What is ScreenConnect?

ScreenConnect is a remote assistance software that has legitimate use cases, but can also sometimes be installed inadvertently, or used by attackers to give them remote access to computers. Used maliciously, it could grant and attacker access to not just your computer but also to any online accounts and services that you access through the computer. This article may help you determine if ScreenConnect is installed and remove it.

Although ScreenConnect will normally appear in Add or remove programs like other software, attackers may take steps to hide these sorts of tools. We've provided three different ways to detect it, and you should check all of them. We have also provided some methods to remove or disable it.

How to check if ScreenConnect is installed

Detection Method 1: Check in Add or remove programs

The first place to check is Add or remove programs.

You can open this through clicking the windows Start Menu and then searching "add or remove programs" as shown below. Once you locate this, click on Open

Once you've opened Add or remove programs, search for "ScreenConnect" and check to see if you see any applications, below is an example of what it might look like (you can also sort applications by date to look for the most recently installed applications)

If you do see ScreenConnect there, you can click the "..." to the right of the application, and then click Uninstall

Detection Method 2: Check in Program Files

Use Windows File Explorer to see if the ScreenConnect program files are on your computer. This may be the case even if the program does not show up in Add or remove programs.

To check open File Explorer either by right clicking on the Start Menu, or clicking on the File icon on your task bar

Once opened, click on This PC on the bottom of the left side menu, and then click on your OS disk -- it's typically named OS (C:)

Once you've opened your OS disk, open the folder Program Files (x86), and look in there for folder named ScreenConnect (there will likely be a code following that like (9ee7c4d386e8fd84)). If you find this folder, that means most likely ScreenConnect is installed

Detection Method 3: Check in Services

To check for the ScreenConnect Service, open Services.

You can open this through clicking the windows Start Menu and then searching "Services" as shown below. Once you locate this, click on Open

Once you've opened Services, scroll down, and check for the service called "ScreenConnect Client". If you find this Service, that means most likely ScreenConnect is installed

Removing ScreenConnect

There are a few potential ways to remove or disable ScreenConnect, in order from most to least preferable.

Removal Method 1: If it appears under Add or remove programs

• click the "..." to the right of the application, and then click Uninstall

  

• check to verify it no longer shows up under add or remove programs, and that the file path and service are no longer there

Removal Method 2: Powershell

If ScreenConnect does not show in Add or remove programs, but you find the Service or installation folder, you can try uninstalling with PowerShell.

• Open powershell from the start menu
  • You can open this through clicking the windows Start Menu and then searching "Powershell" as shown below. Once you locate this, click on Open 
    
  • Once you've opened powershell, copy or type the following command, and hit enter: 

    • Get-Package | Where-Object Name -match 'screenconnect' 

      
  • It should only list the application named ScreenConnect if that is the case, copy or type the following command, and hit enter: 
    • Get-Package | Where-Object Name -match 'screenconnect' | Uninstall-Package
      • you may be prompted with a User Account Control popup when uninstalling this, if you are, click Yes to proceed with the uninstallation 

Removal Method 3: Disable the Service

• You can open Services through clicking the Windows Start Menu and then searching "Services" as shown below. Once you locate this, click on Open 
  

• In Services, scroll down and look for the service called "ScreenConnect." 
  

• Right click on the ScreenConnect service, and click properties
  

• Under properties, click the Startup type: dropdown, and choose Disabled, and then click Stop under service status 

Check that it’s gone

After uninstalling ScreenConnect, we recommend that you repeat all three detection methods above to help determine if it was successfully removed. If ScreenConnect or similar software was present on your computer, and you didn't install it on purpose, it may be an indicator that your computer is compromised, and you should seek professional services. 

Please also contact the IT Service Desk for further assistance.