2

I've had a very strange experience with Windows 10, where the notification bar, the calendar bar, the start menu all started to pop up and off, and I lost control over my mouse cursor which was jumping from one text editor window to another. This lasted for about a minute and then everything was back to normal. I had McAfee scan the whole system for any malware and nothing found; the firewall is on; no odd applications were installed. What would it take for someone to gain such control and how to identify the process responsible?

Thanks

closed as off-topic by Steve, Xiong Chiamiov, Xander, schroeder Apr 7 '17 at 21:17

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – Xander, schroeder
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    Team viewer?or anydesk? – Mr.lock Apr 6 '17 at 18:00
  • 1
    May sound strange but - what mouse do you have? – Arminius Apr 6 '17 at 18:00
  • 1
    Ok, so I've just checked and TeamViewer is indeed installed, but I didn't install it and I'm the only user. Does it come with windows updates or smthng? – ark Apr 6 '17 at 19:01
  • 1
    No, it doesn't come with windows update. If you don't know why it's there, remove it ASAP. – Οurous Apr 6 '17 at 19:06
  • don't count on one single AV to check your system from malewares – elsadek Apr 7 '17 at 15:56
2

If you think you were compromised and are being spied on, here is what you should do:

  1. Now this a double-edged sword since you cannot be sure whether your desktop activity is being monitored. At the moment you read this, you should pull off the internet plug from your computer because once the attacker sees what you are reading, he/she may kill off the process and hide in the shadows until further notice.

  2. Wait for a couple of minutes then run cmd, type in netstat -abno I think, to get PID of every process still listening. If you don't get PID this way, then locate it in task manager, it has to be in one of the manager's tabs. It will tell you which program uses the PID that is listening.

  3. Locate the program with where example.exe command in cmd. Go to the folders and copy the suspected .exe files to a freshly formatted external device, USB for example. After copying, make sure there are no hidden autorun files on there.

  4. Use public network and possibly a public device to plug in USB and scan the files on virustotal. That should shed some light on the whole thing. However, if malware was encoded into the original file, it could easily bypass detection.

  5. If still not convinced, blast the hard drive. Most efficient way to get rid of parasites. Don't forget to format the USB drive also.

All in all, I don't know which processes actually need network in Win 10 but you should be able to figure that out with the help of search engines. Rest you should kill permanently, even for devices such as printer, if you don't use them.

Also, you could install tcpview, a neat program to monitor your network traffic by process. It is a better version of netstat with live bandwidth and packets information. This way you could actually detect if you are live streaming to a foreign address. On the other hand it is a bit limited because in case of passive spying, logs and/or screenshots that don't eat much bandwidth, you won't be able to tell what data is sent over. For that you would need something like wireshark or tcpdump.

Not the answer you're looking for? Browse other questions tagged or ask your own question.