConnect, AnyDesk, TeamViewer, Zoho, or LogMeIn persistence plists:
sudo launchctl bootout system /Library/LaunchDaemons/*screenconnect* 2>/dev/null
sudo launchctl bootout system /Library/LaunchDaemons/*anydesk* 2>/dev/null
sudo launchctl bootout system /Library/LaunchDaemons/*teamviewer* 2>/dev/null
sudo rm -rf /Library/LaunchDaemons/*screenconnect* /Library/LaunchAgents/*screenconnect* /opt/screenconnect*
sudo rm -rf /Applications/AnyDesk.app ~/.anydesk /Library/LaunchDaemons/*anydesk* /Library/LaunchAgents/*anydesk*
sudo rm -rf /Applications/TeamViewer.app /Library/LaunchDaemons/*teamviewer* /Library/LaunchAgents/*teamviewer*

Phase 3: Reversing "Scammer Retaliation Locks" (msconfig Safe Boot Lock, net user Loka Upu Fa'amatalaga, ma mailei BitLocker)¶

When a tech support scammer realizes you are refusing to pay them or hanging up the phone, they frequently spend their final 15 seconds on your computer trying to lock you out of Windows so they can extort you for a "unlock password":

1. Reversing the msconfig "Safe Boot with No Network" Lockout Trap¶

Scammers love to press Win + R -> type msconfig -> check Safe boot (Minimal) -> change your local Windows user account password via net user -> and force a reboot. When your PC reboots into offline Safe Mode, your normal Windows Hello PIN is disabled and Windows asks for the password the scammer just set. - How to break out: 1. At the Windows login screen, hold down the Shift key while clicking the Power icon -> Restart to enter the blue Windows Recovery Environment (WinRE) -> Troubleshoot > Advanced options > Command Prompt. 2. If the scammer disabled normal boot in bcdedit (safeboot minimal), run this command to restore normal boot immediately:

bcdedit /deletevalue {default} safeboot

net user

2. Checking if the Scammer Stole Your Saved Browser Passwords (Login Data / iCloud Keychain)¶

While your screen was blacked out by TeamViewer or ScreenConnect's "Black Monitor" feature, did the scammer export your passwords? - Open Google Chrome (chrome://password-manager/settings) or Microsoft Edge (edge://wallet/settings). Scammers routinely click "Export passwords" (or copy your %LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data SQLite file and Local State DPAPI key) within 30 seconds of connecting. - Assume every single username and password stored inside your web browser was copied by the scammer. Use a separate, clean computer or smartphone to change your email, banking, brokerage, tax, Amazon, and social media passwords, and revoke active browser sessions using our session token hijacking and global session revocation taiala.

3. Auditing and Removing Remote Access Apps Installed on Android or iPhone (AnyDesk / TeamViewer QuickSupport)¶

Increasingly, tech support and fake "Geek Squad / Amazon / Norton Refund" scammers also force victims to install AnyDesk Remote Control or TeamViewer QuickSupport on their iPhone or Android smartphone so the scammer can read incoming bank 6-digit SMS 2FA texts directly off the victim's phone screen while initiating a wire transfer on the laptop: - On Android: Turn ON Airplane Mode, open Settings > Apps > See all apps, and uninstall AnyDesk, TeamViewer QuickSupport, Zoho Assist, or any "AdControl / plugin" helper package. Next, open Settings > Accessibility -> Downloaded apps and make sure no remote control plugin holds Accessibility privileges. - On iPhone / iPad: On iOS, AnyDesk and TeamViewer cannot move your fingers directly, but they stream your live iPhone screen (including incoming SMS 2FA banners) via Apple's Screen Broadcast extension. Swipe down from the top-right corner to open Control Center, verify the red Screen Recording / Screen Broadcast button is turned OFF, delete the AnyDesk or TeamViewer app from your Home Screen, and check Settings > General > VPN & Device Management to delete any unknown configuration profiles.

Phase 4: Financial containment if you paid, logged into your bank, or uploaded ID¶

If the scammer saw you log into your bank, convinced you to pay for a "5-year firewall subscription," or tricked you with the fake "$40,000 overpayment refund" HTML edit:

1. If you logged into Online Banking while the scammer was connected:
2. Call your bank's Fraud Department immediately. Tell them: "I was the victim of a remote-access tech support scam where a criminal had control of my computer via AnyDesk/ScreenConnect while my online banking session was open."
3. Ask the bank to:
   • Close your exposed checking and savings account numbers and open new account numbers (because scammers open your PDF monthly statements inside your bank portal to copy your full Routing Number and Account Number for future ACH debit fraud).
   • Cancel any pending ACH transfers, Zelle payments, Bill Pay checks, or wire transfers.
   • Check if the scammer transferred money between your own internal accounts (for example, moving $25,000 from your Savings or Home Equity Line of Credit into your Checking account to fake an "overpayment refund").
   • Revoke all active OAuth aggregator tokens (Plaid, Yodlee, Finicity) and reset your online banking username, password, and security questions.
4. If you bought Target, Apple, Razer Gold, Lowe's, Home Depot, or Steam Gift Cards:
5. Even if you already read the PIN numbers on the back of the gift cards to the scammer, call the official Gift Card Fraud / Customer Service number on the back of the physical card immediately with the card receipt in hand. Major issuers (Apple, Target, Home Depot, Lowe's, Walmart) can freeze the remaining unspent balance on stolen gift card numbers and refund you if caught before the scammer's gift-card laundering broker liquidates them.
6. If you handed over your Social Security Number, Medicare number, or a photo of your Driver's License / Passport:
7. Place an immediate, free Security Freeze on your credit reports at Equifax, Experian, and TransUnion (and ChexSystems for bank accounts) using our identity theft response and credit recovery taiala.

Prevention: How to scam-proof your computer and protect aging parents or relatives¶

If you are cleaning up a computer for yourself, a parent, or a grandparent after a tech support scam, apply these four technical guardrails in five minutes so a scammer can never connect again:

• Install an Ad & Malvertising Blocker (uBlock Origin / uBlock Origin Lite) in every browser: Over 90 percent of fake full-screen Microsoft and Apple virus pop-ups are served through malicious ad-exchange redirects on news, recipe, crossword, or typo-squatted websites. Installing uBlock Origin blocks 99.9 percent of fake tech support pop-up domains before they ever load.
• Switch the home router or browser DNS to a Malware-Blocking DNS Resolver (1.1.1.2 pe 9.9.9.9): Set the computer or router DNS to Cloudflare for Families (1.1.1.2 ma 1.0.0.2) or Quad9 (9.9.9.9), which automatically block newly registered tech support scam domains at the DNS layer.
• Create a Windows Software Restriction / AppLocker or Firewall Rule Blocking AnyDesk.exe, ScreenConnect, ma UltraViewer: On a relative's computer who never legitimately uses third-party remote desktop tools, convert their daily Windows account from an Administrator account to a Standard User account (keeping a separate, password-protected Administrator account for family IT maintenance) so they cannot silently install SYSTEM-level RMM services without an administrator PIN.
• Tape a physical reminder label to the top bezel of the computer monitor: Write clearly on a small label: "Microsoft, Apple, Geek Squad, and your Bank will NEVER pop up a phone number on screen or ask you to install AnyDesk/UltraViewer. Press Ctrl+Shift+Esc to close."

Fesili e fai soo¶

Taiala fa'atatau¶

• Malware, ransomware, ma fa'ama'i pipisi
• Session token hijacking, infostealer malware, and passkey revocation
• Soliga tupe a le faletupe ma fesiitaiga uaea e le'i fa'atagaina
• Tali o le gaoi fa'asinomaga ma le toe fa'aleleia o aitalafu
• Loka le pule o upu fa'apolokalame ma le toe fa'aleleia o vault fa'afuase'i
• Deepfake leo clone ma AI faafoliga taufaasese
• Fa'atonu numera o fa'alavelave

Punavai ua siaki¶

• Federal Trade Commission (FTC) (United States): How to Spot, Avoid, and Report Tech Support Scams (Pop-Up Warnings, Refund Overpayment Scams, and Gift Card Fraud).
• Cybersecurity and Infrastructure Security Agency (CISA), FBI, and NSA Joint Cybersecurity Advisory (AA23-025A) (United States): Protecting Against Malicious Use of Remote Monitoring and Management (RMM) Software (ConnectWise ScreenConnect and AnyDesk Abuse).
• National Cyber Security Centre (NCSC) & Action Fraud (United Kingdom): * Dealing with Suspicious Tech Support Calls and Unauthorised Remote Access Removal*.
• Microsoft Security Response Center & Apple Platform Security: Official Guidance on Tech Support Scams (support.microsoft.com/security), Browser Fullscreen/PointerLock Abuse, and Removing Unauthorized Configuration Profiles.