Virus or ???

Hihi,

My parents computer running XP has started acting strangely. Unfortunately I can't see it in action as they're in a different state, but they say every now and then the mouse will start moving of it's own accord and go over and launch things from the start menu. It'll open a few things and then shut them down.

They've run a couple of different virus checkers and nothing came up. I've just sent them links to a couple of the free ones mentioned in these threads and I'll see if that turns anything up.

It sounds to me though as if someone's installed a VPN client - definitely not my parents as they're not computer savy. If so, that might be why it's not picked up as a virus signature i.e VPN client was installed and then the virus removed after installation.

Anyone familar with anything like this going on? and recommendations as to what they can look for - bearing in mind they're not computer savy (and I'm a Mac rather than PC person too which doesn't help matters).

Cheers,
Niggles

Check if their firewall (urrmm, they ARE running a firewall, right?) is allowing port 3389--the port for remote assistance. Check if this firewall is also allowing port 5900 (vnc) or 5800 (vnc java). Although VNC (similar to remote desktop) could be configged to listen on other ports, this would be a nice place to start looking.

Go to Control Panel, open up System, and click on the Remote tab. Uncheck both checkboxes, if checked.

Just curious, but what sort of apps are being opened and then closed? If somebody has set up something like vnc on their machine and is using it to control the box... what are they doing with it?

All good questions - I'll ask tonight when I give them a ring - Dad at least understands what I'm trying to talk to him about when it comes to computers :-)

Cheers.

I dont think malware would phisically move the mouse.

I would also go with VNC and that line of software. My IT teacher in High school used to mess with everyone using VNC.

However if you have done the above requirements then run an activescan for me and post or pm me the logs.

http://www.pandasecurity.com/activescan/index/

Hmmm,

It sounds as if they have a RAT (Remote Access Trojan) behind their arras? This will not neccessarily be identified as malware as there are perfectly legitimate remote access and remote desktop (support utilities).

Quote:

---

POLONIUS [behind the arras]. What, ho! help, help, help!
HAMLET [draws]. How now, a rat? dead, for a ducat, dead.
He makes a pass through the arras

POLONIUS [falls]. O, I am slain!
QUEEN. Oh me,what hast thou done?
HAMLET. Nay, I know not,
Is it the king?
He lifts up the arras and discovers Polonius, dead
QUEEN. O what a rash and bloody deed is this!
HAMLET. A bloody deed - almost as bad, good mother,
As kill a king, and marry with his brother.
QUEEN. As kill a king!
HAMLET. Ay, lady, it was my word....
[to Polonius] Thou wretched, rash, intruding fool, farewell!

---

It would appear that this problem has been known since the days of William Shakespeare? :lildevil:

@Cider:

Quote:

---

I dont think malware would phisically move the mouse

---

Yes it will, SubSeven, BackOrifice? the important bit is:

Quote:

---

and go over and launch things from the start menu. It'll open a few things and then shut them down.

---

What Nukevil said, which you can also get to from a right click on <My Computer> then select <Properties>.

Also go into Windows Explorer: Right click on the hard drive(s)
<Properties>
<Sharing>

Check: "Do not share this folder"
<Apply>

CHANGE THE USER ACCOUNT NAMES AND PASSWORDS!!!!!!!

The only way to be certain is to reformat and reinstall everything :(

Hi there niggles,
I tend to agree with Nihil on this one and you can find a free tool for malware and adware here:http://www.mwti.net/products/mwav/mwav.asp

It is free to download by just giving a few details etc..I have used it numerous times and believe me it has saved me a bundle..

It,s fairly simple to use and i hope it helps.:D

cheers
vanman

Quote:

---

It sounds to me though as if someone's installed a VPN client

---

Maybe a server ?

Quote:

---

... recommendations as to what they can look for

---

Start simple.
Have them do a search with explorer ( using admin account, which I hope they don't use everyday! )
for a folder or program
cygwin

I am guessing they have no use for it, and probably would not be picked up by virus scans, malware scans ( although it used to years ago. )

Using cygwin is only one way to take over a box, but a classic way!

It turns out virtually all VNC and Remote Desktop options were on and the Firewall was allowing them through. They're all turned off now.

They said when the mouse moved it moved really quickly and didn't appear to have any pattern when opening and closing windows from the start menu - so it sounds something more scripted or automated than someone controlling it manually.

Will get them to use the other tools suggested since I replied yesterday and reset the user names and password.

Oh yes, they bought the computer second hand. And no, I didn't even bother to ask if they reformatted it completely - I already know the answer to that one :-)

Cheers,
Niggles

Taking an entirely different stance of things;

I have seen this exact problem before and it too puzzled me and the client. The problem resolved itself when the reception computer wireless mouse was replaced with a corded one.

Are you parents' computer using wireless keyboard and mouse? If so, i would wager your neighbours are also using a wireless mouse, inadvertently controlling the cursor on your parents' machine. As the neighbour moves his mouse and opens programs etc so too does your parents' machine.

Let me know if they are using a wireless technology of ANY kind to eliminate other possibilities. Otherwise, it may be a serious problem such as those already suggested.


CTO

Good point there.

Hmm - what is the distance of the mouse? 30 meters?

Quote:

---

Are you parents' computer using wireless keyboard and mouse?

---

When I first spoke to them, they said they replaced the mouse with a wireless one in case it was a problem with the mouse. But it's quite possible the first mouse was also wireless.

They do use wireless for various bits and pieces - again, not sure what as they're in a different state.

Cheers,
Niggles

I think we may have found the problem.

Short of replacing the mouse with a corded one, you can try downloading the software package (manufacturer website) for the specific mouse. I believe <b>some</b> mouse software has a way of filtering out interfering signals and hence preventing this problem.

Could you imagine a small office block crammed with 30 computers all running wireless mice and keyboards ?? :p

Anyways, let me know how things turn out.

IMO, corded mouses are better. They dont waste batteries, if there is a problem the only troubleshooting is "is it plugged in", and of course it wont cut out whilst your almost about to shoot the bad guy finishing the final stage on whatever game it is you play :p

[edit] Simple problem simple answer i know, but isnt it still fun to jump off the deep end every now and then :halo: [/edit]


CTO

Quote:

---

They said when the mouse moved it moved really quickly and didn't appear to have any pattern when opening and closing windows from the start menu - so it sounds something more scripted or automated than someone controlling it manually.

---

Quote:

---

If so, i would wager your neighbours are also using a wireless mouse, inadvertently controlling the cursor on your parents' machine. As the neighbour moves his mouse and opens programs etc so too does your parents' machine.

---

The first comment would seem to rule out the second, as one would expect to see a pattern. However, RF interference could explain the symptoms. That would make other wireless devices suspect, including external ones.

Most modern wireless devices are either "paired" or perform a handshake setup when you install them. This greatly reduces the possibility of interference, but does not rule it out completely. I would check that the mouse has been set up correctly using the manufacturer's software (as CTO suggested)

I guess that if the problem persists, I would change the channel that the mouse is using.

It would help if we knew:

1. The make and model of the mouse.
2. What other wireless devices are being used.

Quote:

---

Quote:
They said when the mouse moved it moved really quickly and didn't appear to have any pattern when opening and closing windows from the start menu - so it sounds something more scripted or automated than someone controlling it manually.



Quote:
If so, i would wager your neighbours are also using a wireless mouse, inadvertently controlling the cursor on your parents' machine. As the neighbour moves his mouse and opens programs etc so too does your parents' machine.

---

When comparing two computers screen to screen, the start menu, application shortcuts, and desktop shortcuts appear in the same screen location. The interfering computer user, clicks start, all programs, and launches internet explorer. Your parents computer mimics this; start, all programs, but instead launches windows media player. The cursor screen position is the same but the shortcut that was selected is not.

This is what makes the movement seem random and non threatening. However, the mouse does have a structured movement of opening and closing programs. Hence the thought of crossover from another wireless device.

If it was interference you would either expect linear interference or chaotic interference. i.e. The mouse cursor would slow move in 1 direction forcing it into a corner. Or it would be crazy and you wouldnt be able to control what you clicked on etc.

What do you guys think>?

Quote:

---

What do you guys think>?

---

Are they living in cardboard boxes? The range of a mouse is about 6~15 feet in clear air?

Now, I do accept your very logical analysis regarding the mapping, but the frenetic speed and opening and closing cannot cover that?

:confused:

Quote:

---

inadvertently controlling the cursor on your parents' machine

---

*giggle* It does not make sense to me due to the limited range of wireless devices, but this does indeed happen in suburbia where houses are crammed close together. (It's a trend; cram as many human bodies in as close of a proximity as possible while still charging massive amounts of money for housing). I've run into the problem once before on a house call.

I'd also strongly advise running Trend Micro's HijackThis and posting the log it spits out in this forum or in their dedicated log analysis forum. This will present a detailed report of everything running on the computer, including remote login clients (logmein, dialaPC) running in the background that wouldn't normally trip AV scans.

Link to download: http://www.download.com/Trend-Micro-...-10227353.html

Also, does this site no longer allow the addition of html in posts? Was trying to create a clean looking link...

Quote:

---

It does not make sense to me due to the limited range of wireless devices, but this does indeed happen in suburbia where houses are crammed close together.

---

Yes that would be particularly likely in apartment blocks where the partition walls are not very robust. Also if the other party has wireless devices intended for use in conference rooms or with media centres.

What surprises me is the reported rapid and apparently random opening and closing of applications. That isn't how people normally use a computer because they would never get anything done?

From a process of elimination viewpoint, I would change the batteries in the mouse.

Quote:

---

Also, does this site no longer allow the addition of html in posts? Was trying to create a clean looking link...

---

test

Copy your link, type in the link name in the body of your post. Highlight the name then click on the "insert link" icon and paste the link.

Quote:

---

From a process of elimination viewpoint, I would change the batteries in the mouse

---

HAHA, the mouse was replaced with another one to remove variables, but i would bet a pound to a dollar they used the same batteries...

---

I have to agree with the range limit in terms of interference. I did not read the sparodic movement of the mouse and opening closing programs to be in quick succession. I figured it was doing all of these things over a period of time (eg. you leave the computer alone and when you come back 5 programs are running).

If the mouse IS the problem, for programs to open and close, the cursor MUST invoke the program. If the mouse cursor does not invoke the application then it MUST be some other cause.


CTO

Since turning off VNC ports it's stopped happening. They did run a number of virus checkers and one of them picked up some possible virii, but as it costs money, they decided not to proceed any further and wait and see if the computer keeps acting normally.

I know, I know... but what can you do apart from bang your head against a wall :-)

Cheers for the help.

Niggles

Quote:

---

Since turning off VNC ports it's stopped happening

---

Ok. So who else is burning with curiosity for the who and why?

Niggles, do you know who installed VNC to begin with?

Well I wanted to ask that but I thought it was n00b question :)

Quote:

---

Ok. So who else is burning with curiosity for the who and why?

Niggles, do you know who installed VNC to begin with?

---

They bought it second hand, so it could already have had it installed.

On the first page of this thread there are a couple of Trojans mentioned too which can open up these ports and/or install VNC software to allow later access.

re: The mouse getting interferance isn't so likely - they live in a small country town, in a house - low housing density area, so I doubt the neighbours mouse would be causing it.

For all intents and purposes it's fine again - except for the lurking unknown virus. It will have to wait until I visit at Xmas to clean it up properly for them. Just hope Mum doesn't do her online banking on that machine :-)

www.activescan.com

Get them to scan and check out the log , pm me a copy as well.

Quote:

---

They bought it second hand, so it could already have had it installed.

---

Does VNC broadcast itself?

What i am thinking, is that once the computer was puchased and moved into the new place, most likely with a new ISP and a new IP address.... how is it possible for someone to connect to this machine without knowing the IP address? (you cant)

Which means 1) the person using VNC knows the ip address and most likey obtained this from actually using the computer from your parents house. or 2) there is other software broadcasting the IP address to either a free domain name or directly to an email account or otherwise.