Remote access trojan (ScreenConnect, AnyDesk, RustDesk, UltraViewer) tech support scam: pulling ethernet, killing services, and bank freeze¶

When a scammer convinces you to install a remote desktop tool or executes a remote monitoring agent on your computer, they gain live, unrestricted control over your mouse, keyboard, file system, and active browser sessions. While displaying a fake security scan or a black privacy curtain on your monitor, the operator silently drains checking accounts, harvests saved passwords, and installs persistent background services that survive standard reboots. This guide provides immediate steps to sever the attacker's data link, permanently eradicate unattended remote access services, and lock down your banking and credit infrastructure before funds clear the wire network.

Yenza lokhu manje¶

1. Sever all internet connectivity physically and immediately. Unplug the Ethernet cable from the back of your desktop or router, flip the physical Wi-Fi switch on your laptop, or press and hold the power button on your Wi-Fi router for 10 seconds until all lights go dark. Do not waste time trying to fight the scammer for control of the mouse cursor to click the disconnect button.
2. Force-shutdown the compromised computer if the screen is blacked out. If the attacker has enabled "Blank Guest Monitor" or locked your keyboard input, press and hold your computer's physical power button for 10 full seconds until the machine powers off completely. Leave it powered off while you secure your financial accounts from a separate, clean device.
3. Call your bank's fraud department from an independent phone. Use a cellular phone to call the official number printed on the back of your debit or credit card, or call your local emergency number (911 in the United States and Canada, 112 across the European Union, 999 in the United Kingdom) if an active extortion threat is occurring; see izinombolo eziphuthumayo for international contacts. Instruct the bank to place an immediate hard freeze on all checking, savings, and line-of-credit accounts, and demand an emergency recall on any pending Automated Clearing House (ACH), wire, or real-time payment transfers.
4. Revoke active session cookies and change passwords from a clean smartphone. Using your phone on cellular data (not connected to your home Wi-Fi if the compromised PC is back on), log into your primary email, banking portals, and cloud storage accounts. Terminate all active login sessions, revoke unrecognized Multi-Factor Authentication (MFA) devices, and rotate your passwords.
5. Boot the infected computer into Safe Mode Without Networking. Only turn the compromised computer back on while disconnected from the internet, entering Windows Safe Mode or macOS Safe Mode to inspect and strip out unattended background services (ScreenConnect Client, AnyDesk Service, RustDesk Service) before the operating system loads third-party network drivers.

Understanding the anatomy of a commercial RMM and remote desktop attack¶

Modern technical support scams, refund frauds, and bank impersonation attacks rarely rely on custom-written computer viruses. Instead, threat actors abuse legitimate, digitally signed Remote Monitoring and Management (RMM) software and commercial remote desktop tools. Because these executables carry valid cryptographic code-signing certificates from trusted software vendors, standard antivirus programs like Windows Defender or macOS XProtect do not block their installation.

How attackers weaponize legitimate remote support binaries¶

When a victim calls a toll-free number displayed on a fake browser pop-up, replies to an urgent invoice email, or follows instructions from a fake bank fraud investigator, the operator directs them to download an executable or MSI installer. The most heavily abused platforms include:

• ConnectWise ScreenConnect (formerly Control): Often deployed via a customized .msi noma .exe package hosted on an attacker-controlled server. Once executed, it installs as a persistent Windows System Service (ScreenConnect Client (xxxx)) running with NT AUTHORITY\SYSTEM privileges, granting silent, unattended access whenever the computer is online.
• AnyDesk (anydesk.exe): Frequently used in cross-platform scams targeting Windows, macOS, and mobile devices. Attackers instruct the victim to read aloud the 9-digit AnyDesk address, request administrative elevation, and set an "Unattended Access Password" to reconnect while the victim sleeps.
• RustDesk (rustdesk.exe): An open-source remote desktop tool favored by scam syndicates because they can self-host relay servers, bypassing vendor abuse takedowns.
• UltraViewer, TeamViewer, Zoho Assist, and SimpleHelp: Commonly chained together. A scammer connecting via UltraViewer or AnyDesk will often silently install a hidden ScreenConnect noma SimpleHelp package in the background as a backup backdoor.

Emergency workflow: severing the connection and triaging damage¶

Use the following operational flowchart to stop an active remote session, isolate the workstation, and determine whether the machine can be cleaned in Safe Mode or requires a complete operating system wipe.

flowchart TD
    A["Active or Recent Remote Access Scam Detected"] --> B["Physically Unplug Ethernet Cable and Power Off Wi-Fi Router"]
    B --> C{"Is Screen Blacked Out or Mouse Locked?"}
    C -- "Yebo" --> D["Hold PC Physical Power Button for 10 Seconds to Force Off"]
    C -- "Cha" --> E["Switch Airplane Mode ON and Shut Down PC Normally"]
    D --> F["Use Clean Smartphone on Cellular Data to Call Bank Fraud Dept"]
    E --> F
    F --> G["Freeze Checking/Savings, Recall Wires/Zelle, Lock Credit Bureaus"]
    G --> H["From Clean Smartphone: Rotate Email/Bank Passwords & Kill Sessions"]
    H --> I{"Did Scammer Have Unattended Access or Run CMD/PowerShell?"}
    I -- "Yes (High Risk)" --> J["Boot PC Offline into Safe Mode to Rescue Personal Docs Only"]
    I -- "No (Brief Supervised Session)" --> K["Boot Offline into Safe Mode to Purge RMM Services and Certs"]
    J --> L["Perform Full Clean OS Reinstall via USB Media From Clean PC"]
    K --> M["Remove Services, Scheduled Tasks, AppData, and Audit Browser Extensions"]

Comparison of remote access tools abused by scammers¶

Before attempting to clean a machine or report the incident to your bank's forensic fraud team, identify which remote tool(s) were installed. Remember that scammers routinely install two or three different tools during a single session so that if you uninstall the visible desktop icon, their hidden secondary service remains active.

Step-by-step banking and financial triage (First 30 minutes)¶

In a remote access scam, the computer infection is only the delivery mechanism; the primary emergency is acute financial theft. Attackers use psychological and technical tricks, such as editing the HTML source code (Inspect Element) of your bank's webpage to simulate an accidental $40,000 overpayment instead of $400, to trick you into wiring money, buying gift cards, or depositing cash into a Bitcoin ATM. Even if you refused to send money, an attacker with remote access can initiate transfers directly while your screen is blacked out.

1. Place an immediate hard freeze and initiate transfer recalls¶

Call your financial institution's dedicated fraud department immediately using a clean phone. State clearly: "My computer was compromised by a remote access trojan during a tech support/bank impersonation scam. An unauthorized party had live access to my online banking session." Demand the following specific actions:

• Online Banking Profile Lockout: Have the bank disable your online and mobile banking login credentials entirely and invalidate all active OAuth tokens and session cookies.
• ACH, Wire, and RTP Recall (SWIFT / Fedwire / Faster Payments): Cela ummeleli ukuthi ahlole i-akhawunti yakho nganoma iyiphi i-Automated Clearing House elindile noma esemgqeni (ACH) transfers, domestic/international wire transfers, Zelle / Venmo izinkokhelo, noma amasheke e-"Bill Pay" ahlelelwe amadethi azayo. Abakhohlisi bavamise ukuhlela isheke le-Bill Pay noma ukudluliswa kwe-ACH okudalwe kwangemva kwedethi okusethwe ukuze basebenzise izinsuku ezi-3 kuya kwezi-5 kamuva ngethemba lokuthi ngeke ukubone.
• Account Number Substitution: Because the attacker likely viewed your full routing and checking account numbers (or downloaded PDF bank statements from your browser), freezing the debit card alone is insufficient. You must request that the bank close the compromised account numbers and transition your balances into brand-new account numbers with "Post No Debits" (PND) restrictions on the old accounts.
• Check for Hidden Internal Transfers or Cash Advances: Attackers frequently take a cash advance from your linked credit card or Home Equity Line of Credit (HELOC) and transfer it into your checking account first, either to make you believe they "accidentally over-refunded" you, or to pool maximum liquidity before wiring the combined balance offshore. Tell the bank fraud specialist to check if any intra-bank transfers occurred between your savings, credit card, or brokerage accounts.

2. Freeze credit bureaus and check for new loan applications¶

While connected to your PC, scammers routinely search your Downloads noma Documents folders for keywords like tax, 1040, W2, passport, license, noma password and exfiltrate your tax returns and ID scans.

1. Place a free Security Freeze at all major credit bureaus immediately using your clean smartphone:
2. In the United States: Freeze Equifax (1-888-298-0045), Experian (1-888-397-3742), TransUnion (1-800-916-8800), and ChexSystems (1-800-428-9687).
3. In the United Kingdom: Contact Experian, Equifax, and TransUnion, and register for Cifas Protective Registration.
4. In Canada: Place credit freezes or fraud alerts with Equifax Canada and TransUnion Canada.
5. In Australia: Request a credit ban through Equifax, Illion, and Experian.
6. Review your credit report immediately for hard inquiries made in the last 24 hours; scammers often apply for instant online personal loans in a background browser tab while talking to you.

Eradicating remote access services in Safe Mode (Windows and macOS)¶

If you decide to inspect the machine, preserve forensic logs for law enforcement, or rescue irreplaceable personal photos before wiping the hard drive, never boot the computer into normal mode while connected to the internet. The moment a normal boot completes with Wi-Fi active, a persistent ScreenConnect noma AnyDesk service will phone home to the scammer's console and alert them that your machine is back online.

Phase 1: Booting into Safe Mode Without Networking¶

On Windows 10 and Windows 11¶

1. Make sure the Ethernet cable is unplugged and your home Wi-Fi router is unplugged or Airplane Mode is active.
2. Power on the PC. At the Windows sign-in screen, hold down the Left Shift key while clicking Power -> Restart.
3. On the blue recovery screen, select Troubleshoot -> Advanced options -> Startup Settings -> Restart.
4. When the startup options list appears, press 4 or F4 (Enable Safe Mode). Do not press 5 (Safe Mode with Networking).

On macOS (Apple Silicon and Intel)¶

1. Turn off the Mac and turn off your Wi-Fi router.
2. Apple Silicon (M1/M2/M3/M4): Hold the Power button until "Loading startup options" appears. Select your startup disk, hold Shift, and click Continue in Safe Mode.
3. Intel Mac: Turn on the Mac and immediately hold the Shift key until the login window appears.

Phase 2: Hunting and terminating persistent Windows Services¶

Standard uninstallation via "Add or Remove Programs" often fails to remove customized ScreenConnect MSI builds because attackers strip the uninstaller entry from the Windows Registry or deploy multiple instances under randomized hexadecimal service names.

1. In Windows Safe Mode, press Win + R, uhlobo services.msc, and press Enter.
2. Click the Name column to sort alphabetically, and carefully inspect every service for the following names:
3. ScreenConnect Client (xxxxxxxxxxxxxxxx) (Note: There may be two or three separate ScreenConnect Client entries with different 16-character alphanumeric strings in parentheses, where each represents a different scammer server).
4. AnyDesk Service
5. RustDesk Service
6. UltraViewerService
7. TeamViewer
8. Zoho Assist - Unattended Agent noma SimpleHelp Remote Access
9. For every suspicious service you find, right-click it and select Properties.
10. Read the Path to executable field carefully and write it down (for example, C:\Program Files (x86)\ScreenConnect Client (a1b2c3d4e5f6g7h8)\ScreenConnect.ClientService.exe).
11. Change the Startup type dropdown to Disabled, click Stop (if running), and click Apply and OK.
12. Next, open an elevated Command Prompt (Win + X -> Terminal (Admin) or Command Prompt (Admin)) and permanently delete the service registrations using the exact service name listed in the properties window:

sc stop "AnyDesk"
sc delete "AnyDesk"
sc stop "RustDesk"
sc delete "RustDesk"
sc stop "UltraViewerService"
sc delete "UltraViewerService"

For ScreenConnect, query all installed instances and delete each one by its exact service key name:

sc query state= all | findstr /I "ScreenConnect"
sc delete "ScreenConnect Client (a1b2c3d4e5f6g7h8)"

Phase 3: Purging Scheduled Tasks, Startup folders, and hidden directories¶

Even after a Windows Service is deleted, attackers often configure a scheduled task that re-downloads the remote agent via powershell.exe noma mshta.exe every time a user logs in.

1. Press Win + R, uhlobo taskschd.msc, and press Enter to open Task Scheduler.
2. Click Task Scheduler Library in the left pane. Expand every subfolder and inspect the Actions tab of each scheduled task. Delete any task that launches binaries from C:\Users\<User>\AppData\, C:\ProgramData\, or invokes curl, bitsadmin, powershell -WindowStyle Hidden, or any remote desktop executable.
3. Press Win + R, uhlobo shell:startup, and press Enter. Delete any shortcuts or .bat / .vbs scripts placed in your user Startup folder. Repeat this by typing shell:common startup to inspect the system-wide Startup folder.
4. Enable viewing hidden files in File Explorer (View -> Show -> Hidden items) and manually delete the application directories and configuration caches for all remote tools:
5. C:\Program Files (x86)\ScreenConnect Client (*)
6. C:\ProgramData\ScreenConnect Client (*)
7. C:\Program Files (x86)\AnyDesk\ futhi C:\ProgramData\AnyDesk\
8. C:\Users\<YourUsername>\AppData\Roaming\AnyDesk\
9. C:\Program Files\RustDesk\ futhi C:\Users\<YourUsername>\AppData\Roaming\RustDesk\
10. C:\Program Files (x86)\UltraViewer\ futhi C:\Users\<YourUsername>\AppData\Roaming\UltraViewer\

Phase 4: Removing macOS LaunchDaemons, LaunchAgents, and Privacy Grants¶

On macOS, remote access tools establish persistence through LaunchDaemons (uhlelo lonke) kanye LaunchAgents (izinga lomsebenzisi), kuhlanganiswe ne-macOS TCC (Ukubonisa ngale, Imvume, Nokulawula) izimvume ze-Ukuqoshwa kwesikrini kanye ne-Ukufinyeleleka.

1. Ngenkathi ukumodi ephephile ye-macOS (ungaxhunyiwe ku-inthanethi), vula okuthi Finder, cindezela Cmd + Shift + G (Go to Folder), and inspect the following three directories one by one:
2. /Library/LaunchDaemons/
3. /Library/LaunchAgents/
4. /Users/<YourUsername>/Library/LaunchAgents/
5. Drag any .plist files containing connectwise, screenconnect, anydesk, rustdesk, teamviewer, zoho, noma simplehelp to the Trash.
6. Next, open /Applications/ futhi /Library/Application Support/ and move any corresponding remote access app bundles and support folders to the Trash.
7. Open System Settings -> Privacy & Security. Check two critical sections:
8. Screen & System Audio Recording: Select any remote support tool listed and click the minus (-) button to revoke its ability to view your display.
9. Accessibility: Select any remote support tool and click the minus (-) button to revoke its ability to control your mouse cursor and synthesize keystrokes.
10. Full Disk Access: Verify that no unknown application or terminal wrapper has been granted Full Disk Access.

Reversing Windows password locks and fake boot banners¶

Before disconnecting, vindictive scammers frequently lock victims out of their computers and demand a ransom for the password. They use three primary methods:

1. Changing your local Windows password (net user) or adding a rogue admin account¶

While their screen curtain is active, scammers often open an elevated Command Prompt and run net user <YourUsername> <NewPassword> or create a backdoor administrator account (net user SupportAdmin Pass123 /add && net localgroup administrators SupportAdmin /add). * How to check and fix: In Safe Mode, open an elevated Command Prompt (cmd.exe as Administrator) and type net user. If you see an unfamiliar account, delete it immediately with net user <RogueAccountName> /delete. If your local password was changed, boot from a Windows Installation USB into the Windows Recovery Environment (WinRE) to restore a prior System Restore Point, or sign in with your linked Microsoft Account after resetting your password on a clean smartphone.

2. Enabling a startup message banner via Registry (LegalNoticeCaption)¶

Scammers often modify HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System by setting LegalNoticeCaption futhi LegalNoticeText to display a fake Microsoft Security lockout phone number before login. * How to fix: This is purely a cosmetic text screen before the normal Windows login prompt. Click OK or press Enter to bypass it, open regedit in Safe Mode, go to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System, and clear the text inside LegalNoticeCaption futhi LegalNoticeText.

3. Safe Boot PIN lockouts (bcdedit)¶

Microsoft removed the legacy syskey.exe tool in Windows 10 version 1709. Today, scammers instead tick Safe boot inside msconfig and reboot your PC offline. Because Windows Hello PINs often fail on the Safe Mode login screen without network access, victims get trapped in a boot loop. * How to fix: Hold Shift + Restart at the login screen, select Troubleshoot -> Advanced options -> Command Prompt, and run:

bcdedit /deletevalue {current} safeboot

Restart the computer normally (keeping your internet router unplugged) so you can log in with your cached password or PIN and remove the remote software.

Kungani ukwebiwa kweseshini yesiphequluli kanye nama-infostealers kudinga ukusulwa okugcwele kwe-OS¶

Even if you delete the ScreenConnect, AnyDesk, noma RustDesk services in Safe Mode, you must evaluate whether the scammer deployed a secondary Infostealer (Lumma, RedLine, Vidar, Stealc) or copied your browser profile directory.

During an unattended remote session, it takes less than 8 seconds for an attacker to run a PowerShell script that copies your Google Chrome, Microsoft Edge, or Brave user data directory (C:\Users\<User>\AppData\Local\Google\Chrome\User Data\Default\) along with the local DPAPI master decryption key. With those files on their server, the attacker possesses:

1. Every password saved in your web browser's built-in password manager.
2. Active session cookies (Cookies futhi Network\Cookies SQLite databases): Even if your email or bank uses two-factor authentication (2FA), possessing your decrypted session token cookie allows the attacker to import your browser profile into an antidetect browser on their machine and access your Gmail, Outlook, Amazon, or cryptocurrency exchange account without needing a password or 2FA code.
3. Browser-based cryptocurrency wallet vaults (MetaMask, Phantom, Rabby): Encrypted vault files inside Local Extension Settings are exfiltrated for offline brute-forcing.

When you must perform a clean USB operating system reinstall¶

While Safe Mode service removal is sufficient if you caught the scammer within 10 seconds of installing AnyDesk and never gave them Administrator elevation or unattended access, you must wipe the drive and perform a clean OS installation from a USB stick if any of the following occurred:

• Your screen went black (Blank Guest Monitor) or your mouse/keyboard was locked.
• You saw a Command Prompt (cmd.exe) or PowerShell window flash on the screen.
• You left the computer unattended while the scammer ran a fake security scan.
• You installed ConnectWise ScreenConnect (which runs as SYSTEM by default and allows invisible background shell script execution).

To perform a safe reinstall: 1. While offline in Safe Mode, plug a brand-new USB flash drive into the compromised PC and copy only personal data files (.jpg, .pdf, .docx, .xlsx, family videos). Never copy .exe, .msi, .bat, .ps1, or browser profile folders. 2. Using a different, clean computer, download the official Windows Media Creation Tool from Microsoft (microsoft.com/software-download) or create a bootable macOS installer. 3. Boot the compromised PC from the clean USB installer, delete all existing partitions on the primary drive (Drive 0), and install a fresh copy of the operating system.

Preserving your legal right to bank reimbursement¶

Banks frequently attempt to deny fraud reimbursement claims in remote access scams by arguing that because you clicked "Download" on AnyDesk or ScreenConnect, you "authorized" the transactions or acted with gross negligence. Knowing how statutory consumer banking protections work in your jurisdiction is critical when speaking to your bank's fraud claim adjudicator.

In the United States: Electronic Fund Transfer Act (EFTA) kanye Regulation E (12 CFR § 1005)¶

Under the federal Electronic Fund Transfer Act (Regulation E), I-Consumer Financial Protection Bureau (CFPB) ikhiphe umhlahlandlela osemthethweni wokuqondisa othi: * Ukufinyelela okudaliwe kuseyi-"Unauthorised Electronic Fund Transfer": Ngaphansi 12 CFR § 1005.2(m), an electronic fund transfer initiated by a person who obtained access to a consumer's account through fraud or robbery is defined by law as an unauthorized EFT, even if the consumer was tricked into providing a password, a one-time passcode, or installing remote desktop software. * Ubudedengu abunakusetshenziselwa ukuphika isimangalo sakho: Incazelo Esemthethweni Ye-CFPB Regulation E (Comment 6(b)-2) states that consumer negligence (such as falling for a phishing pop-up or granting remote desktop access to a scammer) cannot be used by a bank to impose greater liability on the consumer than Regulation E allows ($50 maximum if reported within 2 business days; $500 maximum within 60 days). * Distinguish between Scammer-Clicked vs. Consumer-Clicked transfers: If the scammer moved the mouse and clicked "Send" behind a black screen during the AnyDesk/ScreenConnect session, it is an Unauthorized EFT covered by Regulation E. Tell the bank in writing: "I did not initiate, authorize, or click the button for this transfer; a criminal threat actor executed the transfer remotely using a Remote Access Trojan while locking my screen, which constitutes an unauthorized EFT under 12 CFR § 1005.2(m)." Attach your preserved connection_trace.txt log or Windows Event Viewer Service Control Manager logs (Event ID 7045 showing the exact minute the ScreenConnect noma AnyDesk service was installed) as forensic proof.

In the United Kingdom, European Union, Canada, and Australia¶

• United Kingdom (PSR & FOS): If the scammer controlled your computer directly to move funds, report it as an Unauthorized Payment under the Payment Services Regulations 2017. If the scammer manipulated your screen (Inspect Element fake refund) to trick you into authorizing a Faster Payment yourself, report it under the Payment Services Regulator's (PSR) mandatory Authorized Push Payment (APP) Ukukhwabanisa Imithetho yembuyiselo kanye nokwenyusa noma yikuphi ukwenqatshwa Inkonzo Yomxazululi Wezimali (Financial Ombudsman Service).FOS).
• I-European Union, i-Canada, ne-Australia: Bika isigameko ngokushesha ebhange lakho namaphoyisa kazwelonke, ugcizelele ukuthi i-trojan yokufinyelela ukude isebenzise noma yakhohlisa iseshini. Khulisa izingxabano zasebhange ezingakaxazululiwe ku-Ombudsman Wezinsizakalo Zebhange Nokutshalwa Kwezimali (OBSI)* e-Canada noma i-Australian Financial Complaints Authority (AFCA) in Australia under the ePayments Code.

Post-incident remediation and reporting checklist¶

Complete every item in this checklist before reconnecting your home network or resuming normal online banking:

• Physical isolation confirmed: Compromised computer was physically disconnected from Ethernet and Wi-Fi before any further troubleshooting.
• Bank accounts frozen and re-numbered: All checking, savings, and HELOC account numbers that were visible on the computer have been closed and re-issued with new account numbers.
• Scheduled Bill Pay and ACH queues purged: Verified with a bank supervisor that no future-dated Bill Pay checks, external bank links (Plaid), or standing wire instructions were added during the remote session.
• Credit freezes active: Security freezes placed with Equifax, Experian, TransUnion, and ChexSystems.
• Email forwarding rules audited: Logged into Gmail/Outlook/Yahoo from a clean smartphone and checked Settings -> Forwarding and POP/IMAP and Rules / Filters for hidden rules that auto-delete or forward emails containing "Bank", "Fraud", "Wire", noma "Security Alert".
• Browser password vault rotated: Every password stored inside Chrome, Edge, Firefox, or Safari password managers has been changed from a clean device.
• Forensic logs saved and official reports filed: File reports with the FBI IC3 (ic3.gov) and FTC (reportfraud.ftc.gov) in the US, Action Fraud (actionfraud.police.uk) in the UK, the Canadian Anti-Fraud Centre, or Scamwatch (scamwatch.gov.au) in Australia. Also report the installer binary or connection ID to connectwise.com/company/trust/report-abuse noma anydesk.com/en/abuse.

Imibuzo evame ukubuzwa¶

The scammer showed me my Windows Event Viewer and netstat ku-Command Prompt futhi ibigcwele izinkulungwane zezixwayiso, amaphutha, kanye noxhumo lwe-"FOREIGN ADDRESS". Ingabe ikhompuyutha yami igqekeziwe ngaphambi kokuba ngibashayele ucingo?¶

Cha. Kokubili `eventvwr` (I-Windows Event Viewer) kanye `netstat` ziyizinsiza zokuphatha ezijwayelekile ezakhelwe kuwo wonke amakhophi e-Windows, futhi abakhwabanisi bayawahlukumeza njengezinsiza zokusebenza kwengqondo. Yonke ikhompyutha ye-Windows enempilo ikhiqiza izinkulungwane zesimiso esiphuzi Isexwayiso kanye namalogi wephutha abomvu kusibukeli somcimbi ngesikhathi sokuqalisa okuvamile nezibuyekezo zasemuva, futhi `netstat` ibala lonke uxhumo olujwayelekile lwasemuva olwenziwa yisiphequluli sakho nohlelo lokusebenza kumaseva amafu "njengekheli langaphandle." Ikhompyutha yakho ibiphephe ngokuphelele kuze kube yilapho ulandela imiyalelo yofonayo ukuze ulande futhi usebenzise ithuluzi labo lokufinyelela kude.

Umkhohlisi wenze kanjani iwebhusayithi yami yasebhange langempela ukuthi ibonise ukuthi bafake ngephutha $40,000 ku-akhawunti yami yokuhlola uma bengakwazi ukugebenga iseva yebhange?¶

Ngenkathi uxhumeke kukhompyutha yakho usebenzisa i-AnyDesk noma i-ScreenConnect, umkhonyovu uvala isikrini sakho imizuzwana engu-15, uchofoza kwesokudla ibhalansi yakho yasebhange kusiphequluli sakho sewebhu, bese uchofoza **"Hlola" (`Developer Tools`)**. Lokhu kuvula umbhalo wendawo we-HTML oboniswe kuthebhu yesiphequluli sakho. Umkhohlisi umane athayiphe `$45,200.00` phezu kwakho okwangempela `$5,200.00` ibhalansi bese wengeza ukufundwa komugqa wombhalo okungelona iqiniso `"ACH REFUND OVERPAYMENT +$40,000.00"` esikrinini sakho. Lokhu kuhlelwa kukhona kuphela ngaphakathi kwenkumbulo yesikhashana yethebhu yesiphequluli sakho (`DOM`) bese inyamalala lapho uqala kabusha ikhasi (`F5`) noma hlola ibhalansi yakho kuhlelo lwakho lokusebenza lwe-smartphone. Kungenjalo, bayadlulisa `$40,000` kusuka ku-akhawunti yakho yokonga noma umugqa wesikweletu ku-akhawunti yakho yokuhlola bese ulebula kabusha isikrini ukuze sikukhohlise ukuthi ufake eyakho imali kubo.

Uma ngikhiphe i-AnyDesk noma i-UltraViewer ku-Control Panel, ingabe ngiphephile ukuvula i-Wi-Fi yami futhi?¶

Ngokuvamile ngaphandle kokuhlola Izinsizakalo ZeWindows (`services.msc`) kumodi ephephile kuqala. Izikhungo zezingcingo zomkhonyovu zosekelo lobuchwepheshe ziyazi ukuthi izisulu zivame ukukhipha i-AnyDesk noma i-UltraViewer ngokushesha nje lapho zivala ucingo. Ngakho-ke, phakathi nemizuzu emibili yokuqala yokuxhuma ku-PC yakho, abakhwabanisi basebenzisa njalo ukudluliswa kwefayela buthule ukuze balahle eyesibili, efihliwe **ConnectWise ScreenConnect** (`ScreenConnect.ClientService.exe`) noma **IsisebenzeliSimple** esingadali isinqamuleli sedeskithophu futhi sicashe ngaphakathi `C:\Program Files (x86)\ScreenConnect Client (xxxx)`. Ngaphandle uma uqinisekisa ku-Safe Mode ukuthi ayikho inkohlakalo `SYSTEM` amasevisi noma imisebenzi ehleliwe ekhona, noma yenza ukusula okugcwele kwe-USB OS, ukuxhuma kabusha ku-Wi-Fi kungabuyisela ngokushesha i-PC yakho kumhlaseli.

Ingabe umkhohlisi angafinyelela kwamanye amakhompyutha noma ama-smartphone kunethiwekhi yami ye-Wi-Fi yasekhaya ngenxa nje yokuthi ngifake i-AnyDesk kukhompuyutha ephathekayo eyodwa?¶

Ukufaka i-AnyDesk noma i-ScreenConnect kubeka engcupheni ikhompuyutha ethile lapho usebenzise khona isifaki, hhayi amafoni akho noma amanye amakhompyutha aphathekayo ngokuqondile. Nokho, uma usebenzisa **i-Google Chrome, i-Microsoft Edge, noma iphasiwedi ye-Apple iCloud nokuvumelanisa iseshini** kuyo yonke ikhompyutha yakho ephathekayo kanye ne-smartphone, noma imaphi amagama ayimfihlo umkhonyovu awantshontshayo noma izinguquko kukhompuyutha ephathekayo ethelelekile zizoba nomthelela kuma-akhawunti akho owabelane ngawo amafu. Futhi, ngenkathi uxhumeke kukhompuyutha ephathekayo yakho, umhlaseli angangena ekhasini lokulawula lerutha yasekhaya (`192.168.1.1`) uma isasebenzisa iphasiwedi yomlawuli ezenzakalelayo futhi iguqule eyomzila wakho `DNS` izilungiselelo. Ngemva kokuhlukanisa ikhompyutha ephathwayo ethelelekile, setha kabusha njengasekuqaleni irutha yakho ye-Wi-Fi noma uqinisekise izilungiselelo zayo ze-DNS kanye nephasiwedi yomqondisi kudivayisi ehlanzekile.

Iziqondiso ezihlobene¶

• Tech support pop-up scam and remote desktop AnyDesk/TeamViewer removal
• Ukudunwa kwekhukhi lesikhathi, i-infostealer malware, nokuhoxiswa kokhiye wokudlula
• Fake CAPTCHA ClickFix PowerShell Win+R clipboard malware and Lumma Infostealer remediation
• Authorized push payment (APP) app fraud: Zelle, Venmo, and Faster Payments impersonation and reimbursement rights
• Ukwephulwa kwe-akhawunti yasebhange
• Izinombolo zesimo esiphuthumayo ngezwe

Imithombo nesiqondiso esisemthethweni¶

• I-Cybersecurity and Infrastructure Security Agency (CISA), I-Federal Bureau of Investigation (FBI), Inhlangano Yezokuphepha Kazwelonke (NSA), kanye Nesikhungo Sokwabelana Nokuhlaziya Ulwazi Lwezifundazwe Eziningi (MS-ISAC) (I-United States): I-Joint Cybersecurity Advisory (AA23-025A): Ukuvikela Ekusetshenzisweni Okunonya Kokuqapha Nokuphatha Okukude (RMM) Isoftware.
• Consumer Financial Protection Bureau (CFPB) (I-United States): Ukudluliselwa Kwesikhwama Se-elekthronikhi (Regulation E, 12 CFR Part 1005) Izincazelo Ezisemthethweni kanye nama-FAQ kuma-EFT Angagunyaziwe kanye Nokufinyelela Okubangelwa Ngokukhwabanisa.
• Federal Trade Commission (FTC) (I-United States): Indlela Yokubona, Ukugwema, Nokubika Imikhonyovu Yokusekela Ubuchwepheshe.
• National Cyber Security Centre (NCSC) Nokukhwabanisa Kwesenzo (e-United Kingdom): Ukuvikela Amadivayisi kokuthi Amathuluzi Okufinyelela Kukude Angagunyaziwe kanye Nokukhwabanisa Kokwabelana Ngesikrini.
• I-ConnectWise Trust & Security Response Center: Ukuhlonza nokukhipha i-Rogue ScreenConnect (ConnectWise Control) Izimo zeklayenti.