I was working using TeamViewer to connect to my home PC for some CAD work when suddenly a message popped up in the bottom right corner saying 'file transfer started' along with an account name indicated as allowed. I panicked and disconnected immediately. A few minutes later, I reconnected and noticed a file transfer task running in the task manager, which I ended before shutting down the PC. I'm really worried—did I get hacked? I want to clarify that I did not initiate any file transfers myself at any point.
4 Answers
Did you copy and paste anything while working? TeamViewer lets you paste stuff between connected computers, which could appear as a file transfer. But if you're just using it to work on your own files without any external transfers, you should be fine. Try pressing Print Screen on your work computer and then Ctrl+V on your home computer in an image program to see if that works. It’s been a while since I've used TeamViewer though.
You caught it early, which is the best part! The file transfer message indicates someone likely started transferring data through your TeamViewer session, confirmed by the task in the manager. Change your TeamViewer password immediately and enable two-factor authentication if you haven't yet. Run full antivirus scans in safe mode since someone accessing your PC might have installed something malicious. Also, check your login history to see what IP accessed your account. Even though you halted it quickly, treat this as if your password was compromised.
Thanks for the insight! I’ll get on that when I return home.
Definitely contact your IT department. As a security analyst, I’d recommend reporting anything suspicious—even if it turns out to be a false alarm. It’s better to be safe!
This sounds a bit concerning. The message about a file transfer starting implies that someone might be trying to access your files. I’d recommend pulling the ethernet cable or disabling WiFi before restarting the computer, and avoid TeamViewer until you check the logs. Open the Event Viewer on that PC, look under Windows Logs > Security for login events, particularly any successful logins that weren’t yours. Change your TeamViewer password right away and enable two-factor authentication if you can. Running a scan with Malwarebytes or Kaspersky could also help.
The name that displayed in the message was my email address. I did make a copy of a file in the same folder for my work so maybe that triggered something. I’ll check the logs when I get home, but I don’t have a premium account for TeamViewer. Thanks for your advice, I’ll definitely follow these steps!
I was using CAD software when that message popped up. I don't really remember if I copied anything but I don’t think so. It’s odd because I just set up TeamViewer for the first time and I'm worried someone might be accessing it. The company network I’m on is strange too.