Remove AnyDesk on Linux & Check for Unauthorized Access

This guide shows you how to completely remove AnyDesk from your Linux system and then check for signs of unauthorized remote access. You’ll learn the exact commands for major distributions, how to purge configuration files, and how to audit logs and active connections. This is essential if you suspect someone may have used AnyDesk without your permission, or if you simply want to ensure no remote access tool remains on your machine.

What You’ll Need

Root or sudo access to your Linux system
A terminal window (Ctrl+Alt+T on most distributions)
Basic familiarity with the command line

Step-by-Step

Stop AnyDesk service (if running)
Before removal, stop the background service to prevent it from restarting or interfering. Open a terminal and run:
```
sudo systemctl stop anydesk
```
If your system uses SysVinit (older distributions), use:
```
sudo service anydesk stop
```
Remove AnyDesk using your package manager
The command depends on your distribution:
Debian/Ubuntu (apt):
```
sudo apt remove anydesk
```
Fedora (dnf):
```
sudo dnf remove anydesk
```
openSUSE (zypper):
```
sudo zypper remove anydesk
```
Arch (pacman):
```
sudo pacman -R anydesk
```
Purge configuration files
To remove all user data, passwords, and settings, use the purge option (for apt) or manually delete the config directory. For Debian/Ubuntu:
```
sudo apt purge anydesk
```
For other distributions, manually delete the configuration folder:
```
sudo rm -rf /etc/anydesk
```
```
rm -rf ~/.anydesk
```
Remove AnyDesk repository (if added)
If you installed AnyDesk from a repository, remove it to prevent future updates. Check for files in /etc/apt/sources.list.d/ (Debian/Ubuntu) or /etc/yum.repos.d/ (Fedora). For example:
```
sudo rm /etc/apt/sources.list.d/anydesk-stable.list
```
Then update your package list:
```
sudo apt update
```
Verify AnyDesk is completely removed
Check that no AnyDesk binaries remain:
```
which anydesk
```
This should return nothing. Also search for any leftover files:
```
find / -name '*anydesk*' 2>/dev/null
```
If you see files, delete them with sudo rm -rf.
Check for unauthorized remote access
Now that AnyDesk is gone, look for other signs of intrusion or remote control tools. Run these commands:
```
who
```
Shows who is logged in. Look for unexpected users or IPs.
```
last
```
Displays login history. Check for logins at odd times or from unknown IPs.
```
ss -tulpn
```
Lists all listening ports and the processes using them. Look for unusual ports (e.g., 7070, 4444, 5555) or unknown processes.
Check AnyDesk logs (if still present)
If you want to see if AnyDesk was used before removal, check its logs. They are usually in /var/log/anydesk/ or ~/.anydesk/. Look for connection timestamps and remote IPs. If you already deleted them, you may still find traces in system logs:
```
sudo journalctl | grep -i anydesk
```
Scan for other remote access tools
Unauthorized access may come from other software. Check for common remote access daemons:
```
ps aux | grep -E 'vnc|x11vnc|teamviewer|rustdesk|tigervnc'
```
Also check for open SSH access:
```
sudo grep 'PermitRootLogin' /etc/ssh/sshd_config
```
Ensure it is set to no or prohibit-password.
Review crontab and startup entries
Malicious software often persists via cron jobs or systemd services. Check your user crontab:
```
crontab -l
```
And system crontab:
```
sudo crontab -l
```
Look for anything suspicious. Also list enabled systemd services:
```
systemctl list-unit-files --state=enabled
```
Look for unknown services that might be remote access backdoors.
Change your passwords and enable firewall
After removing AnyDesk and checking for other tools, change your user password and any passwords that might have been exposed. Also ensure your firewall is active:
```
sudo ufw enable
```
(for Ubuntu) or sudo systemctl enable firewalld (for Fedora).

Common Mistakes

Only removing the package, not purging – Leaving configuration files behind can allow AnyDesk to restore its settings if reinstalled, and old passwords may remain.
Forgetting to stop the service – If AnyDesk is running, the package manager may fail to remove it or leave processes behind.
Skipping the check for other remote access tools – Removing AnyDesk doesn’t guarantee your system is clean; other tools or backdoors could still be present.
Ignoring systemd services – AnyDesk or other tools may have installed a persistent service that restarts them after removal.
Not changing passwords after suspected intrusion – Even if you remove the remote access tool, the attacker may still have your password and could reinstall it later.

Tips

Use sudo apt autoremove after purging to clean up unused dependencies.
Keep your system updated: sudo apt update && sudo apt upgrade (or your distribution’s equivalent) to patch vulnerabilities.
Consider using a firewall with default deny rules to block unexpected incoming connections.
Enable two-factor authentication for your user account if your system supports it (e.g., via PAM).
Regularly review /var/log/auth.log (or journalctl -u ssh) for failed login attempts.

Troubleshooting

Package manager says AnyDesk is not installed – You may have installed it manually. Search for the binary with find / -name 'anydesk' 2>/dev/null and delete it.
AnyDesk service won’t stop – Try sudo pkill -f anydesk to force kill processes, then proceed with removal.
Can’t find configuration files – They may be in a non-standard location. Use sudo find / -name '*anydesk*' -type d to locate them.
After removal, AnyDesk still appears in the application menu – This is usually a stale .desktop file. Delete it with sudo rm /usr/share/applications/anydesk.desktop.
Unknown process listening on a port – Use sudo lsof -i :PORT to identify it. If it’s not a legitimate service, investigate further or kill it.

Frequently Asked Questions

Will removing AnyDesk delete my saved passwords and settings?

Yes, if you use purge (Debian/Ubuntu) or manually delete the ~/.anydesk and /etc/anydesk directories, all saved data will be removed.

How can I tell if someone used AnyDesk without my permission?

Check the AnyDesk log files (if still present) for connection timestamps and remote IPs. Also review system logs with journalctl | grep anydesk and look for unusual login sessions via who and last.

Is it enough to uninstall AnyDesk to stop unauthorized access?

No, the attacker may have installed other backdoors or changed your passwords. You should scan for other remote access tools, change all passwords, and review system services.

What if I don’t have sudo access?

You cannot remove system-wide packages without root privileges. Contact your system administrator or use the user-local removal if AnyDesk was installed per-user (unlikely).

Can I reinstall AnyDesk after cleaning my system?

Yes, but only if you trust the source and have changed your passwords. Download from the official website or use your distribution’s repository to avoid tampered versions.

How do I check if AnyDesk is running right now?

Use ps aux | grep anydesk or systemctl status anydesk to see if the service is active.

General steps for current mainstream versions; menus can differ by device and version. See the disclaimer or report an error.

More in this bed

The whole Tech How-To bed →