Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsAnyDesk (1).exe is not automatically a virus, but the filename alone cannot prove that it is genuine. AnyDesk’s normal Windows client is usually named AnyDesk.exe, while “(1)” commonly means Windows or a browser created a duplicate download name. However, multiple files with this name have been linked to malicious activity, and attackers can abuse authentic AnyDesk software. Treat the specific file as untrusted until you check its hash, digital signature, location, source and behavior.
Do not open an unknown copy just to see what it does. The steps below let you identify the file, contain any risk and respond appropriately if someone used it during a remote-support scam.
As an Amazon Associate I earn from qualifying purchases.
What “AnyDesk (1).exe” actually tells you
A filename is only a label. It does not identify one universal program, publisher or cryptographic file. Two unrelated executables can both be called AnyDesk (1).exe, and the same file can be renamed without changing its contents.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Official AnyDesk documentation refers to the standard client as AnyDesk.exe, typically installed at C:Program Files (x86)AnyDeskAnyDesk.exe. A “(1)” suffix often appears when a browser downloads another copy of a file that already exists. That explains many harmless cases, but it is not a safety certificate. A copy in a random temporary folder, an unsolicited email attachment or a link supplied by a caller deserves additional scrutiny.
#1 Best Overall
![Norton 360 Deluxe 2027 Antivirus, 3 Devices, Auto-Renews [Download]](https://m.media-amazon.com/images/I/41qw3FS3qLL._SL160_.jpg)
- ONGOING PROTECTION Download instantly & install protection for 3 PCs, Macs, iOS or Android devices in minutes!
- TOP-PERFORMING VPN Faster speeds, more server locations, and greater connection control to protect your privacy across all your devices, including Smart TVs.
- ADVANCED SCAM PROTECTION Help spot hidden scams online. With the built-in Genie AI assistant, you’ll never wonder if a message or email is suspicious again.
- REAL-TIME PROTECTION Advanced security protects against existing and emerging malware threats, including ransomware and viruses, and it won’t slow down your device performance.
- DARK WEB MONITORING Identity thieves can buy or sell your information on websites and forums. We search the dark web and notify you should your information be found.
Why the name has a bad history
- ANY.RUN reported a malicious-activity sample named
AnyDesk (1).exeon April 20, 2024. - Another ANY.RUN report, analyzed July 29, 2025, gave a malicious-activity verdict to a sample whose metadata claimed AnyDesk Software GmbH and version 9.5.9. A plausible publisher string therefore does not prove that a file is safe.
- The Peruvian government’s Alerta Integrada de Seguridad Digital N° 057-2023, published March 7, 2023, listed a malicious SHA-256 associated with
AnyDesk (1).exe. - Microsoft’s BlackByte case study documents attackers running legitimate
AnyDesk.exefiles from several locations. The genuine remote-access program can be abused after an intrusion.
These are findings about particular hashes, not every file with this name. No trustworthy statistic establishes what percentage of all “AnyDesk (1).exe” files are malicious. Identify your copy by its SHA-256, full path, signer and acquisition source.
Check the file without executing it
1. Isolate it and preserve basic evidence
- Do not double-click the file, right-click it to run it, or allow a caller to guide you through opening it.
- If a remote session may still be active, disconnect the computer from Wi-Fi or unplug its network cable. If you are only investigating a downloaded file and no session is running, leave the computer connected so security updates and scans can work.
- Write down the full path, filename, file size, download time and where it came from. Take a screenshot of the file’s Properties window if you may need to report it.
- Do not rename or delete the file until you have recorded its details, unless it is actively running and you need to stop an immediate threat.
2. Calculate the SHA-256 hash
Open PowerShell and substitute the actual path, keeping quotation marks if the name contains spaces:
Get-FileHash -LiteralPath "C:UsersYourNameDownloadsAnyDesk (1).exe" -Algorithm SHA256Save the resulting 64-character hash. A hash is the file’s fingerprint: a one-byte change produces a different value. The hash is more reliable than the filename when you ask a security professional or incident-response service about the sample. Do not assume that a hash mentioned in a report applies to your copy unless every byte matches.
Recommended Free Tools
Rank #2
- THREAT DETECTION – Stay one step ahead. Suspicious links, risky sites, viruses, and scams, caught automatically before they reach you.
- PERSONAL INFO PROTECTION – Keep your personal info safer. Identity monitoring watches for your exposed info and tells you what to do about it.
- SECURE CONNECTIONS – Just a few easy clicks, and we'll automatically protect your info on public Wi‑Fi, every time you connect.
- GUIDED ACTION – Know what matters and what to do next. Clear alerts and simple guidance make it easy to take action.
- MORE THAN ANTIVIRUS – Scam protection, identity monitoring, VPN, web protection, and antivirus work together to protect you, all in one place.
3. Inspect the Authenticode signature
Right-click the file, choose Properties, open Digital Signatures, select the signature and choose Details. A valid signature should report that the digital signature is OK and identify a signer associated with AnyDesk.
AnyDesk says its current certificate is issued to AnyDesk Software GmbH. Older official clients may show philandro Software GmbH; AnyDesk states that clients obtained from official sources remain safe to use despite that certificate change. An absent, invalid or unexpected signature is a warning, not absolute proof of malware. Conversely, the July 29, 2025 malicious sample had convincing publisher metadata, so a signer must be considered together with the hash, path and source.
You can also query the signature in PowerShell:
Get-AuthenticodeSignature -LiteralPath "C:UsersYourNameDownloadsAnyDesk (1).exe" | Format-List Status,SignerCertificateDo not install a certificate merely because the file asks you to trust one. A certificate cannot make an altered or repackaged download legitimate.
Rank #3
![Norton 360 Deluxe 2027 Antivirus, 5 Devices, Auto-Renews [Download] | Includes Scam Protection, Advanced VPN, Dark Web Monitoring, & PC Cloud Backup](https://m.media-amazon.com/images/I/41IYV5zGyCL._SL160_.jpg)
- ONGOING PROTECTION Download instantly & install protection for 5 PCs, Macs, iOS or Android devices in minutes!
- TOP-PERFORMING VPN Faster speeds, more server locations, and greater connection control to protect your privacy across all your devices, including Smart TVs.
- ADVANCED SCAM PROTECTION Help spot hidden scams online. With the built-in Genie AI assistant, you’ll never wonder if a message or email is suspicious again.
- REAL-TIME PROTECTION Advanced security protects against existing and emerging malware threats, including ransomware and viruses, and it won’t slow down your device performance.
- DARK WEB MONITORING Identity thieves can buy or sell your information on websites and forums. We search the dark web and notify you should your information be found.
4. Compare the location with the expected installation
The standard installed client is normally under C:Program Files (x86)AnyDeskAnyDesk.exe. A file in Downloads may simply be an installer or a second download; a file in Temp, an obscure user-profile folder or a newly created directory should receive extra scrutiny. Location is evidence, not a verdict: attackers can copy a genuine executable to a different path, and a user can deliberately store a legitimate copy elsewhere.
5. Establish provenance
Ask how the file arrived:
- Lower-risk origin: you intentionally obtained it from AnyDesk’s official website and can account for the download.
- Higher-risk origin: an unsolicited phone call, pop-up, social-media message, cracked-software bundle, unknown attachment or third-party mirror.
- Unclear origin: a file that appeared in Downloads or Temp without a remembered download. Treat it as unknown until checked.
Anyone who claims to be technical support and asks for AnyDesk access without you initiating the relationship is a major warning sign. AnyDesk’s own guidance says, “Never give anyone you don’t know access to your devices.”
Scan and observe it safely
Use Microsoft Defender before opening the file
- In Windows Security, open Virus & threat protection and install any pending security-intelligence updates.
- Choose Scan options, then Custom scan, select the folder containing the file and start the scan.
- If you suspect the file already ran, use Microsoft Defender Offline scan. Save work first; Windows will restart and scan before normal startup.
- Allow Defender to quarantine a detected threat. Record the detection name and the file path before removing evidence if you expect to report the incident.
A clean scan is not proof that an unfamiliar binary is safe. It means that the installed scanner did not detect it at that time. For a second opinion, submit the recorded hash (rather than executing the file) to a reputable multi-engine analysis service or provide it to your organization’s security team. Do not upload confidential documents or proprietary software without authorization.
Rank #4
- SPEED-OPTIMIZED, CROSS-PLATFORM PROTECTION: World-class antivirus security and cyber protection for Windows (Windows 7 with Service Pack 1, Windows 8, Windows 8.1, Windows 10, and Windows 11), Mac OS (Yosemite 10.10 or later), iOS (11.2 or later), and Android (5.0 or later). Organize and keep your digital life safe from hackers
- SAFE ONLINE BANKING: A unique, dedicated browser secures your online transactions; Our Total Security product also includes 200MB per day of our new and improved Bitdefender VPN
- ADVANCED THREAT DEFENSE: Real-Time Data Protection, Multi-Layer Malware and Ransomware Protection, Social Network Protection, Game/Movie/Work Modes, Microphone Monitor, Webcam Protection, Anti-Tracker, Phishing, Fraud, and Spam Protection, File Shredder, Parental Controls, and more
- ECO-FRIENDLY PACKAGING: Your product-specific code is printed on a card and shipped inside a protective cardboard sleeve. Simply open packaging and scratch off security ink on the card to reveal your activation code. No more bulky box or hard-to-recycle discs. PLEASE NOTE: Product packaging may vary from the images shown, however the product is the same.
Look for behavior that does not fit a normal client
If the file was executed, check Task Manager for an unexpected AnyDesk process, newly added startup entries, unexplained child processes, persistent network connections or prompts for passwords and banking information. Dropping additional files, creating persistence, or making network connections before you requested remote assistance are especially concerning. Behavior can confirm that an incident needs investigation, but an apparently quiet process does not prove safety.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What to do in each situation
| What happened | Immediate response | Next action |
|---|---|---|
| Only downloaded; never opened | Leave it closed and record its path and SHA-256. | Check the signature, source and Defender result. Delete or quarantine it after preserving details if it is not needed. |
| Opened briefly, but no remote session occurred | Disconnect from the network if behavior is suspicious and end the process. | Run a full and, if warranted, Offline scan; review startup items and installed applications; change important passwords from a clean device if credentials were entered. |
| An unsolicited person connected or viewed the desktop | End the AnyDesk session, disconnect the network and stop further contact. | Change exposed passwords from a separate trusted device, contact your bank or payment provider about suspicious transactions, have the computer examined and report the incident. |
| You intentionally installed AnyDesk from an official source | Verify the signature and expected installation path. | Keep the program updated, protect access codes and allow remote access only when you initiated and understand the session. |
Stop a running process
If an unknown copy is currently running, note its process ID in Task Manager before ending it. You can select the process and choose End task. From an elevated Command Prompt, this form stops a process by ID:
taskkill /PID 1234 /FReplace 1234 with the actual process ID. Do not kill random system processes. If the remote operator is still connected, disconnect the network first; ending one visible window may not remove other software they installed.
Best Value
- THREAT DETECTION – Stay one step ahead. Suspicious links, risky sites, viruses, and scams, caught automatically before they reach you.
- PERSONAL INFO PROTECTION – Keep your personal info safer. Identity monitoring watches for your exposed info and tells you what to do about it.
- SECURE CONNECTIONS – Just a few easy clicks, and we'll automatically protect your info on public Wi‑Fi, every time you connect.
- GUIDED ACTION – Know what matters and what to do next. Clear alerts and simple guidance make it easy to take action.
- MORE THAN ANTIVIRUS – Scam protection, identity monitoring, VPN, web protection, and antivirus work together to protect you, all in one place.
Remove a legitimate installation you no longer want
After preserving evidence and completing any needed scans, open Settings → Apps → Installed apps, find AnyDesk and choose Uninstall. Also remove a separately downloaded installer from Downloads. If Windows cannot uninstall it, do not download a replacement from an unsolicited link; ask a trusted administrator or security professional to inspect the system.
If a remote-access scam may have occurred
AnyDesk warns that scammers can misuse remote-access software to steal data, access codes and money. Stop communicating with the caller or message sender, and do not provide banking credentials, one-time codes or passwords. From a clean device, change passwords for email, banking, shopping and work accounts; prioritize accounts that were visible during the session. Sign out other sessions and enable multifactor authentication where available.
Contact your bank or card issuer immediately if financial information was displayed or a transaction is suspicious. Preserve the filename, SHA-256, screenshots, phone number, messages, timestamps and any payment records. Report the incident to the relevant platform, your employer’s security team and local authorities or a national cybercrime reporting service. A professional examination is appropriate when the operator had control of the keyboard, installed software, disabled security tools or accessed sensitive files.
How to decide whether the file is genuine
| Evidence | More reassuring | More concerning |
|---|---|---|
| Provenance | You initiated the download from the official AnyDesk website. | An unsolicited caller, message, attachment or mirror supplied it. |
| Integrity | Valid signature for AnyDesk Software GmbH, or an older official certificate for philandro Software GmbH, plus a hash that matches a trusted record. | Unsigned, invalid, altered or unverifiable signature. |
| Path | Expected program directory under Program Files (x86)AnyDesk. |
Unexpected Temp, Downloads or hidden user-profile location without a clear reason. |
| Behavior | Runs only when you initiate a session and does not request unrelated credentials. | Drops files, creates persistence, makes unexpected connections or prompts for banking details. |
No single row settles the question. A trusted source with a valid signature is stronger evidence than a familiar filename, while a malicious verdict tied to your exact SHA-256 overrides assumptions based on appearance.
Quick Recap
As an optional shortcut after the manual checks, Outbyte PC Repair can address more than 100 common Windows issues where possible, clean temporary and cache files, review app-crash logs and check selected Windows vulnerabilities. It complements antivirus rather than replacing it; results vary, and no tool repairs every crash. It runs on Windows 11, 10, 8 and 7, with a category-based free trial of at least two days followed by a paid subscription.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
