Remote access trojan (ScreenConnect, AnyDesk, RustDesk, UltraViewer) tech support scam: pulling ethernet, killing services, and bank freeze¶

When a scammer convinces you to install a remote desktop tool or executes a remote monitoring agent on your computer, they gain live, unrestricted control over your mouse, keyboard, file system, and active browser sessions. While displaying a fake security scan or a black privacy curtain on your monitor, the operator silently drains checking accounts, harvests saved passwords, and installs persistent background services that survive standard reboots. This guide provides immediate steps to sever the attacker's data link, permanently eradicate unattended remote access services, and lock down your banking and credit infrastructure before funds clear the wire network.

Gawin ito ngayon¶

1. Sever all internet connectivity physically and immediately. Unplug the Ethernet cable from the back of your desktop or router, flip the physical Wi-Fi switch on your laptop, or press and hold the power button on your Wi-Fi router for 10 seconds until all lights go dark. Do not waste time trying to fight the scammer for control of the mouse cursor to click the disconnect button.
2. Sapilitang i-shutdown ang nakompromisong computer kung naka-black out ang screen. Kung na-enable ng attacker ang "Blank Guest Monitor" o na-lock ang input ng iyong keyboard, pindutin nang matagal ang pisikal na power button ng iyong computer sa loob ng 10 buong segundo hanggang sa tuluyang mag-off ang makina. Iwanan itong naka-off habang sini-secure mo ang iyong mga financial account mula sa isang hiwalay at malinis na device.
3. Tumawag sa departamento ng pandaraya ng iyong bangko mula sa isang independiyenteng telepono. Gumamit ng cellular phone upang tawagan ang opisyal na numero na naka-print sa likod ng iyong debit o credit card, o tawagan ang iyong lokal na numerong pang-emergency (911 sa United States at Canada, 112 sa buong European Union, 999 sa United Kingdom) kung ang isang aktibong banta ng pangingikil ay nagaganap; tingnan mo mga numerong pang-emergency para sa mga internasyonal na kontak. Atasan ang bangko na maglagay ng agarang hard freeze sa lahat ng checking, savings, at line-of-credit account, at humiling ng emergency recall sa anumang nakabinbing Automated Clearing House (ACH), wire, o real-time na mga paglilipat ng pagbabayad.
4. Bawiin ang cookies ng aktibong session at palitan ang mga password mula sa isang malinis na smartphone. Gamit ang iyong telepono sa cellular data (hindi nakakonekta sa iyong home Wi-Fi kung naka-on muli ang nakompromisong PC), mag-log in sa iyong pangunahing email, banking portal, at cloud storage account. Wakasan ang lahat ng aktibong session sa pag-log in, bawiin ang hindi nakikilalang Multi-Factor Authentication (MFA) na device, at i-rotate ang iyong mga password.
5. I-boot ang infected na computer sa Safe Mode Without Networking. I-on lang muli ang nakompromisong computer habang nakadiskonekta sa internet, papasok sa Windows Safe Mode o macOS Safe Mode upang siyasatin at alisin ang mga serbisyo sa background na hindi nag-aalaga (ScreenConnect Client, AnyDesk Service, RustDesk Service) bago i-load ng operating system ang mga driver ng third-party na network.

Pag-unawa sa anatomy ng isang komersyal na RMM at remote desktop attack¶

Ang mga modernong panloloko sa teknikal na suporta, mga panloloko sa refund, at mga pag-atake sa pagpapanggap sa bangko ay bihirang umasa sa mga custom-written na computer virus. Sa halip, inaabuso ng mga banta ng aktor ang lehitimong, digitally sign na Remote Monitoring and Management (RMM) software at komersyal na remote desktop tool. Dahil ang mga executable na ito ay may mga wastong cryptographic code-signing certificate mula sa mga pinagkakatiwalaang software vendor, hindi hinaharangan ng mga karaniwang antivirus program tulad ng Windows Defender o macOS XProtect ang kanilang pag-install.

Paano ginagamit ng mga umaatake ang mga lehitimong remote na binary ng suporta¶

Kapag ang isang biktima ay tumawag sa isang walang bayad na numero na ipinapakita sa isang pekeng browser pop-up, tumugon sa isang agarang invoice na email, o sumunod sa mga tagubilin mula sa isang pekeng bank fraud investigator, ang operator ay nagtuturo sa kanila na mag-download ng isang executable o MSI installer. Kabilang sa mga pinaka-mabigat na inabusong platform ang:

• ConnectWise ScreenConnect (dating Control): Madalas na na-deploy sa pamamagitan ng customized .msi o .exe package na naka-host sa isang server na kinokontrol ng attacker. Kapag naisakatuparan, nag-i-install ito bilang isang patuloy na Serbisyo ng Windows System (ScreenConnect Client (xxxx)) tumatakbo kasama NT AUTHORITY\SYSTEM mga pribilehiyo, pagbibigay ng tahimik, walang nag-aalaga na pag-access sa tuwing online ang computer.
• AnyDesk (anydesk.exe): Madalas na ginagamit sa mga cross-platform na scam na nagta-target sa Windows, macOS, at mga mobile device. Inutusan ng mga umaatake ang biktima na basahin nang malakas ang 9-digit na AnyDesk address, humiling ng administrative elevation, at magtakda ng "Unattended Access Password" upang muling kumonekta habang natutulog ang biktima.
• RustDesk (rustdesk.exe): Isang open-source na remote desktop tool na pinapaboran ng mga scam syndicate dahil maaari silang mag-self-host ng mga server ng relay, na lampasan ang mga pagtanggal ng pang-aabuso ng vendor.
• UltraViewer, TeamViewer, Zoho Assist, at SimpleHelp: Karaniwang magkakadena. Ang isang scammer na kumokonekta sa pamamagitan ng UltraViewer o AnyDesk ay madalas na tahimik na nag-i-install ng isang nakatago ScreenConnect o SimpleHelp package sa background bilang backup backdoor.

Emergency na daloy ng trabaho: pinuputol ang koneksyon at pagsubok ng pinsala¶

Gamitin ang sumusunod na flowchart ng pagpapatakbo upang ihinto ang isang aktibong remote session, ihiwalay ang workstation, at matukoy kung ang makina ay maaaring linisin sa Safe Mode o nangangailangan ng kumpletong pagpunas ng operating system.

flowchart TD
    A["Aktibo o Kamakailang Remote Access Scam Natukoy"] --> B["Pisikal na I-unplug ang Ethernet Cable at I-off ang Wi-Fi Router"]
    B --> C{"Naka-Black Out ba ang Screen o Naka-lock ang Mouse?"}
    C -- "Oo" --> D["Hawakan ang Pisikal na Power Button ng PC sa loob ng 10 Segundo para Puwersahang I-off"]
    C -- "Hindi" --> E["I-ON ang Airplane Mode at I-shut Down ang PC Normally"]
    D --> F["Gumamit ng Malinis na Smartphone sa Cellular Data para Tawagan ang Bank Fraud Dept"]
    E --> F
    F --> G["I-freeze ang Checking/Savings, Recall Wires/Zelle, Lock Credit Bureaus"]
    G --> H["Mula sa Malinis na Smartphone: I-rotate ang Email/Bank Password at Patayin ang Mga Session"]
    H --> I{"Ang Scammer ba ay Nagkaroon ng Unattended Access o Nagpatakbo ng CMD/PowerShell?"}
    I -- "Oo (Mataas na Panganib)" --> J["I-boot ang PC Offline sa Safe Mode para Iligtas ang Mga Personal na Docs Lang"]
    I -- "Hindi (Maikling Pinangangasiwaang Session)" --> K["Mag-boot Offline sa Safe Mode para I-purge ang Mga Serbisyo at Cert ng RMM"]
    J --> L["Magsagawa ng Full Clean OS Reinstall sa pamamagitan ng USB Media Mula sa Clean PC"]
    K --> M["Alisin ang Mga Serbisyo, Mga Naka-iskedyul na Gawain, AppData, at Mga Extension ng Browser sa Pag-audit"]

Paghahambing ng mga remote access tool na inaabuso ng mga scammer¶

Bago subukang linisin ang isang makina o iulat ang insidente sa forensic fraud team ng iyong bangko, tukuyin kung aling (mga) remote na tool ang na-install. Tandaan na ang mga scammer ay karaniwang nag-i-install ng dalawa o tatlong magkakaibang tool sa isang session upang kung i-uninstall mo ang nakikitang desktop icon, mananatiling aktibo ang kanilang nakatagong pangalawang serbisyo.

Step-by-step banking at financial triage (Unang 30 minuto)¶

Sa isang remote access scam, ang impeksyon sa computer ay ang mekanismo ng paghahatid lamang; ang pangunahing emerhensiya ay matinding pagnanakaw sa pananalapi. Gumagamit ang mga umaatake ng sikolohikal at teknikal na mga panlilinlang, gaya ng pag-edit ng HTML source code (Inspect Element) ng webpage ng iyong bangko upang gayahin ang isang hindi sinasadya $40,000 sobrang bayad sa halip na $400, para linlangin ka sa pag-wire ng pera, pagbili ng mga gift card, o pagdeposito ng cash sa isang Bitcoin ATM. Kahit na tumanggi kang magpadala ng pera, ang isang umaatake na may malayuang pag-access ay maaaring direktang magpasimula ng mga paglilipat habang naka-black out ang iyong screen.

1. Maglagay ng agarang hard freeze at simulan ang mga pagpapabalik sa paglipat¶

Tawagan kaagad ang dedikadong departamento ng pandaraya ng iyong institusyong pampinansyal gamit ang malinis na telepono. Sabihin nang malinaw: "Ang aking computer ay nakompromiso ng isang malayuang pag-access trojan sa panahon ng isang tech support/panggagaya sa bangko scam. Ang isang hindi awtorisadong partido ay nagkaroon ng live na access sa aking online banking session." Humingi ng mga sumusunod na partikular na pagkilos:

• Lockout ng Profile sa Online Banking: Ipa-disable sa bangko ang iyong mga kredensyal sa pag-log in sa online at mobile banking at ipawalang-bisa ang lahat ng aktibong token ng OAuth at cookies ng session.
• ACH, Wire, at RTP Recall (SWIFT / Fedwire / Faster Payments): Hilingin sa kinatawan na siyasatin ang iyong account para sa anumang nakabinbin o nakapila palabas na Automated Clearing House (ACH) paglilipat, domestic/internasyonal na wire transfer, Zelle / Venmo payments, or "Bill Pay" checks scheduled for future dates. Scammers often schedule a Bill Pay check or post-dated ACH transfer set to execute 3 to 5 days later hoping you will not notice.
• Account Number Substitution: Dahil malamang na tiningnan ng attacker ang iyong buong routing at checking account number (o na-download na PDF bank statement mula sa iyong browser), hindi sapat ang pag-freeze ng debit card lamang. Dapat mong hilingin na isara ng bangko ang mga nakompromisong account number at i-transition ang iyong mga balanse sa mga bagong account number na may "Mag-post ng Walang Mga Debit" (PND) restrictions on the old accounts.
• Suriin ang mga Hidden Internal Transfers o Cash Advances: Ang mga attacker ay madalas na kumukuha ng cash advance mula sa iyong naka-link na credit card o Home Equity Line of Credit (HELOC) and transfer it into your checking account first, either to make you believe they "accidentally over-refunded" you, or to pool maximum liquidity before wiring the combined balance offshore. Tell the bank fraud specialist to check if any intra-bank transfers occurred between your savings, credit card, or brokerage accounts.

2. Freeze credit bureaus and check for new loan applications¶

While connected to your PC, scammers routinely search your Downloads o Documents folders for keywords like tax, 1040, W2, passport, license, o password and exfiltrate your tax returns and ID scans.

1. Place a free Security Freeze at all major credit bureaus immediately using your clean smartphone:
2. In the United States: Freeze Equifax (1-888-298-0045), Experian (1-888-397-3742), TransUnion (1-800-916-8800), and ChexSystems (1-800-428-9687).
3. In the United Kingdom: Contact Experian, Equifax, and TransUnion, and register for Cifas Protective Registration.
4. In Canada: Place credit freezes or fraud alerts with Equifax Canada and TransUnion Canada.
5. In Australia: Request a credit ban through Equifax, Illion, and Experian.
6. Review your credit report immediately for hard inquiries made in the last 24 hours; scammers often apply for instant online personal loans in a background browser tab while talking to you.

Eradicating remote access services in Safe Mode (Windows and macOS)¶

If you decide to inspect the machine, preserve forensic logs for law enforcement, or rescue irreplaceable personal photos before wiping the hard drive, never boot the computer into normal mode while connected to the internet. The moment a normal boot completes with Wi-Fi active, a persistent ScreenConnect o AnyDesk service will phone home to the scammer's console and alert them that your machine is back online.

Phase 1: Booting into Safe Mode Without Networking¶

Sa Windows 10 at Windows 11¶

1. Make sure the Ethernet cable is unplugged and your home Wi-Fi router is unplugged or Airplane Mode is active.
2. Power on the PC. At the Windows sign-in screen, hold down the Left Shift key while clicking Power -> Restart.
3. On the blue recovery screen, select Troubleshoot -> Advanced options -> Startup Settings -> Restart.
4. When the startup options list appears, press 4 or F4 (Enable Safe Mode). Do not press 5 (Safe Mode with Networking).

On macOS (Apple Silicon and Intel)¶

1. Turn off the Mac and turn off your Wi-Fi router.
2. Apple Silicon (M1/M2/M3/M4): Hold the Power button until "Loading startup options" appears. Select your startup disk, hold Shift, and click Continue in Safe Mode.
3. Intel Mac: Turn on the Mac and immediately hold the Shift key until the login window appears.

Phase 2: Hunting and terminating persistent Windows Services¶

Standard uninstallation via "Add or Remove Programs" often fails to remove customized ScreenConnect MSI builds because attackers strip the uninstaller entry from the Windows Registry or deploy multiple instances under randomized hexadecimal service names.

1. In Windows Safe Mode, press Win + R, uri services.msc, and press Enter.
2. Click the Name column to sort alphabetically, and carefully inspect every service for the following names:
3. ScreenConnect Client (xxxxxxxxxxxxxxxx) (Note: There may be two or three separate ScreenConnect Client entries with different 16-character alphanumeric strings in parentheses, where each represents a different scammer server).
4. AnyDesk Service
5. RustDesk Service
6. UltraViewerService
7. TeamViewer
8. Zoho Assist - Unattended Agent o SimpleHelp Remote Access
9. For every suspicious service you find, right-click it and select Properties.
10. Read the Path to executable field carefully and write it down (for example, C:\Program Files (x86)\ScreenConnect Client (a1b2c3d4e5f6g7h8)\ScreenConnect.ClientService.exe).
11. Change the Startup type dropdown to Disabled, click Stop (if running), and click Apply and OK.
12. Next, open an elevated Command Prompt (Win + X -> Terminal (Admin) or Command Prompt (Admin)) and permanently delete the service registrations using the exact service name listed in the properties window:

sc stop "AnyDesk"
sc delete "AnyDesk"
sc stop "RustDesk"
sc delete "RustDesk"
sc stop "UltraViewerService"
sc delete "UltraViewerService"

For ScreenConnect, query all installed instances and delete each one by its exact service key name:

sc query state= all | findstr /I "ScreenConnect"
sc delete "ScreenConnect Client (a1b2c3d4e5f6g7h8)"

Phase 3: Purging Scheduled Tasks, Startup folders, and hidden directories¶

Even after a Windows Service is deleted, attackers often configure a scheduled task that re-downloads the remote agent via powershell.exe o mshta.exe every time a user logs in.

1. Pindutin Win + R, uri taskschd.msc, and press Enter to open Task Scheduler.
2. Click Task Scheduler Library in the left pane. Expand every subfolder and inspect the Actions tab of each scheduled task. Delete any task that launches binaries from C:\Users\<User>\AppData\, C:\ProgramData\, or invokes curl, bitsadmin, powershell -WindowStyle Hidden, or any remote desktop executable.
3. Pindutin Win + R, uri shell:startup, and press Enter. Delete any shortcuts or .bat / .vbs scripts placed in your user Startup folder. Repeat this by typing shell:common startup to inspect the system-wide Startup folder.
4. Enable viewing hidden files in File Explorer (View -> Show -> Hidden items) and manually delete the application directories and configuration caches for all remote tools:
5. C:\Program Files (x86)\ScreenConnect Client (*)
6. C:\ProgramData\ScreenConnect Client (*)
7. C:\Program Files (x86)\AnyDesk\ at C:\ProgramData\AnyDesk\
8. C:\Users\<YourUsername>\AppData\Roaming\AnyDesk\
9. C:\Program Files\RustDesk\ at C:\Users\<YourUsername>\AppData\Roaming\RustDesk\
10. C:\Program Files (x86)\UltraViewer\ at C:\Users\<YourUsername>\AppData\Roaming\UltraViewer\

Phase 4: Removing macOS LaunchDaemons, LaunchAgents, and Privacy Grants¶

On macOS, remote access tools establish persistence through LaunchDaemons (system-wide) and LaunchAgents (user-level), combined with macOS TCC (Transparency, Consent, and Control) permissions for Screen Recording and Accessibility.

1. While in macOS Safe Mode (offline), open Finder, press Cmd + Shift + G (Go to Folder), and inspect the following three directories one by one:
2. /Library/LaunchDaemons/
3. /Library/LaunchAgents/
4. /Users/<YourUsername>/Library/LaunchAgents/
5. Drag any .plist files containing connectwise, screenconnect, anydesk, rustdesk, teamviewer, zoho, o simplehelp to the Trash.
6. Next, open /Applications/ at /Library/Application Support/ and move any corresponding remote access app bundles and support folders to the Trash.
7. Open System Settings -> Privacy & Security. Check two critical sections:
8. Screen & System Audio Recording: Select any remote support tool listed and click the minus (-) button to revoke its ability to view your display.
9. Accessibility: Select any remote support tool and click the minus (-) button to revoke its ability to control your mouse cursor and synthesize keystrokes.
10. Full Disk Access: Verify that no unknown application or terminal wrapper has been granted Full Disk Access.

Reversing Windows password locks and fake boot banners¶

Bago magdiskonekta, ang mga mapaghiganti na scammer ay madalas na ikinakandado ang mga biktima sa kanilang mga computer at humihingi ng ransom para sa password. Gumagamit sila ng tatlong pangunahing pamamaraan:

1. Changing your local Windows password (net user) or adding a rogue admin account¶

While their screen curtain is active, scammers often open an elevated Command Prompt and run net user <YourUsername> <NewPassword> or create a backdoor administrator account (net user SupportAdmin Pass123 /add && net localgroup administrators SupportAdmin /add). * How to check and fix: In Safe Mode, open an elevated Command Prompt (cmd.exe as Administrator) and type net user. If you see an unfamiliar account, delete it immediately with net user <RogueAccountName> /delete. If your local password was changed, boot from a Windows Installation USB into the Windows Recovery Environment (WinRE) to restore a prior System Restore Point, or sign in with your linked Microsoft Account after resetting your password on a clean smartphone.

2. Enabling a startup message banner via Registry (LegalNoticeCaption)¶

Scammers often modify HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System by setting LegalNoticeCaption at LegalNoticeText to display a fake Microsoft Security lockout phone number before login. * How to fix: This is purely a cosmetic text screen before the normal Windows login prompt. Click OK or press Enter to bypass it, open regedit in Safe Mode, go to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System, and clear the text inside LegalNoticeCaption at LegalNoticeText.

3. Safe Boot PIN lockouts (bcdedit)¶

Microsoft removed the legacy syskey.exe tool in Windows 10 version 1709. Today, scammers instead tick Safe boot inside msconfig and reboot your PC offline. Because Windows Hello PINs often fail on the Safe Mode login screen without network access, victims get trapped in a boot loop. * How to fix: Hold Shift + Restart at the login screen, select Troubleshoot -> Advanced options -> Command Prompt, and run:

bcdedit /deletevalue {current} safeboot

Restart the computer normally (keeping your internet router unplugged) so you can log in with your cached password or PIN and remove the remote software.

Bakit nangangailangan ang pagnanakaw ng session ng browser at mga infostealers ng buong OS wipe¶

Even if you delete the ScreenConnect, AnyDesk, o RustDesk services in Safe Mode, you must evaluate whether the scammer deployed a secondary Infostealer (Lumma, RedLine, Vidar, Stealc) or copied your browser profile directory.

During an unattended remote session, it takes less than 8 seconds for an attacker to run a PowerShell script that copies your Google Chrome, Microsoft Edge, or Brave user data directory (C:\Users\<User>\AppData\Local\Google\Chrome\User Data\Default\) along with the local DPAPI master decryption key. With those files on their server, the attacker possesses:

1. Every password saved in your web browser's built-in password manager.
2. Active session cookies (Cookies at Network\Cookies SQLite databases): Even if your email or bank uses two-factor authentication (2FA), possessing your decrypted session token cookie allows the attacker to import your browser profile into an antidetect browser on their machine and access your Gmail, Outlook, Amazon, or cryptocurrency exchange account without needing a password or 2FA code.
3. Browser-based cryptocurrency wallet vaults (MetaMask, Phantom, Rabby): Encrypted vault files inside Local Extension Settings ay exfiltrated para sa offline na brute-pwersa.

Kapag kailangan mong magsagawa ng malinis na USB operating system na muling i-install¶

Bagama't sapat na ang pag-aalis ng serbisyo ng Safe Mode kung nahuli mo ang scammer sa loob ng 10 segundo ng pag-install ng AnyDesk at hindi kailanman binigyan sila ng Administrator elevation o walang-bantay na access, dapat mong i-wipe ang drive at magsagawa ng malinis na pag-install ng OS mula sa isang USB stick kung alinman sa mga sumusunod ang nangyari:

• Naging itim ang iyong screen (Blank Guest Monitor) o ang iyong mouse/keyboard ay naka-lock.
• Nakakita ka ng Command Prompt (cmd.exe) o PowerShell window flash sa screen.
• Iniwan mo ang computer nang hindi nakabantay habang ang scammer ay nagpatakbo ng isang pekeng pag-scan sa seguridad.
• Nag-install ka ConnectWise ScreenConnect (na tumatakbo bilang SYSTEM bilang default at nagbibigay-daan sa hindi nakikitang background shell script execution).

Upang magsagawa ng ligtas na muling pag-install: 1. Habang offline sa Safe Mode, magsaksak ng bagong USB flash drive sa nakompromisong PC at kopyahin ang mga personal data file lamang (.jpg, .pdf, .docx, .xlsx, mga video ng pamilya). Huwag kopyahin .exe, .msi, .bat, .ps1, o mga folder ng profile ng browser. 2. Gamit ang isang iba, malinis na computer, i-download ang opisyal na Windows Media Creation Tool mula sa Microsoft (microsoft.com/software-download) o lumikha ng bootable macOS installer. 3. I-boot ang nakompromisong PC mula sa malinis na USB installer, tanggalin ang lahat ng umiiral na partisyon sa pangunahing drive (Drive 0), at mag-install ng bagong kopya ng operating system.

Pagpapanatili ng iyong legal na karapatan sa reimbursement sa bangko¶

Madalas na sinusubukan ng mga bangko na tanggihan ang mga claim sa reimbursement ng panloloko sa mga scam sa remote access sa pamamagitan ng pangangatwiran na dahil na-click mo ang "Download" sa AnyDesk o ScreenConnect, "pinahintulutan" mo ang mga transaksyon o kumilos nang may matinding kapabayaan. Ang pag-alam kung paano gumagana ang ayon sa batas na mga proteksyon sa pagbabangko ng consumer sa iyong nasasakupan ay kritikal kapag nakikipag-usap sa tagahatol ng paghahabol sa pandaraya ng iyong bangko.

Sa Estados Unidos: Electronic Fund Transfer Act (EFTA) at Regulation E (12 CFR § 1005)¶

Sa ilalim ng pederal na Electronic Fund Transfer Act (Regulation E), ang Consumer Financial Protection Bureau (CFPB) ay naglabas ng opisyal na gabay sa pangangasiwa na nagsasaad na: * Ang sapilitan na pag-access ay isa pa ring "Hindi awtorisadong Electronic Fund Transfer": Sa ilalim 12 CFR § 1005.2(m), ang electronic fund transfer na pinasimulan ng isang taong nakakuha ng access sa account ng consumer sa pamamagitan ng panloloko o pagnanakaw ay tinukoy ng batas bilang hindi awtorisadong EFT, kahit na nalinlang ang consumer sa pagbibigay ng password, isang beses na passcode, o pag-install ng remote desktop software. * Ang kapabayaan ay hindi maaaring gamitin upang tanggihan ang iyong paghahabol: Ang Opisyal na Interpretasyon ng CFPB ng Regulation E (Comment 6(b)-2) ay nagsasaad na ang kapabayaan ng consumer (tulad ng pagkahulog sa isang phishing pop-up o pagbibigay ng malayuang desktop access sa isang scammer) **ay hindi maaaring gamitin ng isang bangko upang magpataw ng mas malaking pananagutan sa consumer kaysa Regulation E pinapayagan ($50 maximum kung iniulat sa loob ng 2 araw ng negosyo; $500 maximum sa loob ng 60 araw). * Ibahin ang pagkakaiba sa pagitan ng Scammer-Clicked kumpara sa Consumer-Clicked na paglilipat: Kung ginalaw ng scammer ang mouse at nag-click sa "Ipadala" sa likod ng isang itim na screen sa panahon ng AnyDesk/ScreenConnect session, ito ay isang Unauthorized EFT na sakop ng Regulation E. Sabihin sa bangko nang nakasulat: "Hindi ko pinasimulan, pinahintulutan, o na-click ang button para sa paglipat na ito; isang kriminal na banta na aktor ang nagsagawa ng paglilipat nang malayuan gamit ang Remote Access Trojan habang ni-lock ang aking screen, na bumubuo ng hindi awtorisadong EFT sa ilalim ng 12 CFR § 1005.2(m)." Ilakip ang iyong napreserba. connection_trace.txt log o mga log ng Windows Event Viewer Service Control Manager (Event ID 7045 na nagpapakita ng eksaktong minuto ang ScreenConnect o AnyDesk na-install ang serbisyo) bilang forensic proof.

In the United Kingdom, European Union, Canada, and Australia¶

• United Kingdom (PSR at FOS): Kung kinokontrol ng scammer ang iyong computer nang direkta para maglipat ng mga pondo, iulat ito bilang Hindi Awtorisadong Pagbabayad sa ilalim ng Mga Regulasyon sa Mga Serbisyo sa Pagbabayad 2017. Kung manipulahin ng scammer ang iyong screen (Inspect Element pekeng refund) upang linlangin ka sa iyong sarili na pahintulutan ang isang Mas Mabilis na Pagbabayad, iulat ito sa ilalim ng Regulator ng Mga Serbisyo sa Pagbabayad (PSR) mandatory Awtorisadong Push Payment (APP) Panloloko mga tuntunin sa reimbursement at palakihin ang anumang pagtanggi sa Financial Ombudsman Service (FOS).
• European Union, Canada, at Australia: Iulat kaagad ang insidente sa iyong bangko at pambansang pulisya, na binibigyang-diin na isang remote access trojan ang nagsagawa o nagmanipula sa session. Idulog sa Ombudsman for Banking Services and Investments ang hindi naresolbang mga hindi pagkakaunawaan sa bangko (OBSI) sa Canada o ang Australian Financial Complaints Authority (AFCA) sa Australia sa ilalim ng ePayments Code.

Checklist ng remediation at pag-uulat pagkatapos ng insidente¶

Complete every item in this checklist before reconnecting your home network or resuming normal online banking:

• Physical isolation confirmed: Compromised computer was physically disconnected from Ethernet and Wi-Fi before any further troubleshooting.
• Bank accounts frozen and re-numbered: All checking, savings, and HELOC account numbers that were visible on the computer have been closed and re-issued with new account numbers.
• Scheduled Bill Pay and ACH queues purged: Verified with a bank supervisor that no future-dated Bill Pay checks, external bank links (Plaid), or standing wire instructions were added during the remote session.
• Credit freezes active: Security freezes placed with Equifax, Experian, TransUnion, and ChexSystems.
• Email forwarding rules audited: Logged into Gmail/Outlook/Yahoo from a clean smartphone and checked Settings -> Forwarding and POP/IMAP and Rules / Filters for hidden rules that auto-delete or forward emails containing "Bank", "Fraud", "Wire", o "Security Alert".
• Browser password vault rotated: Every password stored inside Chrome, Edge, Firefox, or Safari password managers has been changed from a clean device.
• Forensic logs saved and official reports filed: File reports with the FBI IC3 (ic3.gov) and FTC (reportfraud.ftc.gov) in the US, Action Fraud (actionfraud.police.uk) in the UK, the Canadian Anti-Fraud Centre, or Scamwatch (scamwatch.gov.au) in Australia. Also report the installer binary or connection ID to connectwise.com/company/trust/report-abuse o anydesk.com/en/abuse.

Mga madalas itanong¶

The scammer showed me my Windows Event Viewer and netstat in Command Prompt and it was full of thousands of warnings, errors, and "FOREIGN ADDRESS" connections. Was my computer actually hacked before I called them?¶

No. Both `eventvwr` (Windows Event Viewer) and `netstat` are normal administrative utilities built into every copy of Windows, and scammers abuse them as psychological props. Every healthy Windows computer generates thousands of routine yellow Warning and red Error logs in Event Viewer during normal boot-ups and background updates, and `netstat` lists every normal background connection your browser and operating system make to cloud servers as a "Foreign Address." Your computer was completely safe until the moment you followed the caller's instructions to download and run their remote access tool.

How did the scammer make my real bank website show that they accidentally deposited $40,000 into my checking account if they cannot hack the bank's server?¶

While connected to your computer via AnyDesk or ScreenConnect, the scammer blacks out your screen for 15 seconds, right-clicks your bank balance in your web browser, and clicks **"Inspect" (`Developer Tools`)**. This opens the local HTML text displayed in your browser tab. The scammer simply types `$45,200.00` over your real `$5,200.00` balance and adds a fake text line reading `"ACH REFUND OVERPAYMENT +$40,000.00"` on your screen. This edit exists only inside your browser tab's temporary memory (`DOM`) and vanishes the instant you refresh the page (`F5`) or check your balance on your smartphone app. Alternatively, they transfer `$40,000` from your own savings account or credit line into your checking account and relabel the screen to trick you into wiring your own money to them.

If I uninstalled AnyDesk or UltraViewer from the Control Panel, am I safe to turn my Wi-Fi back on?¶

Usually not without inspecting Windows Services (`services.msc`) in Safe Mode first. Professional tech support scam call centers know that victims often uninstall AnyDesk or UltraViewer as soon as they hang up. Therefore, within the first two minutes of connecting to your PC, scammers routinely use silent file transfer to drop a secondary, hidden **ConnectWise ScreenConnect** (`ScreenConnect.ClientService.exe`) or **SimpleHelp** agent that does not create a desktop shortcut and hides inside `C:\Program Files (x86)\ScreenConnect Client (xxxx)`. Unless you verify in Safe Mode that no rogue `SYSTEM` services or scheduled tasks exist, or perform a full USB OS wipe, reconnecting to Wi-Fi can immediately hand control of your PC back to the attacker.

Maaari bang ma-access ng isang scammer ang iba pang mga computer o smartphone sa aking home Wi-Fi network dahil lang sa nag-install ako ng AnyDesk sa isang laptop?¶

Installing AnyDesk or ScreenConnect compromises the specific computer where you ran the installer, not your phones or other laptops directly. However, if you use **Google Chrome, Microsoft Edge, or Apple iCloud password and session syncing** across your laptop and smartphone, any passwords the scammer steals or changes on the infected laptop will impact your shared cloud accounts. Also, while connected to your laptop, an attacker can log into your home router's admin page (`192.168.1.1`) if it still uses the default admin password and alter your router's `DNS` settings. After isolating the infected laptop, factory-reset your Wi-Fi router or verify its DNS settings and admin password from a clean device.

Mga kaugnay na gabay¶

• Tech support pop-up scam at remote desktop na AnyDesk/TeamViewer na pag-alis
• Session cookie hijacking, infostealer malware, and passkey revocation
• Pekeng CAPTCHA ClickFix PowerShell Win+R clipboard malware at Lumma Infostealer remediation
• Awtorisadong push payment (APP) na panloloko sa app: Zelle, Venmo, at mga karapatan sa pagpapanggap at pagbabayad ng Mas Mabibilis na Pagbabayad
• Bank account breach
• Mga numerong pang-emergency ayon sa bansa

Mga mapagkukunan at opisyal na patnubay¶

• Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), National Security Agency (NSA), & Multi-State Information Sharing and Analysis Center (MS-ISAC) (United States): Joint Cybersecurity Advisory (AA23-025A): Protecting Against Malicious Use of Remote Monitoring and Management (RMM) Software.
• Consumer Financial Protection Bureau (CFPB) (United States): Electronic Fund Transfers (Regulation E, 12 CFR Part 1005) Official Interpretations and FAQs on Unauthorized EFTs and Fraudulently Induced Access.
• Federal Trade Commission (FTC) (United States): How To Spot, Avoid, and Report Tech Support Scams.
• National Cyber ​​Security Center (NCSC) & Action Fraud (United Kingdom): Protecting Devices from Unauthorised Remote Access Tools and Screen-Sharing Fraud.
• ConnectWise Trust & Security Response Center: Identifying and Removing Rogue ScreenConnect (ConnectWise Control) Client Instances.