What is ScreenConnect?

ScreenConnect is a remote assistance software that has legitimate uses, but it is also sometimes installed inadvertently or as part of attacks. Used maliciously, it could grant attackers access not just to your computer but also to any online accounts and services you access through the computer. The purpose of this article is help you determine if ScreenConnect is installed and remove it.

ScreenConnect will normally appear in the Installed Apps settings panel, but attackers sometimes take steps to hide it. Because of this, we describe three ways to help detect it, and you should check all of them.

How to check if ScreenConnect is installed

Detection Method 1: Check in Add or remove programs

The first place to check is the Installed Apps panel.

You can open this through clicking the windows Start Menu and then searching "Installed Apps" or "Add or Remove Programs" as shown below. Once you locate this, click on Open.

In the Installed Apps panel, search for "ScreenConnect" and check to see if you see any applications, below is an example of what it might look like. You may also want to sort your applications by date to look for those most recently installed.

If you see ScreenConnect and want to uninstall it, you can click the "..." to the right of the application, and then click Uninstall.

Detection Method 2: Check in the Program Files folder

The next thing to check is to look for ScreenConnect files on your hard drive in case it was hidden from the Installed Apps panel. in File Explorer.Click on the File Exploer icon on your Task Bar or type "File Explorer" in the Search box in the Task Bar or Start Menu.

Once opened, click on This PC on the bottom of the left side menu, and then click OS (C:)

In your OS disk, open the Program Files (x86) folder and look in there for a folder named ScreenConnect. If you find this folder, that means most likely ScreenConnect is installed.

Detection Method 3: Check in Services

In case ScreenConnect was hidden or installed to a different folder, you should check for to see if the ScreenConnect Service is running..

Open the Services panel by clicking the windows Start Menu and then searching "Services" as shown below.

In the Services panel, scroll down towards the bottom and look for a service called "ScreenConnect." If you find it, ScreenConnect is most likely installed.

Removing ScreenConnect

Here are a few ways to remove Zoho Assist or to disable it if you're unable to remove it.

Removal Method 1: If you see it in the Installed Apps panel.

• Click the "..." to the right of the ScreenConnect application to open the drop-down menu and click Uninstall.

Removal Method 2: PowerShell

If you find the Service, or installation folder, but do not see it under Add or remove programs, you can try uninstalling with PowerShell

• Open Powershell from the Start Menu
  • Open the Start Menu and search "Powershell" as shown below. Once you locate this, click on Open.
    • 
    • Once you've opened Powershell, copy or type the following command, and hit enter. 

      • Get-Package | Where-Object Name -match 'screenconnect' 

        
    • If it shows an application named ScreenConnect, copy or type the following command, and hit enter 
      • Get-Package | Where-Object Name -match 'screenconnect' | Uninstall-Package
        • If you are prompted with a User Account Control popup, click Yes to proceed to uninstall the application. 

Removal Method 3: Disable the Service

• To open the Services panel, open the Windows Start Menu and then search for "Services" as shown below. Once you locate this, click on Open. 
  

• In the Services panel, scroll down and check for a service called "ScreenConnect." 
  

• If it's there, to disable it, right-click on the Zoho Assist service, and click properties.
• 

• Then, click the Startup type dropdown menu and choose Disabled.
• Then under Service Status, click Stop.
• 

Check that it’s gone

After uninstalling ScreenConnect, we recommend that you repeat all three detection methods above to help determine if it was successfully removed. If ScreenConnect or similar software was present on your computer and you didn't install it on purpose, it may be an indicator that your computer is compromised and you should seek professional services. 

Please also contact the IT Service Desk for further assistance.