a team viewer get installed and iam hacked of crypto currency.

Every now and then A team view get autoinstalled on my computer in this folder
C:\Users\TejbirPC\AppData\Roaming\QTUpdate
with the folloing files.
QTConnect.exe

TeamViewer.ini

TeamViewer_Desktop.exe

TeamViewer_Resource_en.dll

TeamViewer_StaticRes.dll

content of teamviewer.ini is as

[Settings]
nosave=1
importsettings=0
LogIncomingConnections=0
LogOutgoingConnections=0
[License]
code=00-00000-000000-000000

I keep on deleting, it keep comming after few hours, i have done all types of scan, boot scan,

It show up like a dark window in which i can not read any thing.

earlier my Crypto account get hacked, after that i get to Bitdefender.

Find more posts tagged with

Accepted answers

All comments

Gjoksi

Hello.
First, scan (and disinfect, if needed) your PC with Bitdefender Rescue Environment:
https://www.bitdefender.com/consumer/support/answer/29132/
Next, restart your PC and see if the issue has been solved.
If the steps provided above didn't help, do the following steps:
First, take screenshot(s) of the issue.
Next, create a log file on your Windows device using Bitdefender Support Tool, by following these steps:
https://www.bitdefender.com/consumer/support/answer/1733/
and
create a log file on your Windows device using BDsysLog, by following these steps:
https://www.bitdefender.com/consumer/support/answer/1922/
Finally, contact Bitdefender Consumer Support by e-mail:
https://www.bitdefender.com/consumer/support/help/
with short description of the issue.
After that, you will get an automated reply by the Bitdefender Customer Care Team, with your ticket number.
Now, in reply to that automated reply, you can send the screenshot(s) you already took and the log files you already created in the first step.
Since you are all done, just wait for the support engineers to investigate your issue and find a solution to fix the issue.
Remember that the screenshot(s) and the log files will help a lot to the support engineers for better and faster investigation on your issue and finding a solution.
NOTE: If any of the log file is larger than 25MB, you can upload the log file here:
https://upload.bitdefender.net/
After the upload is done, you will get a notification with the file's URL and then you can share the file's URL with the Bitdefender Consumer Support.
Regards.

Alexandru_BD

Hello @tejbirsandhu,

I think this can be labeled as highly suspicious and consistent with malware or unauthorized remote access tool (RAT) behavior. This is not normal behavior for legitimate TeamViewer installations and suggests that someone may be trying to maintain persistent remote access to your system. The path AppData\Roaming is often used by malware to evade detection. The nosave=1 and importsettings=0 flags in the TeamViewer.ini file indicate the app is likely running in a stealth or temporary mode. Lack of logging (LogIncomingConnections=0) is another red flag: this is used to hide activity. I think the fact it reappears after deletion suggests a persistence mechanism is in place, for example a scheduled task, malicious startup entry, registry key, or even a second process reinstalling it silently.
Since you mentioned the history of accounts being hacked on your device, then yes, this is indeed a reason of concern. I will list a couple of things to try.

First, to prevent any potential remote attacker from accessing your system, disconnect from the internet.

Then open Task Scheduler and look under Library to check for any persistence mechanisms. More specifically, look for any subfolders, especially unfamiliar ones, and/or suspicious tasks that launch .exe files from AppData\Roaming, or run at logon or periodically.

Secondly, check for startup items, open Task Manager and go to startup tab. There, look for entries related to QTUpdate, TeamViewer, or anything unfamiliar.
Check for network activity as well, so use TCPView to monitor which processes are making outbound connections, especially anything tied to QTUpdate or TeamViewer_*.exe. TCPView is a Windows program that provides a comprehensive view of all TCP and UDP endpoints on your system, including the local and remote addresses and the state of TCP connections. It also displays the name of the process that owns each endpoint, making it useful for troubleshooting network issues and monitoring network activity. It's part of the Sysinternals suite, now owned by Microsoft.

You can reboot in Safe Mode with Networking, and delete the folder again from:
C:\Users\TejbirPC\AppData\Roaming\QTUpdate

Check if it comes back after several hours in safe mode.

Lastly but very important, change all passwords everywhere, assume they might have been compromised, especially remote access or financial logins. Use a secure, uncompromised device to access such platforms, until you can get rid of this. Another recommendation would be to enable 2FA where possible, to prevent reentry if someone already has your credentials. If cleanup fails and it keeps returning, consider backing up data (without EXEs or scripts), formatting the drive, and doing a clean OS reinstall. That would be the last resort, in my opinion..

Another preventive measure would be to block TeamViewer from executing via AppLocker or Group Policy.

I hope you see my message in good time and go offline as soon as possible, to start cleaning up your device.

Stay safe.