AnyDesk installed by scammer

Don't bother to download any of the installers as their uninstall instructions are worthless.

I see what you mean, though. I just downloaded and installed the app to see what it would do. The question you note is right there:

In other words, it's acting as either. You can connect to someone else, or allow someone to connect to you.

These are the instructions that are supposed to work to remove the app:

1. Go to Menu > About AnyDesk
2. Hold the option/ALT key
3. Click "Uninstall" on the top right corner of the window
4. Delete the ~/.anydesk/ and /etc/anydesk/ folders for standard AnyDesk clients
5. Delete the ~/.anydesk-ad_<prefix>/ and /etc/anydesk-ad_<prefix>/ folders for custom AnyDesk clients

Most of this doesn't even exist where they tell you to look. And what a shock, holding the Option/Alt key (or any modifier key) doesn't bring up any "Uninstall" button.

Besides the main app, the bolded items are what you need to get rid of:

/Users/your_user_name/.anydesk

/Users/your_user_name/Movies/anydesk

/Users/your_user_name/Library/Preferences/com.philandro.anydesk.plist

/private/var/folders/dr/xpx6ms_14plbf4_dgtnsmx9w0000gn/C/com.philandro.anydesk

First, click anywhere on the desktop so Finder is the name of the foreground app at the top left. Press Command+Shift+. (Command+Shift+period) to show all hidden items.

Next, while still in the Finder, press Command+Shift+H to open your user account home folder. You'll see a lot of extra stuff that's normally hidden. You needed to show them with the command just above in order to see and get rid of part of AnyDesk because the first item listed above starts with a period, and the fourth item is in a normally hidden area of the drive.

Put the folder, .anydesk , in the trash.

Open the Movies folder in your account and put the file anydesk (an alias) in the trash.

Go to the Preferences folder of your user account and put the file com.philandro.anydesk.plist in the trash.

Double click the icon on the desktop for your Mac so you can see the normal folders (Applications, Library, Users) and a bunch of normally hidden stuff. Follow through the folder path, /private/var/folders/dr/xpx6ms_14plbf4_dgtnsmx9w0000gn/C/ and put the file com.philandro.anydesk in the trash.

You can now press Command+Shift+. again to hide all hidden items.

Put the main AnyDesk app in the Applications folder in the trash. Empty the trash. All gone.

Erase the Mac and restore a Time Machine backup created prior to the intrusive event.

No Time Machine backup? Erase the Mac and configure it from the ground up.

There is no other practicable solution. Forget about third party uninstallers.

Good catch! I forgot to address that. Sounds like the OP was trying to delete the .dmg download while it was still mounted on the desktop. They'd have to dismount the pseudo drive, first.

Edit: (Dang it! I hit the Helpful button again while going for Edit in the drop-down menu). Anywho, if you're method doesn't work, as the OS sometimes insists something is open/in use when you know darn well it isn't, it always works to restart the Mac, then remove the item.

OP simply means "original poster". The person who started the topic. Which in this case of course is you.

It wasn't necessary to unplug the computer. All you had to do was shut down AnyDesk to break the connection to the scammer. Good idea to change the account as you may not be certain what the scammer managed to get access to while on your computer. Very much consider cancelling your current credit cards and having the providers get you new ones with new numbers.

The Norton scam is like lots of other scams. I get at least two per week thanking me for my (a random "charge" of roughly $250 to $450) purchase of Norton, BitDefender, Microsoft Defender, Geek Squad coverage, LifeLock, etc. Many of them say thanks for the renewal. That's a giveaway it's fake right off the top as you can't renew something you never had to start with.

The other very obvious similarity is every one of them puts an obviously huge phone number in bold text to call them if you have any questions for this automatic billing, or to cancel. If you look up the number, it of course NEVER goes to the company the email or message claims it's from. The entire idea is to get you to call so they can ask for your credit card info to "verify" they're cancelling the payment from the correct account. And then they have what they really wanted all along.

If you actually are using Norton, get rid of it. All AV software is 100% useless. There are no Mac viruses. None. And no AV software can stop you from installing and/or running a Trojan.

https://support.anydesk.com/knowledge/anydesk-on-macos#installation-uninstallation

Follow Kurt Lang's instructions. One thing to add- if you get the "can't delete" message when trying to empty the Trash, hold Shift and try again. This will force the erase.

Ah, right! I believe macOS gives a 'Force Eject' option too.