How to remove a Programme installed by fraudulent means

Individuals claiming to be from the London-based Bitcom Financial company with the name of the company where I had purchased invested in Bitcoins 5 years who knew my account number and exact amount had invested contacted me, In this process a programme was installed in my computer called AnyDesk and the functions permitting access to  my computer are on. I have removed/uninstalled this programme but what now must be manually unistalled removed are the Programme Folder as well as the Shell Association of AnyDesk. Does anyone know how to remove these?

Edited by hamluis, 28 January 2024 - 04:34 PM.
Moved from Intros to Gen Sec - Hamluis.

First what exactly are file extension(s) of this? 

It will be listed in the Root of the Registry - and can be deleted easily (in Safe Mode is easier). Also searching AnyDesk in the Registry and and it's main executable files (anydesk.exe for example, not accurate by any means, so make a list of the file first before deletion to be used for cleaning the registry) can be safely deleted in the Registry.

WARNING!!! Please make a backup of the Registry and a new System Restore before attempting to edit the Registry - just to be on the side of safety.

Something like a free registry cleaner (not always recommended but in this situation will be effective and useful) such as Wise Registry Cleaner will delete the file extensions in the Registry for you, but only after the files are all deleted from the drive.

As for folders in the Program Directory and ProgramData and in the User(s) Directories, these you must be able to either list for us or figure these out. Using Windows Search with AnyDesk can be quite useful to locate and determine the files and folders.

Still maybe even drivers or files can be left-over in the System32 directory that must be removed maybe manually. Again Windows Search will be an aid to find these for you.

And deleting those files/folders may require you to do so only in the Safe Mode if these are in use or locked by Windows.

Autoruns can be useful to help find some rogues - https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns

And Process Explorer - https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer

An alternative is do a System Reinstall or Refresh - it will bring you up to a nice new and clean setup. 

Edited by 0lds0d, 28 January 2024 - 09:49 PM.

Start a Topic in the Malware Removal Forum after reading and getting the Prep done before posting.

Note : Would be worried about your Bitcoins having been stolen. So do the above as fast as possible.

Also read the front Page of Bleepingcomputer.com daily for info you should be aware of. this is a known scam and others.

https://www.google.com/search?client=firefox-b-d&q=London-based+Bitcom+Financial+scam+bleepingcomputer.com