2

I'm not sure if it's relevant, but the computer in question is a DELL Optiplex 3040.

OS: Windows 10

Symptoms:

  • Chrome browser auto-opens tabs that is file:// browsing, like the documents folder.
  • Page will change by itself and the DVD drive opens

What I've Done:

  1. Reset Chrome, checked start up pages, settings, etc.
  2. Installed AVG, updated definitions, ran all tests. (Then uninstalled)
  3. Installed Kaspersky, updated definitions, ran all tests. (Still installed)
  4. Checked Firewall (Currently using Windows default security settings and defender)
  5. Checked for suspicious apps running via task manager.
  6. Checked for suspicious programs installed via Add/Remove Programs

Every test passed with flying colors. Is there a list of steps I can take for further action to identify the issue? I've never seen this before.

Improve this question
1
  • do you use a wireless keyboard?
    – schroeder ♦
    Commented Apr 11, 2017 at 17:27

1 Answer 1

Reset to default
2

If I was you, I would just re-image it.

If you need to know what could be running, do a memory dump before you shut it off, and take a copy of the disk (using a live linux ISO and dd) for analysis.

Check any firewall logs you might have, and check for any strange outbound connections.

You don't mention you environment, but if you have domain admins, they could just be messing with you.

Updated:

A hack that had such 'obvious' symptoms wouldn't necessarily be as concerning as one that didn't (which is why I asked about your admins).

The real issue is that if you think you've lost control of your PC (and that does sound like it might be the case), then there is very little you can do to be sure you have addressed the issue, if you don't re-image.

An attacker with sufficiently high privileges can do a lot to mask and obfuscate their actions, and that ultimately means most of your diagnosis tools become less trustworthy: if you do see something, that's generally promising, but if you don't see anything suspicious, then you have no way of knowing what that means.

So, while I can understand you don't want to re-image, doing so is by and large the only way you can hope to have some peace of mind, and certainty about you system.

That doesn't mean you must or should do anything in particular - other than what you think is best.

Improve this answer
2
  • On the env., it's clean. No one messing with me. I wish that was the case. Sounds more like a genuine hack going on to you? I'd hate to rebuild the OS from scratch. Wouldn't I be able to absolutely see an open port being used during the activity (e.g. netstat -ano) ? A process must be involved right? Can't completely hide?
    – user1447679
    Commented Apr 10, 2017 at 19:37
  • "genuine hacks" don't open the optical drives randomly - if you have lost control of the device, then you really need to re-image it
    – schroeder ♦
    Commented Apr 11, 2017 at 17:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .