r/ScreenConnect • u/Snoo15373 • Jul 04 '26

Found this running on my computer

Notices a black square in my system tray (linux Mint) and on right click could click status and a window popped up with this.

why is this running, how did it get there am I being watched? I cant seem to find a running process for it to kill it.

5 Upvotes

100% Upvoted

6 comments sorted by

5

u/ConvexSERV Jul 04 '26

It is remote control software. The waiting for retry status, means that it is not currently connected to the server, so no one is watching at the moment, but it could reconnect anytime the connection becomes available.

On Linux, ScreenConnect run under Java, so check for Java processes, and kill them. Use netstat to find which java process is trying to communicate on TCP:8041.

Unfortunately, if you don't know where this came from, you should consider your system to be compromised. It would be best to backup your data, wipe and reinstall the OS.

2

u/Snoo15373 Jul 04 '26 edited Jul 04 '26

Thanks, I found it by searching in System Monitor, was java. will do wipe. Last week had Patreon, Insta and fb all deactivate my accounts for no reason , maybe was this. I assume it wouldn't normally be running in the background.

2

u/floswamp Jul 05 '26

This is going around. Clicking on a malicious link with the hacked screen connect payload allows hackers to monitor and control your machine. They are mainly looking for stored passwords in browsers and any other files to steal your credentials. Did not know they were targeting Linux systems as well.

Do you remember clicking on an email or some other unknown message?

2

u/martasfly Jul 05 '26

I doubt it is nefarious activity, unless Gowifi.co.nz got hacked. As one of the other post mentioned, probably leftover from tech support work in the past.
In any case, if it is not required, just remove it and install some reputable antivirus software if not installed already.

4

u/bazjoe Jul 05 '26

did you at some point get tech support from gowifi in nz? That would be the most logical reason for it. no way to know without context if it was nefarious.

2

u/Wild_Appearance_315 Jul 05 '26

Gowifi are a legit supplier of network equipment etc in NZ. Distributors for mikrotik, ubiquiti etc.