How to Check for and Remove Suspicious ScreenConnect on Windows

This guide is for people who have found ConnectWise ScreenConnect on a Windows PC and do not recognize it. ScreenConnect is legitimate remote support software. Its presence alone does not mean a computer is infected: an employer, school, repair shop, or support provider may have installed it with permission. The important questions are who installed it, which organization controls it, and whether that use was authorized.

If this is a work or school computer, contact your IT team before changing services, files, or security settings. Removing a managed support tool can disrupt legitimate support and may destroy evidence needed for an investigation.

What the 2024 ScreenConnect vulnerabilities mean

In February 2024, ConnectWise disclosed two vulnerabilities affecting certain self-hosted ScreenConnect versions: CVE-2024-1709, an authentication bypass, and CVE-2024-1708, a path traversal flaw. CISA reported evidence that CVE-2024-1709 was being exploited in the wild. ConnectWise published fixes for affected self-hosted servers. This history is useful context, but it does not mean every ScreenConnect client found on a PC is malicious or currently vulnerable. Check the ConnectWise security bulletin and CISA alert for the original incident details.

Signs that deserve a closer look

Investigate further when you cannot identify the organization controlling the installation, someone installed it without your permission, or you find other indicators such as an unexpected remote session, security alerts, unfamiliar administrator accounts, or changes you did not make.

A folder name, service name, file name, domain suffix, or open network connection is not proof by itself. Administrators can customize ScreenConnect deployments, and legitimate clients can use different names and locations. Do not delete files or disable protection based on one indicator.

Step 1: If you suspect active unauthorized access

If a remote session appears to be active and you cannot reach the person or organization that manages the PC, disconnect Wi-Fi or unplug Ethernet. If this is a company device, follow your incident-response instructions or call IT from another device. Disconnecting the network can interrupt remote control, but it does not remove malware and may affect evidence collection.

Do not sign in to banking, email, work, or cryptocurrency accounts from a computer you believe is compromised. Do not enter new passwords on it. If you need to preserve evidence, note the time, take a photo of visible alerts, and avoid deleting files or clearing logs.

Step 2: Check whether the installation is expected

Review Settings > Apps > Installed apps and look for ConnectWise ScreenConnect or ScreenConnect Client. Check with your employer, school, repair provider, or family IT administrator before removing it. If the device is personally owned and no one recognizes the installation, continue with read-only checks below.

List matching Windows services

Open PowerShell. You can run the following command in a normal PowerShell window to list services whose name, display name, or executable path mentions ScreenConnect or ConnectWise:

Get-CimInstance Win32_Service |
Where-Object {
    $_.Name -match 'ScreenConnect|ConnectWise' -or
    $_.DisplayName -match 'ScreenConnect|ConnectWise' -or
    $_.PathName -match 'ScreenConnect|ConnectWise'
} |
Select-Object Name, DisplayName, State, StartMode, PathName |
Format-List

The PathName field shows the command Windows uses to start the service. Record the service name, file path, and any server or relay address in the command. A path outside a familiar folder can be worth investigating, but it is not enough to classify the service as malicious. ScreenConnect deployments may be customized.

Inspect matching processes

This command only displays matching process details. It does not stop or change them:

Get-CimInstance Win32_Process |
Where-Object {
    $_.Name -match 'ScreenConnect|ConnectWise' -or
    $_.CommandLine -match 'ScreenConnect|ConnectWise'
} |
Select-Object ProcessId, Name, ExecutablePath, CommandLine |
Format-List

A command line may include the address of the ScreenConnect server. Compare it with the organization that is supposed to provide support. Do not publish an instance address, session code, or other identifier in a public forum.

Check network connections, if needed

To list established TCP connections owned by a process whose name contains ScreenConnect or ConnectWise, run:

$matchingIds = Get-Process -ErrorAction SilentlyContinue |
Where-Object { $_.ProcessName -match 'ScreenConnect|ConnectWise' } |
Select-Object -ExpandProperty Id

Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue |
Where-Object { $_.OwningProcess -in $matchingIds } |
Select-Object LocalAddress, LocalPort, RemoteAddress, RemotePort, State, OwningProcess

An established connection only shows that a process is communicating with a remote endpoint. It does not show whether the session is authorized or whether the endpoint belongs to an attacker. Confirm the address with the organization that manages the installation.

Step 3: Review Microsoft Defender exclusions

Malware can abuse antivirus exclusions, but exclusions can also be configured by administrators or other software. Review them without changing anything:

Get-MpPreference |
Select-Object -Property ExclusionPath, ExclusionProcess, ExclusionExtension |
Format-List

If an exclusion is unfamiliar, record it and ask the device administrator or a qualified support professional to verify it. Do not remove an organization-managed exclusion or change security policy based only on a folder name. If you confirm an unauthorized exclusion on a personal PC, remove it through Windows Security or with help from Microsoft support, then run a scan.

Step 4: Review scheduled tasks and startup entries

The following commands list matching scheduled tasks and common Run-key startup entries. They do not disable or delete anything:

Get-ScheduledTask -ErrorAction SilentlyContinue |
Where-Object {
    $_.TaskName -match 'ScreenConnect|ConnectWise' -or
    $_.TaskPath -match 'ScreenConnect|ConnectWise' -or
    $_.Actions.Execute -match 'ScreenConnect|ConnectWise' -or
    $_.Actions.Arguments -match 'ScreenConnect|ConnectWise'
} |
Select-Object TaskName, TaskPath, State, Actions |
Format-List

$runKeys = @(
    'HKLM:\Software\Microsoft\Windows\CurrentVersion\Run',
    'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run',
    'HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run'
)

foreach ($key in $runKeys) {
    if (Test-Path $key) {
        Get-ItemProperty $key -ErrorAction SilentlyContinue |
        Format-List *
    }
}

Review the output for entries that point to the files or folders you have already identified. A matching word alone is not enough to justify removal. If you find an unfamiliar entry, save its details and get help identifying it before making changes.

Step 5: Verify the file and its publisher

In File Explorer, right-click the executable, choose Properties, and inspect the Digital Signatures tab if one is present. A valid signature from ConnectWise can help establish who signed that file, but it does not prove that the installation was authorized or that the device is clean. An unsigned file is not automatically malware either. Compare the file and installation details with your support provider and, where appropriate, scan the file with Microsoft Defender.

ConnectWise documents that legitimate client installations can use instance-specific folders under C:\ProgramData, so that location alone is not evidence of compromise. See its host client documentation.

Step 6: Remove a confirmed unauthorized installation safely

Do not run a broad command that kills every process with “ScreenConnect” in its name, deletes a folder, removes a scheduled task, or deletes a service. Those actions can interrupt legitimate support, break managed software, or erase evidence. This guide deliberately uses read-only discovery commands.

For a work or school computer, ask IT or the security team to contain and remove the installation. For a personally owned computer, first confirm that no trusted support provider manages it. Then use Settings > Apps > Installed apps to uninstall the application if it is listed. If it is not listed, or the uninstall fails, ask Microsoft support or a reputable technician to review the recorded service and file paths rather than deleting system entries by guesswork.

If you believe the device has been compromised, consider keeping it disconnected until it has been assessed. Avoid reinstalling or resetting it before you decide whether logs or files need to be preserved.

Step 7: Run Microsoft Defender scans

Update Microsoft Defender security intelligence, then run a full scan from Windows Security. If you still suspect persistent malware, Microsoft documents an offline scan that restarts the PC into a separate scanning environment. Save your work first. If BitLocker is enabled, make sure you have the recovery key available before restarting.

You can start an offline scan from an elevated PowerShell window with:

Start-MpWDOScan

Read Microsoft's Microsoft Defender Offline guidance before running the scan. It explains requirements and how to review scan results. An offline scan is a useful check, but no single scan can prove that a device is completely clean.

Step 8: Report suspected abuse

If you identify an unauthorized ScreenConnect instance, preserve the relay or server address and the time you observed it. Avoid sharing session codes, personal information, or machine details publicly. You can submit a report through the official ScreenConnect abuse-reporting page. If this is a managed device, report it to your IT or security team first and follow their instructions.

Step 9: Protect your accounts from a clean device

If you have reason to believe someone accessed the computer, use a separate, trusted device to:

1. Change important passwords, starting with your primary email, financial accounts, work accounts, and password manager.
2. Enable multifactor authentication where available.
3. Review account activity and sign out sessions you do not recognize.
4. Contact your bank promptly if you notice an unfamiliar transaction.
5. Review browser extensions and account recovery settings.

Key takeaway

ScreenConnect is legitimate remote-support software that can also be abused when installed or controlled without authorization. Verify who manages the installation, use read-only checks first, and get qualified help before deleting services, tasks, exclusions, or files. A suspicious-looking path or an active network connection is a clue to investigate, not proof of compromise.

Official references

• ConnectWise ScreenConnect security bulletin
• CISA alert on CVE-2024-1709
• Microsoft Defender Offline guidance