1

I need advice on how to remove Anydesk from my computer. I had received an email from someone that (I since found out that it was a fake) appeared to be from PayPal that said I needed to pay $XXX, I did not recognize the purchase and I was worried that they would affect my credit if I did not, so I called the number in the email and the person that answered ended up putting Anydesk on my computer. How? I don't know whether it was Flatpack, Snap, Deb file, or whatever. He did it without my permission.

I am running Linux Ubuntu 22.04.3 LTS with Linux Kernel 6.2.

I have recently removed any and all traces I could find of Anydesk, but still it remains on my computer. Using the 'search' function in the files folder I have tried deleting all items related to Anydesk, and then I went to the hidden files and did the same thing. I was able to remove all but one file (that I was able to locate), and the one file that I tried to remove by deletion still indicated that the "file cannot be deleted".

In the upper right hand top of the screen there is an icon for Anydesk that I can't remove, try as I might. Even right clicking on it, I get the 'quit' message so I select it. After deletion efforts, I did an update and then did a reboot, and then the icon returns.

When I select the icon, I get this:

enter image description here

enter image description here

I do not think it actually is logged into anything I do, like my keyboard use, but I still want it removed.

Any help would be greatly appreciated.

Best regards,

George Generke

GWGeorge007
  • 29
  • 5
    Please edit your question and add more information on how you installed Anydesk. Did you install using Flatpack, Snap, Deb file, or did you add the PPA repository? Also add how did you "remove any and all traces"? Also add what happens if you click on the icon of Anydesk? What happens if you right click on the icon, do you get the Quit option? – user68186 Dec 30 '23 at 19:23
  • 5
    If you are unsure of how the program was installed, you might want to consider simply nuking and reinstalling your system from scratch. A clean install (after copying files you want to keep to external media) would allow you to make sure you've removed all traces of the bad guys programs. – Thomas Ward Dec 30 '23 at 23:28
  • I did get the QUIT option when selecting the icon, but it still returned after doing an update and then rebooting. – GWGeorge007 Dec 30 '23 at 23:38
  • Also, I do not want to do a re-installation of the hard drive after nuking everything. I do know how to do that, but it is VERY time consuming. I just hope that someone has an answer to my original question. – GWGeorge007 Dec 30 '23 at 23:41
  • 2
    You might remove Anydesk or whatever it is by some means, but there's no guarantee that you will be able to remove any other backdoor that the attacker has set up, so you'll probably just end up having it installed again by the attacker. – muru Dec 31 '23 at 00:12
  • 2
    A compromised installation has become untrustworthy. Reinstalling is really the ONLY way to make sure that it's clean. Otherwise you can never know what evil things an attacker got onto your system. – HuHa Dec 31 '23 at 01:25
  • I agree: NUKE the system. The only correct option. and @GWGeorge007 I disagree: it is not timeconsuming, What you need to do is prepare once: create scripts for all the changes you made after the install is done and it is very easy to reinstall, – Rinzwind Dec 31 '23 at 07:32
  • If you have good backup from before you were hacked including /home, list of instlalled apps and any server type apps in / , then reinstall & restore should take less than an hour if you have SSD and faster Internet. Only a little longer if Internet not really fast. But a backup now may include the malware. Never call number in scammer's email. Lady in news lately called that number said he was bank's security chief & she should remove all her money & convert to bitcoin. Lost everything. – oldfred Dec 31 '23 at 15:37
  • For your safety, please don't post screenshots of the Anydesk window. It contains the unique number that can be used to remotely access your computer. Normally Anydesk would ask your permission when someone tries to remotely access your computer. However, that setting can be changed and may have been changed by the scammer. – user68186 Jan 02 '24 at 23:15
  • Since you don't think I have answered your question, I will delete my answer. – user68186 Jan 15 '24 at 18:14
  • 1
    @user68186 at least wait until Valentine's day, seriously all answers are useful to someone in the future. – Raffles Jan 16 '24 at 00:03

2 Answers2

7

"I have recently removed any and all traces I could find of Anydesk, but still it remains on my computer."

You were the victim of criminal activity, not an honest mistake.
Consider your system compromised by professionals.
They know how to prevent you (and us) from easily removing their malware and backdoors.
Nuke it immediately.

"I do not want to do a re-installation of the hard drive after nuking everything. I do know how to do that, but it is VERY time consuming."

Yes, it can be.
Sorry.

user535733
  • 62,253
0

Background

Anydesk is a legitimate program. I use it to help my family members with their computer problems. It is unfortunate that scammers use it too to access the victim's computer. They usually tell you what to do to install Anydesk in your computer. Without Anydesk or something similar, they do not have access to your computer. Once you install Anydesk and allow them to gain full full control of your computer, they may install other programs and malware without your knowledge. There are quite a few videos on YouTube that shows how the scammers operate. Here is another one.

From your edits it looks like you have not uninstalled it. you may have removed the icon from the dock, but that does not remove the software. Since it is not clear how you installed it in the first place, I will tell you a few methods.

Warning

The scammers may have installed other malware once they had access to your computer using Anydesk. Malware includes other software to regain control of your computer, keyloggers, to record and steal your passwords, to name a few things. For this reason, as others have said in comments and answers, it is best to reformat the hard drive and reinstall Ubuntu.

1. Uninstall using apt

Open a terminal by pressing Ctrl+Alt+T. Enter the command:

sudo apt purge anydesk

Note, apt purge uninstalls the app, as well as removes all the configuration files

If this does not work and you get see something like:

E: Unable to locate package anydesk

Then Anydesk was probably not installed using the "deb" file or the PPA.

Clean up

Once Anydesk is removed by this method, you may want to remove its repository, GPG key and folders.

First find the repository and GPG files:

sudo ls /etc/apt/*/anydesk*

You will see an output like this:

/etc/apt/trusted.gpg.d/anydesk.gpg~
/etc/apt/trusted.gpg.d/anydesk.gpg
/etc/apt/sources.list.d/anydesk-stable.list

2. Uninstall using GUI

This method does the same thing as the command line method above. So, if the above didn't work, this probably won't. Unfortunately the Ubuntu Software app does not find Anydesk when it is installed. So there is no easy GUI method to uninstall it without installing another software like gnome-software or synaptic.

One way to get around it is to right click on the downloaded Deb file:

enter image description here

and select Open with other application. Then select Software Install:

enter image description here

This will open Ubuntu Software to the following page:

enter image description here

Click on the red trash can to uninstall confirmation dialog:

enter image description here

You will have to provide your password to uninstall Anydesk. Once uninstalled the red icon on the top right hand corner will be gone. You will still need to delete the config folders Anydesk created as default, and in your home folder. These are easier to delete from the terminal:

sudo rm -r /etc/anydesk

See the Clean up personal files section below for the rest of the folders to delete.

If you installed Anydesk from the PPA repository (from the terminal) then you can use the app software & Updates. You will find the Anydesk PPA repository under the Other Software tab:

enter image description here

Use the Remove button below to remove it.

They you will have to remove the GPG public key for Anydesk. To do this go to the Authentication tab of the software & Updates app and look for "philndro Software":

enter image description here

Use the Remove button below to remove it.

3. Other possible ways to uninstall

I am listing both Snap and Flatpak uninstall methods here. I am not sure if Anydesk is available in the snap and flatpak formats. So these may not work. Use the commands:

sudo snap remove anydesk
sudo flatpak uninstall --delete-data anydesk

If these do not work try these commands without sudo in case Anydesk was installed just for your user:

snap remove anydesk
flatpak uninstall --delete-data anydesk

Even if these commands don't work, they should not harm your system.

Clean up personal files

Then remove these files using the following commands:

sudo rm /etc/apt/sources.list.d/anydesk-stable.list
sudo rm /etc/apt/trusted.gpg.d/anydesk.gpg
sudo rm /etc/apt/trusted.gpg.d/anydesk.gpg~

Now remove all the files in your personal home folder:

rm -r .anydesk
rm -r video/AnyDesk
rm -r Documents/AnyDesk

I think that's all of them.

Hope this helps

user68186
  • 33,360
  • 1
    "...it is best to reformat the hard drive and reinstall Ubuntu." Thank you for making a prominent warning and making your advice clear. – user535733 Jan 02 '24 at 21:21