ScreenConnect and ConnectWise scams
Support software real technicians use, abused when a stranger installs it.
ScreenConnect, sold by ConnectWise and for a while called ConnectWise Control, is remote-support software used by IT companies and in-house support teams. If your employer or your local computer shop looks after your PC, there’s a fair chance they use it.
Scammers like it for a different reason. Once it’s installed, ScreenConnect can stay on a computer and let someone connect again later, without anyone at the PC doing anything. For a scammer, that’s a way back in.
How the scam usually arrives
Most ScreenConnect scams start with an email or a call. The common versions:
- An invoice or renewal email for antivirus, a support plan or an online order, with a number to call if you want to cancel.
- A message dressed up as a document to sign, a tax form or a government statement, with a link to view it. What downloads is actually a ScreenConnect installer.
- A caller claiming to be your bank, your internet provider or Microsoft, who sends you a link to “join a support session”.
The link often goes to an address ending in screenconnect.com, with a company name in front that has nothing to do with the story. The file that downloads usually has ScreenConnect or ClientSetup in its name, though scammers sometimes rename it to look like a PDF or an invoice.
Why it’s hard to spot afterwards
ScreenConnect installs as a Windows service. That means it runs in the background, starts with Windows, and keeps going after the call ends and its window disappears. You may see nothing on screen at all. In your list of installed apps it appears as “ScreenConnect Client” followed by a string of letters and numbers in brackets.
If one of those is on your computer and you don’t know who put it there, assume someone can still connect.
How to tell if it’s running right now
Press Ctrl + Shift + Esc to open Task Manager and click the Services tab. A service named ScreenConnect Client, with a code in brackets, means it’s installed and ready to accept connections. While someone is actually connected, ScreenConnect usually shows a small panel or a notice in the corner of the screen, but scammers can hide that, so don’t rely on seeing it.
Is ScreenConnect safe?
The software is fine. The question is who controls it. A ScreenConnect client installed by your company’s IT team on a work laptop is normal. One that turned up on your home PC after a call about a refund isn’t.
If you’re not sure, ask whoever looks after your computer whether they use ScreenConnect. If nobody does, remove it.
On a work computer, don’t uninstall anything yourself. Disconnect from the network and call your IT team on a number you already have. They’ll want to know about a session they didn’t start, and removing their own tool could get in the way of them checking what happened.
How to remove ScreenConnect
- Disconnect from the internet first, so nobody can connect while you work.
- Open Settings, then Apps, then Installed apps (Apps & features on Windows 10).
- Find every entry called ScreenConnect Client or ConnectWise Control Client, and uninstall each one. There may be more than one.
- Look through the rest of the list, sorted by install date, for anything else that arrived the same day.
- Restart the PC, check the list again, then run a full scan in Windows Security.
If it won’t uninstall, or it comes back, leave the PC offline and get help from a technician you already know.
What else to do
Assume anything you did on that computer while ScreenConnect was installed could have been watched. From a different device, change your email password first, then banking and anything else important. Call your bank if you signed in to it on that PC, or if any money moved. Our guide on what to do after a remote access scam has the full checklist.
For businesses that rely on ScreenConnect
If your support runs on ScreenConnect, banning it isn’t an option. The risk is a session nobody expected, often from an instance that isn’t yours. Guardian Business lets your own technicians connect as usual while every other remote connection waits for approval from a named person, and every request is logged with who approved it. See Guardian for business.
Last updated