2

I'm not sure if it's relevant, but the computer in question is a DELL Optiplex 3040.

OS: Windows 10

Symptoms:

  • Chrome browser auto-opens tabs that is file:// browsing, like the documents folder.
  • Page will change by itself and the DVD drive opens

What I've Done:

  1. Reset Chrome, checked start up pages, settings, etc.
  2. Installed AVG, updated definitions, ran all tests. (Then uninstalled)
  3. Installed Kaspersky, updated definitions, ran all tests. (Still installed)
  4. Checked Firewall (Currently using Windows default security settings and defender)
  5. Checked for suspicious apps running via task manager.
  6. Checked for suspicious programs installed via Add/Remove Programs

Every test passed with flying colors. Is there a list of steps I can take for further action to identify the issue? I've never seen this before.

  • do you use a wireless keyboard? – schroeder Apr 11 '17 at 17:27
2

If I was you, I would just re-image it.

If you need to know what could be running, do a memory dump before you shut it off, and take a copy of the disk (using a live linux ISO and dd) for analysis.

Check any firewall logs you might have, and check for any strange outbound connections.

You don't mention you environment, but if you have domain admins, they could just be messing with you.

Updated:

A hack that had such 'obvious' symptoms wouldn't necessarily be as concerning as one that didn't (which is why I asked about your admins).

The real issue is that if you think you've lost control of your PC (and that does sound like it might be the case), then there is very little you can do to be sure you have addressed the issue, if you don't re-image.

An attacker with sufficiently high privileges can do a lot to mask and obfuscate their actions, and that ultimately means most of your diagnosis tools become less trustworthy: if you do see something, that's generally promising, but if you don't see anything suspicious, then you have no way of knowing what that means.

So, while I can understand you don't want to re-image, doing so is by and large the only way you can hope to have some peace of mind, and certainty about you system.

That doesn't mean you must or should do anything in particular - other than what you think is best.

  • On the env., it's clean. No one messing with me. I wish that was the case. Sounds more like a genuine hack going on to you? I'd hate to rebuild the OS from scratch. Wouldn't I be able to absolutely see an open port being used during the activity (e.g. netstat -ano) ? A process must be involved right? Can't completely hide? – user1447679 Apr 10 '17 at 19:37
  • "genuine hacks" don't open the optical drives randomly - if you have lost control of the device, then you really need to re-image it – schroeder Apr 11 '17 at 17:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.