Tools to look for
There are dozens of legitimate remote tools — most also abused by scammers. Common ones:
- AnyDesk, TeamViewer, Quick Assist, UltraViewer, ScreenConnect / ConnectWise Control
- LogMeIn, Splashtop, Supremo, RustDesk, Parsec, Chrome Remote Desktop
- Built-in Windows Remote Desktop (RDP), Windows Remote Assistance
Step 1: Search Installed apps
Settings → Apps → Installed apps. Use the search box to type each tool name above one at a time.
Sort by Date installed and review anything from the last 30 days.
Step 2: Check running processes
Open Task Manager → Details tab. Look for processes like
AnyDesk.exe, TeamViewer.exe, UltraViewer_Service.exe, ScreenConnect.WindowsClient.exe, QuickAssist.exe.Right-click any suspicious process → Open file location to see where it lives.
Step 3: Check Windows Services
Press Win + R, type
services.msc and press Enter.Sort by Status. Look for services running with names matching the tools above. Any service set to 'Automatic' will start at every boot.
Step 4: Check connection logs
AnyDesk: open the app → menu → Connection trace. Or check
C:\ProgramData\AnyDesk\connection_trace.txt.TeamViewer: open the app → Help → Open log files. Look for incoming connections from IDs you do not recognise.
Windows RDP: open Event Viewer → Applications and Services Logs → Microsoft → Windows → TerminalServices-LocalSessionManager → Operational.
Important
If you see incoming connections from IDs or IPs you do not recognise, treat the PC as compromised: change passwords from a different device first, then continue cleaning up.
Was this guide helpful?
Know someone who needs this? Send them the guide.
JD
Written by
Jordan DicksonFounder, CyberSecurityGuides
Founder of CyberSecurityGuides, writing practical, jargon-free guides that help everyday people recover from and protect against online attacks.
Reviewed by CSG Security Engineers