Webcam Hijacking??

Hey there, yes, I am a newbie, and a very inexperienced one at that!
Here goes, my first thread....

In the last week or so, I have found that my webcam control program starts up and starts taking a rapid succession of photos without so much as a by your leave. I delete these (up to a hundred if left unchecked!) and shut the control program down. It promptly restarts and repeats the process.

I am assuming this is some kind of hijacking to catch 16 year old girls undressing in front of the computer. Heh heh, what a surprise they would get!! A 32 year old man scratching picking his nose! ;-)

Anyhow, what is this thing, how did I get it, how can I stop it, is it a security thing or is it a program error? I run Norton, have auto update, did get that virus a couple of weeks back, and do run adaware. Unfortunately, I run Kazaa (although for how long, I don't know) and it seems that everything and anything gets in that way.

Apologies if I am rambling, it is late, I am tired, and totally pissed at my poor machine!

Narcosis.

Sub7 had a built in function that let you view the victims webcam but it did not need to open up the webcam's software as it was built into the server - never heard of anything like that....sounds a bit to obvious to be any kind of backdoor as they tend to try to run in silent.

Are you sure you dont have any kind of motion detection software installed? I know alot of newer webcams give you the option of setting them up to act as sort of security cameras which switch on and start taking pics whenever motion is detected - could it be that? check the different options for your webcam just incase...

what make of cam is it and what software are you running for it - might be able to provide a bit more info if knew that.

v_Ln

Webcam is a Creative Webcam 5, running the standard Webcam Control software.

It isn't a motion thing, as I have not set it up, and have resorted to turning the camera to the wall, and hopefully it isn't going anywhere.

I know what you mean about the stealth thing, but maybe I am just lucky(?) that it [the program] popped up. It seems strange that it comes on, takes five or ten fast snaps, then lies dormant, snaps off some more, waits, snaps again....

I have loaded Bot S&D from the AntiOnline site and ran it through a few times. I am sure Kazaa has no idea what has hit it! Heh heh.

Anyhow, hope this is helpful, and thanks for trying to help me out.

Narcosis.

You also might want to check your Flash Settings on your Computer. If you have installed Flash Viewer, it is possible it is configure to allow this. If you go to a page that is running a Flash Plugin, and Right Click on the Flash Movie, you can check config settings. There are settings for Webcam and Microphone. You can Turn On and Off Access through there.
Check that -

Other than that i agree, that it doesn't seem like it is a backdoor, more like a motion detection or something along that nature

Quote:

---

Creative WebCam™ Monitor
The Creative WebCam™ Monitor application can use sophisticated motion detection to take a snapshot when anybody or anything gets near your PC and even automatically upload it to your website

---

well it is built in to your software so maybe it is worth double checking your settings??

v_Ln

Well, I just checked the webcam software settings, and I don't even have the monitor application, just Webcam Comtrol. There was nothing there to do with motion surveillance.

I ran Spybot S&D again, got a few hits, and maybe there is something in there that will help.

Again, thanks a lot to those who are banging their heads on the desk for me with this. I really appreciate it. Wish I could repay the favours with some of my own, but know far too little!

Ta,

Narcosis :)

Ok, just found out something interesting, when Kazaa is on, the camera program opens and goes clickety click.

I deleted the shots it took, and left it switched on, but in "Album" mode. It is trying to click away, but it can't do anything in that mode.

This is really pissing me off. I am thinking of recycling Kazaa, any suggestions?

Thanks,

Narcosis :mad:

yeah, recycling Kazaa wont do anything, you need to uninstall it from Add or Remove Programs which is in the Controll Panel and also, remove all of the components that came along with Kazaa. Then if you want to, you can re install it. (i am sure you already knew this, i just wanted to make sure). About your camera taking snap shots when Kazaa is running sounds a little funky...if i were you i would uninstall and the re install kazaa and check if that is still happenning.

What I would try in that case - after you've done a full Anti-virus sweap and tested for spyware is uninstall kazza (tho i dont see why it would cause this but just incase) and also uninstall your camera drivers/spftware incase there's a problem there

then reinstall your driverws, camera software and get kazza-lite instead - its what I use and never had any problems.

This should solve it

You also might want to check - I know this sounds basic but sometimes its the most basic of things that cause problems but if your camera has a button on it to take a snapshot - some do like I know mine has........that the button has been become jammed incase thats why its taking pics all the time - might want to check that first actually before you start uninstalling and installing drivers

v_Ln

Thanks for the advice, will give that all a go. The button was in order, so I guess the next stage will be to scrub Kazaa, clean out the drivers, give it all a clean, and start again. WIll let you know how it turns out.

Thanks, really, I appreciate it.

Narcosis. :D

np at all matey - heh thats what we're here for ;)
you might want to check the webcams site for updated drivers as well
v_Ln

I also have a creative web cam with the software that you are speaking of.

I also have the monitor program installed...

I have never seen it do anything like described.

But then again... I am a bit parinoid when it comes to stuff like that... microphone and webcam unplugged when not in use.

FYI- there are more trojans other than sub7 that will allow the attacker to take control of the webcams..

optixpro would be a good example.
http://www.evileyesoftware.com/
net-devil trojan
amongst many others...

also, is this happening only when you're online?

Use a program such as tcpview or fport to see if you have any odd programs listening...

Another thing you can use to see what is taking control of your webcam would be filemon .

Fire up filemon and wait for the webcam to start acting up. I'd be more intersted in what is happening before and during the webcam acting up... You can see which files/programs are active and rule them out one by one until you find the offending program.

You may also want to look into pstools ...

Have phun investigating! And let us know your results.

Is it just a webcam, or a digital camera too? Mine is both, and it has a camera setting, an off setting, and a webcam setting. I've discovered that if I leave it on webcam mode and plugged in, it randomly takes pics. If I make sure it's turned off, it doesn't do it. Kinda freaked me out the first time I came back to the computer and the webcam software was open and there were like 10 new pictures :eek: Fortunately, when I'm not actually using it as a webcam, I put it on a shelf in my desk, so it was just pictures of a bunch of books...lol. I finally realized what the problem was, and it hasn't happened since.