Share via

My Windows PC was hacked

Cynthia-5300 0 Reputation points
2025-12-01T19:43:53.7566667+00:00

In early October I returned from lunch to find my Windows computer locked. The screen was black except for the word "SCREENCONNECT." I unplugged my computer to login again. For the next two weeks there were at least three more incidents. Most strange was that my cursor wouldn't function, but I could see a cursor moving around my black screen. I researched "screen connect" on the internet and learned it is a program Microsoft installed for remote access to assist customers in resolving issues. It took some searching but I found the "screen connect client" program under services. It was set to "start" rather than "manual." I could not delete the program but, hopefully, set it to "disable" permanently. Two weeks later my Amazon account was breached and some unknown person purchased a $2,300 Mac computer using my credit card. I never received an email from Amazon confirming the purchase or an email about the shipping. I did not receive an alert from American Express either. According to Amazon and American Express e mail messages/alerts were sent. Somehow, the hacker was able to divert these emails so that I did not receive them. Geek Squad searched for viruses and malware and my PC was clean. I am guessing that "screen connect" was exploited by a hacker, who then committed a criminal offense, which may cost me $2,300 (that is another long explanation). Who at Microsoft should I contact about this hacking incident?

Moved from: Microsoft Security | Microsoft Authenticator

Windows for home | Other | Security and privacy
0 comments

3 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Q&A Assist
    2025-12-01T19:44:12.4833333+00:00
    AI generated content. This question contains an answer created with AI from Q&A Assist. Learn more

    If you suspect that your Windows PC has been compromised, especially with incidents like unauthorized remote access and financial fraud, it's crucial to take immediate action. Here are steps you can follow:

    1. Report the Incident: You can report the hacking incident to Microsoft by using their technical support scam form. This will help them track and address such issues.
    2. Secure Your Accounts: Since your Amazon account was breached, ensure you change your passwords for all important accounts, including your email and financial accounts. Enable two-factor authentication wherever possible.
    3. Monitor Your Financial Statements: Keep an eye on your bank and credit card statements for any unauthorized transactions. Report any suspicious activity to your financial institutions immediately.
    4. Consider Professional Help: If you continue to experience issues, consider seeking help from a professional IT security service that can provide a thorough investigation and remediation.
    5. Educate Yourself on Security Practices: Familiarize yourself with common security practices to prevent future incidents, such as not allowing unsolicited remote access and being cautious about sharing personal information.

    For future reference, remember that Microsoft does not initiate unsolicited contact to request access to your device or personal information. Always ensure that any remote access is initiated by you.

    References:

    0 comments
  2. Lychee-Ng 10,900 Reputation points Microsoft External Staff Moderator
    2025-12-02T09:03:14+00:00

    Hi Cynthia-5300,

    Welcome to Microsoft Q&A!

    ScreenConnect (also known as ConnectWise Control) is NOT a Microsoft program. You were likely targeted by a tech support scammer who installed it to maintain access. You can find the link to report such an incident provided by the AI assistant: Report a technical support scam

    I understand how concerning it is to suspect that your Windows PC was hacked and to experience unauthorized remote access and account breaches. This is a situation that requires immediate action beyond typical tech support from Microsoft. Here's what I can suggest:

    1. Disconnect the computer from the Internet (Ethernet/Wi-fi) to prevent further access.
    2. If you cannot uninstall ScreenConnect, boot into Safe Mode and try again.
    3. From a secure device, change your Microsoft account password and any other accounts (Amazon, email, banking) that you ever used on this PC.
    4. If you suspect deep compromise persists, back up your files and perform a clean installation of Windows.
    5. Taking in the possible consequences, you should consider filing a police report:
      1. Contact local law enforcement
      2. File a report for unauthorized computer access and fraud
      3. Get a case number for Amazon/Amex investigations

    Again, ScreenConnect is a third-party remote access tool, and Microsoft never uses it for remote assistance. If you did not install it yourself or authorize its use, it is a strong indicator that your system was compromised.

    If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

  3. Cynthia-5300 0 Reputation points
    2025-12-02T11:48:50.6066667+00:00

    I did not install a remote access program on my computer--not Installer, ScreenConnect Client, etc. I did not authorize the installation of a remote access program on my computer because I have had no need for support assistance with a computer issue. If it was not already installed when I purchased my computer in 2023, then I have no idea how it was installed, without me knowing, on my computer.

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.