Possible hack on computer through 'ScreenConnect Client'?

[arapahoepark]

So this morning on our desktop computer my dad noticed the cursor moving and opening windows and then suddenly it stopped.
Taking a look at task manager, I saw ScreenConnect Client and that looked suspicious. I don't recall this program at all. I went to uninstall it via control panel and a window popped up wanting to know if the app should make changes. I hit no and nothing happened. No uninstall. Tried it again hit yes and it started to uninstall but it said something else, I can't remember what. But it did go away from the control panel.
I know very little about computers so what are next steps aside from a scan?

 

[NaphtaliPress]

Did your Dad have any tech support recently? Otherwise it could be some fraudulent install somehow.
AI Overview
Learn more

No, ScreenConnect Client itself is not inherently a "hack," but it can be used as a tool for malicious activity if not properly secured and managed, particularly due to recent vulnerabilities that allowed attackers to exploit the software to gain unauthorized access to systems through authentication bypass flaws; therefore, it's crucial to ensure you are using the latest patched version of ScreenConnect to mitigate potential security risks.

Key points about ScreenConnect and potential security concerns:

• Vulnerability Exploitation:
  A critical vulnerability (CVE-2024-1709) was discovered in ScreenConnect, allowing attackers to bypass authentication mechanisms and gain unauthorized access to systems, which has been actively exploited by malicious actors.
  
  
• Improper Usage:
  While designed for legitimate remote access, ScreenConnect can be misused by individuals who trick users into installing it to gain control of their systems, sometimes used in technical support scams.
  
  
• Patching is Crucial:
  To protect against exploitation, it's essential to ensure you are using the latest version of ScreenConnect with all security patches applied.
  

 

[Edward]

Malwarebytes and Spybot to get your started.

 

[arapahoepark]

Did your Dad have any tech support recently? Otherwise it could be some fraudulent install somehow.
AI Overview
Learn more

No, ScreenConnect Client itself is not inherently a "hack," but it can be used as a tool for malicious activity if not properly secured and managed, particularly due to recent vulnerabilities that allowed attackers to exploit the software to gain unauthorized access to systems through authentication bypass flaws; therefore, it's crucial to ensure you are using the latest patched version of ScreenConnect to mitigate potential security risks.

Key points about ScreenConnect and potential security concerns:

• Vulnerability Exploitation:
  A critical vulnerability (CVE-2024-1709) was discovered in ScreenConnect, allowing attackers to bypass authentication mechanisms and gain unauthorized access to systems, which has been actively exploited by malicious actors.
  
  
• Improper Usage:
  While designed for legitimate remote access, ScreenConnect can be misused by individuals who trick users into installing it to gain control of their systems, sometimes used in technical support scams.
  
  
• Patching is Crucial:
  To protect against exploitation, it's essential to ensure you are using the latest version of ScreenConnect with all security patches applied.

Nope. Not sure what happened.

 

[83r17h]

What sort of computer? What windows were opening?

 

[arapahoepark]

What sort of computer? What windows were opening?

It's a Dell Computer. It opened software browsers, one of them mine.

 

[83r17h]

It's a Dell Computer. It opened software browsers, one of them mine.

Sorry, I phrased the question poorly - Windows, Linux? If Windows, what version?

 

[arapahoepark]

Sorry, I phrased the question poorly - Windows, Linux? If Windows, what version?

Windows 11. Also, I meant Internet browsers.

 

[83r17h]

Checking the browsing history might be interesting to see if they downloaded anything. Checking the process list for recently started processes can also be interesting. Typically Windows Defender is pretty good, so instructing it run a full scan (which will take awhile) would be a good idea.

 

[arapahoepark]

Checking the browsing history might be interesting to see if they downloaded anything. Checking the process list for recently started processes can also be interesting. Typically Windows Defender is pretty good, so instructing it run a full scan (which will take awhile) would be a good idea.

Ok. Did a McAfee (dad has a subscription, I don't know why. I think it slows the computer down) scan and it so far sees nothing.

 

[83r17h]

Ok. Did a McAfee (dad has a subscription, I don't know why. I think it slows the computer down) scan and it so far sees nothing.

Yeah - McAfee is not a good security product. Defender is far superior.

 

[arapahoepark]

Yeah - McAfee is not a good security product. Defender is far superior.

General Windows security sees nothing either...

 

[83r17h]

General Windows security sees nothing either...

Hmm. Well, if you've uninstalled it, then I'd keep an eye out, but not worry too much. Consider rebooting the computer as well.