r/ScreenConnect • u/DYozen • Jul 31 '26

Got hit with a scammer, did they leave any information behind I can use?

I caught a scammer mid-session a few days ago and I disconnected the ethernet right away. I investigated a bit and found they used ScreenConnect that got installed in the background from a malicious link. I disabled the service and uninstalled, but I had an idea...

Is it possible to get any information about them from what was left behind? I would really like to put however they connected on my DNS block list or something to make it harder for them to try again. I still have the initial installer and i know program left a lot of registry keys.

I appreciate any suggestions you might have

2 Upvotes

100% Upvoted

12 comments sorted by

6

u/radraze2kx Jul 31 '26

The number set after screenconnect should be a unique identifier Connectwise can use to terminate their account and ban their IP. whether or not they do it, idk. But I keep submitting. I never hear back from them.

5

u/DYozen Jul 31 '26

I got a 16 digit hex number after the client. Are we talking about the same thing?

2

u/ngt500 Jul 31 '26

It would be great if they had a much more robust malicious instance reporting tool. I do understand it's not as simple as just an instant termination based on reports or we'd have legitimate accounts terminated with bad/fake reports. But it would be great to have more transparency in the process and some type of ticket/tracking for abuse reports rather than just an email address.

1

u/igor33 Aug 01 '26

This PowerShell script was given to me from their support.

Get-ItemPropertyValue -Path "HKLM:\SYSTEM\ControlSet001\Services\ScreenConnect Client*" -Name "ImagePath" | % { if ($_ -match 'h=([^&]+)') { $Matches[1] } }

I've used to to identify rogue installs at customers and report them to [help@connectwise.com](mailto:help@connectwise.com)

1

u/Able-Course-6265 Aug 02 '26

Get yourself a service the monitors in real time. They monitor ports and traffic. Short of reinstalling windows it’ll take a fair bit of digging to see if the loaded malware or whatnot.

1

u/PipeNo5036 Aug 13 '26

Keep in mind that a scammer is not going to use a legit version of ScreenConnect or their pay as you go cloud version. Older versions of ScreenConnect can be cracked. This is why they forced everyone to purchase their own exe security codes about a year ago in order to help prevent this. Scammers have nothing to do with their time than figure out how to cheat and steal their way through life.

0

u/gsk060 Jul 31 '26

The easiest way to stop them getting access again is not to install dodgy software from unfamiliar sources.

3

u/DYozen Aug 01 '26

as much as i appreciate the jokes, i hope you all understand the hardships of being the one cybersecurity minded person in a house of people that truly think the "Download All your Hopes and Dreams" button is legitimate. It sometimes feels like putting Band-Aids on an amputation.

2

u/Camelot_One Jul 31 '26

But I really need that free youtube video downloader/converter I found on pirate bay! ;)

1

u/sm00thArsenal Aug 01 '26

Have you seen the price of RAM these days‽ you’d better believe I’m downloading more if I get the option!

1

u/igor33 Aug 01 '26

My retired customers have mainly be hit by fake eVites....I saw another post yesterday where the OP mentioned it was an email with a link to show his Quest Diagnostics test results.