Preliminary note: the detection and removal steps below will get a confident, technical user most of the way through cleaning one of these machines. What they will not do is tell you whether anything was taken, or close the account exposure that follows. If this happened to a business machine, or if money or email accounts were touched, get a professional involved before you declare victory on the strength of a successful uninstall. I’ve now cleaned four of these in about two weeks, and no two were identical.

Something shifted in this category over the past year, and I don’t think most people have caught up to it yet.

The old tech-support scam had a predictable ending. Scary pop-up, phone number, friendly voice, remote session, and then a sales pitch — $400 for “lifetime protection” that consisted of a free malware scanner and a receipt. Annoying, expensive, but bounded. The remote session was the sales tool.

That’s not what I’m seeing now. Now the remote session is the product. They don’t want to sell you anything. They want to sit on the machine quietly, sometimes for months, and use it as you.

Four machines have come through my lab since late August carrying this exact pattern. One desktop had four separate ScreenConnect clients installed across a two-week window in May, every one of them still running when the owner brought it to me in late August — roughly a hundred days of uninterrupted access, discovered only because someone tried to drain his airline miles and got sloppy with his bank. A laptop had Breeze RMM and ScreenConnect installed 90 seconds apart, which is not the cadence of a human clicking through two installers. A long-time client of mine got hit a second time and arrived with four ScreenConnect clients, the oldest dating to June. And a fourth machine had a trojanized ScreenConnect.ClientSetup.exe come down from a compromised host overseas; Defender caught that one about sixty seconds after it landed, fortunately, though it doesn’t always work out that way.

Same playbook, four different front doors. Let me explain why this approach works so well, because once you understand the economics of it, the rest of the article makes a lot more sense.

Why Stealing Your Password Is the Hard Way to Do This

Credential theft has gotten expensive for the bad guys, and that’s mostly a good-news story. Multi-factor authentication is finally common. Banks and the big identity providers now score every login attempt: Is this device recognized? Is this IP address consistent with where this person normally is? Is the browser fingerprint the same? Did they get here at a plausible hour? A stolen username and password dropped into a login form from a VPS in another hemisphere trips every one of those wires at once.

So they stopped fighting the risk engine and started sitting behind it.

When someone has interactive remote control of your computer, they aren’t logging in as you. They’re using your already-authenticated session, and the difference is enormous:

• Your session cookies and refresh tokens are already in the browser. Your bank, your email, your brokerage, your retirement account — many of those are already signed in, or one click from it. No password prompt ever appears.
• Your MFA has already been satisfied. Most services set a “trusted device” cookie after you complete a second factor, valid for weeks or months. The attacker inherits that trust automatically.
• Your IP address is your IP address. Same residential connection, same city, same ISP. No impossible-travel alert. No “we noticed a sign-in from a new location” email. Nothing for the fraud department to flag.
• Your device fingerprint matches. Same operating system, same browser build, same screen resolution, same time zone, same installed fonts. To the bank, this is you on your own computer doing something unusual — which is a category of event their systems are designed to tolerate.
• Your saved passwords and autofill are right there. They often don’t even need them, but the browser vault, the saved cards, and the address autofill are all available if they do.

Set the money aside for a second, because the account that matters most is usually email. Email is the password-reset endpoint for everything else you own, and it’s also an intelligence file: who your accountant is, which bank you use, what your title insurance company sent you last month, what your law firm charges. An hour of quiet reading gives a stranger a better picture of your financial life than a stolen credit card ever would.

And that’s where this turns into a business problem instead of a personal one.

The Pivot Nobody Sees Coming: Your Email Becomes Their Invoice

They get in. They read. They find a live thread where you’re expecting to pay someone, or expecting to be paid — a closing, a contractor draw, a vendor invoice, a commission check. They don’t hijack anything dramatically. They wait, then reply in your existing thread, from your actual mailbox, with your actual signature block and the full quoted history underneath, saying the banking details have changed and here’s the updated wire instruction.

Then they create an inbox rule that quietly files the replies somewhere you won’t look, so the “wait, is this right?” message never reaches you.

The money lands in a mule account, and by the time anyone notices, it’s gone through three more. Nobody’s antivirus was going to catch that, because nothing about it was malware. It was a legitimate email sent from a legitimate mailbox by someone sitting at a legitimate computer. Like any other potentially powerful tool — a gun, a chainsaw — there is nothing wrong with the tool; it’s the user that renders it dangerous.

This is why, when I tell a residential client that a remote-access agent has been on their machine since May, I’m not being dramatic about the password advice. The exposure isn’t limited to what’s on the hard drive. It extends to everyone who trusts email from that address.

They Install More Than One — On Purpose.

This is a critical point that many people miss.

On the desktop I mentioned, the four ScreenConnect clients were registered on May 15th, 16th, 18th, and 29th. Four installs, spread across two weeks, with distinct instance identifiers — meaning distinct session endpoints. On another machine it was Breeze RMM and ScreenConnect back to back, plus a Chrome Remote Desktop host that had been sitting there since July.

That redundancy is deliberate, and it’s designed around exactly what a reasonable person does next:

1. You notice something odd, or a family member does.
2. You go to Programs and Features, find “ScreenConnect Client,” and uninstall it.
3. You feel better. You tell yourself you caught it.
4. Three weeks later they come back in through agent number two, which you never saw, and now they know you’re watching.

This is also why the timeline matters so much, and why I reconstruct one on every single case. Two installs 90 seconds apart were not performed by the person sitting at the keyboard. That spacing is the signature of a remote operator pushing software, and it tells me the first tool was used to deploy the second — which in turn tells me to stop looking for “the infection” and start looking for a deployment channel.

Why an RMM agent in the mix is a different animal

When one of these installs turns out to be a remote monitoring and management agent — Breeze, Atera, PDQ Connect, GoTo Resolve, SimpleHelp, Level, Action1, and a dozen others — the situation is categorically worse than a plain remote-viewing tool, and here’s why.

A remote-control program like UltraViewer or AnyDesk is, at its core, a screen and a mouse. An RMM agent is an administrative channel. It is built from the ground up to run scripts unattended, transfer files silently, install and remove software, and reach in without the person at the desk being prompted or even aware. It runs as SYSTEM. It’s digitally signed by a real vendor. Endpoint security products trust it, because in 99 cases out of 100 it belongs to the IT department.

So when an attacker gets an RMM agent onto a machine, removing the ScreenConnect client accomplishes nothing durable. The RMM just pushes a new one, from a signed installer, over an outbound HTTPS connection that looks like every other management heartbeat on the internet.

This isn’t a theory I’m extrapolating from my own caseload, either. The published research this year has documented the same layered pattern repeatedly: threat actors abusing a legitimate management platform as the beachhead, then using it to deploy ScreenConnect or SimpleHelp as the persistent foothold. Cisco Talos has tracked initial-access brokers spinning up free-trial RMM accounts specifically for this. Huntress has been cataloguing renamed ScreenConnect binaries delivered under Social Security, invoice, and letter-of-invitation lures since 2025. Securonix documented a multi-wave campaign this past August using fake Adobe and Zoom update prompts to do the same thing. And in early September, researchers described attackers abusing the Faronics Deploy management platform — a real product, used by real schools and businesses — purely as a vehicle to install ScreenConnect on victim machines.

The tooling is legitimate. The signatures are valid. The traffic is boring. That’s the whole point.

One more wrinkle: the ones you can’t see in Programs and Features

Every ScreenConnect client on that desktop had been installed with a flag that suppresses its entry in the Apps & Features list. The owner went looking for it, exactly as you’d hope, and found nothing — because there was nothing to find in the place he knew to look.

Mechanically, this is the SystemComponent value being set to 1 under the product’s uninstall key. It’s a legitimate Windows feature intended for runtime components that shouldn’t clutter the list. In this context it’s a hiding place, and it’s the single best reason not to trust “I checked my installed programs and it’s clean” as a finding.

Finding Them Yourself

Now for the practical part. Everything below runs from an elevated PowerShell prompt on the affected machine.

Before you touch anything: disconnect the machine from the network first — pull the Ethernet cable or switch off Wi-Fi. If someone is connected at that moment, killing their session in front of them gives them a reason to do something destructive on the way out. I isolate every one of these before I start the removal work, without exception.

1. Look at the services. This is where these tools live, and it’s the fastest high-yield check. Check everything, searching for remote access tools you don’t recognize.

A ScreenConnect client, for instance, registers as ScreenConnect Client ( followed by a sixteen-character instance identifier — that identifier is the tell, because it maps to whoever’s relay server it phones home to. Four different identifiers means four different sessions, not one program installed four times.

2. Look for the hidden uninstall entries. This catches what Programs and Features won’t show you:

$keys = 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*',
        'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*'
Get-ItemProperty $keys -ErrorAction SilentlyContinue |
  Where-Object { $_.SystemComponent -eq 1 } |
  Select-Object DisplayName, DisplayVersion, UninstallString | Format-List

Some legitimate runtimes appear here. Anything with a remote-access product name does not belong.

3. Sweep the rest of the persistence. Scheduled tasks, Run keys, and firewall rules are where many leftovers hide. Check these areas thoroughly for anything that was added by a tool you’ve identified in any of the other areas.

4. Check the things that get quietly modified. On a clean case these all come back empty; on a bad one, they’re where the real damage is:

Get-MpPreference | Select-Object -ExpandProperty ExclusionPath
Get-MpPreference | Select-Object -ExpandProperty ExclusionProcess
Get-Content $env:SystemRoot\System32\drivers\etc\hosts
netsh winhttp show proxy

Defender exclusions are the one I care about most. A carved-out exclusion path is somebody building a room your antivirus isn’t allowed to enter, and it is never accidental.

5. Remove, in this order. Stop the service, delete the service registration, then run the product’s own uninstaller using the UninstallString you pulled in step two:

sc.exe stop  "ScreenConnect Client (0000000000000000)"
sc.exe delete "ScreenConnect Client (0000000000000000)"

For MSI-based installs, the uninstall string will be an msiexec call with a product GUID; run it with /qn for a silent removal. Afterward, clean the install directories — C:\Program Files (x86)\ScreenConnect Client (…), %ProgramData%\AnyDesk, %APPDATA%\AnyDesk, C:\Program Files (x86)\UltraViewer, and their equivalents — and then re-run every query above from a fresh session. Don’t take the uninstaller’s word for it. I re-scan every machine after cleanup and compare it against the intake scan item by item, because a removal that reports success and a removal that is successful are two different things, and I’ve seen the gap often enough to never trust it.

Once you’re clean, reconnect to the network, run a full Defender scan, and verify real-time protection is on and definitions are current.

The Uninstall Is the Easy Half

This part is as important as the initial cleanup.

Getting the software off the machine is the part I can do for you. The accounts are the part only you can do, and it matters more than everything above combined. If someone had remote control of a computer for any length of time, treat every credential typed or stored on it as exposed. That means:

• Change passwords from a different device. Your phone or a tablet is fine. Do not do it from the machine you’re not yet certain is clean.
• Start with email, then your Microsoft and Google accounts, then banking, then everything with a stored card number. Email first, always — it’s the reset key for the rest.
• Sign out of all active sessions explicitly. This is the step almost everyone misses. Changing a password does not always invalidate a session that’s already open. Google, Microsoft, Apple, and most banks all have a “sign out everywhere” or “sign out of all other sessions” control. Use it. Otherwise, a stolen cookie keeps working after the password change.
• Check your mailbox rules and forwarding settings. Look for rules you didn’t create, especially ones that move or delete messages, and check that your recovery email address and phone number are still yours.
• Turn on app-based two-factor authentication anywhere it’s offered. Authenticator app over SMS where you have the choice.
• Give your password manager a new master password, since anything in the vault was reachable from that machine.
• Tell your accountant, your bookkeeper, and anyone you regularly send or receive money from. If the mailbox was read, they are downstream of your incident whether they know it yet or not. And from here on, verify any change of payment instructions by phone, at a number you already had — not one printed in the email making the request.

One additional note on the theater of it: on one of these machines, about ninety minutes after the remote session began, someone launched CCleaner by hand and downloaded two copies of its support tool. That’s not incompetence. That’s a performance — visible “cleanup” software running on screen while the person watching feels reassured that something productive is happening. Treat any unsolicited “we’ll clean your computer” session as what it is.

What I Do About It, and Why My Clients Are in a Different Position

Two things make these cases go faster and end more conclusively for my customers, and both are mine.

The first is the Remote Access Guard built into the Triple-S Customer Panel, which I’ve now deployed across thousands of client machines. Without giving away the mechanism, it works in two layers that cover for each other: one keeps the download from happening in the first place, and the other doesn’t watch the browser at all — it watches Windows, and reacts the instant one of these tools registers itself with the operating system. It stops it, locks it out at the firewall, and tells the user plainly what it did. It records the prior state before it changes anything, so a family member’s legitimate remote-support tool can be put back exactly as it was. And it does all of this without a resident service or background process, which is a design constraint I hold myself to on everything I build: ride the infrastructure Windows already provides, and stay out of the user’s way. To my knowledge this is a rare offering in this industry, and I built it precisely because I got tired of cleaning the same machines twice.

The second is S-Ray, my own proprietary in-house diagnostic and analysis platform. It’s what turns four disconnected oddities into a single narrative. S-Ray correlates the installed software inventory, service registration timestamps, startup entries, running processes, live network connections, event log history, Defender detection and quarantine records, browser configuration, and driver state into one correlated picture, grades the machine’s risk posture, and — critically — lets me run the same analysis again at closeout and compare it against intake. That’s how I can tell a client with confidence that the first agent registered on May 15th and the fourth on May 29th, that one was still talking to an outside relay when the machine hit my lab, and that every component of all four is verifiably gone. It’s also how I catch the ones nobody reported: on one of these machines the remote-access stack was the presenting complaint, but S-Ray also surfaced a stalled firmware update, a wireless driver throwing faults twice a day, and a System Restore subsystem that had failed 122 consecutive times — meaning the machine had no rollback point at all.

A scan tells you what’s infected. A correlated timeline tells you what happened. Those are very different deliverables, and after twenty years of this work I am evolving my tooling faster than ever before.

Bottom Line

The remote-access scam has quietly become the most financially dangerous thing I see in this business, and it got there by getting simpler. There’s no exploit, no zero-day, no clever malware. There’s a convincing stranger, a legitimate piece of software, and a person who was trying to be helpful.

If you take three things from this:

1. Nobody legitimate will ever contact you first and ask for remote access. Not Microsoft, not your bank, not Amazon, not Dell, not the Social Security Administration. Not once, not ever. That request, arriving unsolicited, is the entire scam in a single sentence.
2. If you find one, assume there are more. It’s like finding a mouse (and they even build false nests in the same spirit). Check the service install history, not just the programs list.
3. The cleanup doesn’t end the incident. The password and session work does. Do it from another device, and don’t skip the sign-out-everywhere step.

And if you’re staring at a machine right now wondering whether someone’s been on it, stop using it and get it looked at. Two hours of my time is considerably cheaper than the alternative — trust me.

---

If you’re in the Louisville area and think someone may have had remote access to your computer — or you’ve already found one of these and want to be certain it’s the only one — give me a call. I’ve been doing this work since 2006, every machine is handled personally by me, and I’ll tell you exactly what happened and when, not just what got removed.