I am new to this forum, so apologies in advance if this question does not seem to fall within its scope, or if it seems too long:
On two occasions over the past ~3 weeks, a hacker gained remote access to my laptop (PC running Windows 10), as evidenced by mouse cursor movement. On both occasions, I was connected to the WiFi network at my university, and rapidly shut down the computer as soon as I saw what was going on.
On the first occasion, I was in denial, assuming that the cursor movement was due to a touchpad malfunction. The second time, the cursor movement looked very purposeful and human-like; I am confident that my computer was remotely accessed.
Since then, I have only used this laptop offline. I am preparing to do a clean install of the OS. Before that point, however, I'm trying to find any evidence that confirms my initial suspicion that my computer was accessed through the RealVNC Server that I did have running on there. This assumes that someone was able to identify my password through brute force.
Tricky thing is, I'm lacking in evidence that this was the means of access. Usually, VNC Server connections should prompt an on-screen notification, which I never saw. I also cannot find evidence of VNC connections if I search the Event Log for the dates/times when I noticed the cursor movement. So, now I'm wondering if (a) the hacker suppressed the logging/notification, or (b) my laptop was accessed in some other way.
There are three other pieces of information that might be useful:
(1) If I look in the Event Log at the date/time of the first incident, I can find a Logon of Type 3, with Security ID "ANONYMOUS LOGIN", Security ID "NULL SID", a Login Process of "NtLmSsp", and blanks or 0's in any fields that would provide information about the origin (no Workstation Name, no IP address, etc). Is this consistent with a web-based VNC login, or something else?
(2) In both cases I noticed the cursor movement when I was using Chrome. Maybe just a coincidence.
(3) I have run full scans with both Symantec and MalwareBytes; neither detected anything.
It seems that understanding the cause of these incidents will be important for preventing them from happening again. As stated above, I plan to reinstall the OS, and since I have no future need for VNC Server, I will not reinstall it. I've also been changing the relevant passwords. But I'm not sure if that will be enough.
Thank you in advance for your time.