Igen suspect that someone is may be controlling my computer using some remote desktop app. How I check if I am right or not?

My only clue is that my mouse sometimes start to move randomly (it is not a mouse error, not even straight line moves, and sometimes 5-10 secs around the screen.

I am using fedora 17.

How can I verify this, and stop it?

  • 9
    Is you mouse wireless? If you only experience random mouse movements, I'd first think about either interference, dirty optical sensor or any other mechanical damage to the mouse, not about someone strange that enjoys controlling your PC just to randomly move mouse. Sep 11, 2012 at 11:07
  • 2
    Real hackers don't use the network to remote-control your computer, they use a butterfly with very accurately timed wing flaps, creating small changes in atmospheric pressure, which in turn causes electromagnetic radiation to hit your computer, flipping specific bits in memory thereby allowing them to alter your system's state to their advantage.
    – Thomas
    Sep 11, 2012 at 14:30
  • 4
    @Thomas - no they use emacs C-x M-c M-butterfly.
    – dr jimbob
    Sep 11, 2012 at 16:30
  • 2
    Is it a laptop? Does it have the Thinkpad nubby pointer? Does it have a touch pad? If the answer is yes to any of these, there are known issues that can cause random mouse movement with these devices, particularly on non-standard OSes that sometimes have spotty or minimal driver support. Also, you can get some really weird movement if sensor's are partially blocked (such as by a hair across the sensor). Sep 11, 2012 at 16:57
  • 2
    @Icallyca I think you have some misconceptions regarding monitoring and remote control. Monitoring is just watching (or recording) your screen, or the data being passed to/from your computer. It would not cause the mouse movements you've described. Remote control, on the other hand, is actually hijacking your computer in order to make it do tasks other than what you would have it do. This can be done in the background, but some methods (i.e.: VNC or other "desktop sharing" applications) will actually show themselves in ways such as what you're experiencing here.
    – Iszi
    Sep 11, 2012 at 16:57

5 Answers 5


If someone is accessing your computer then there will be network traffic related to this. While if you suspect that your PC has been compromised, then you can't rely on data you get from the computer but you could monitor the traffic using a seperate box and (e.g.) wireshark


netstat (network Statistics) is a simple command line tool that displays all active connections both incoming and out coming, and provides a number of useful network interface statistics. You can explore it further at how to use this command to detect suspicious IPs. For Blocking you can use IPtables which is a very useful network layer firewall to block all the blacklist IPs or unwanted outbound connections by writing rules for them.


First off, you will need to provide more information in your question to help this audience narrow down and assist you. As you have proposed it, your question is like asking - my house might have been broken into, how can I tell while I am on vacation in africa.

Secondly, having installed linux systems (fedora being one of them) on a variety of hardware configurations, you can sometimes get this behavior just from the system. Lately, for instance on my Ubuntu system, I have been finding for some strange reason, when I connect USB drives (clean ones I know for a fact) to my machine, my wireless mouse starts doing a very similar behavior - it becomes erratic. So what you are witnessing could simply be a kernel change that is flaky.

Finally, the advice provide above is good, however some pointers and thoughts:

  1. If a rootkit has been installed on your machine, understand any utility (including netstat) could be subverted, so you can not test what is being reported. If you are wanting to listen to network traffic coming from/to your machine you will need to do it from an independent machine. You can do this very easily by grabbing a Snorby appliance and setting it up on another machine (its a VM) on your subnet and listening to your traffic. (https://snorby.org/)

  2. Boot your machine with a clean fedora livecd and gather md5 hashes of all the key binaries. Then go set up a clean instance in a VM and bring it to the same run level as the one yours is and capture the same hash base. Do a diff.

  3. Run through the SAN checklist provided.

  4. Google around and see if other users of your fedora version/level are having similar issues with the mouse config you have. I would do this FIRST before anything else.

Just a few of the quick things you can do. You can be as diligent as you want, and take it to whatever level you want. Its up to you and the time you have.


There is a really REALLY simple thing you can do to figure out if this is a technical issue or a remote access. If it occurs regularly, simply disconnect your computer from the network the next time it occurs. See if the movement continues or is terminated. If it ever happens while disconnected, it is a technical problem. If it consistently stops when disconnecting the network, then you will probably want to look in to things more closely.


You can check whether there is a remote desktop app listening on your computer using netstat (netstat -ltp or netstat -ltpn if you want netstat to resolve hosts and ports). The most widely used remote desktop app is VNC I guess, which should listen on port 5900 by default. If something like that is listening, then you may have a problem :)

But if you can't find it this way, it doesn't mean your computer is safe, because the person may have installed a rootkit that hijacks the informations read by netstat. So you could install something like wireshark and tcpdump, stop all your activities using the network (web browsing, e-mail, IM, etc) or learn how to use filters in wireshark/tcpdump and see if there is remaining network activity. Then you'll have the IP address from which the person should be connecting (it may be spoofing his IP address using some tor or socks relay but that's beyond the scope of this reply).

You can also use nmap to find open ports on your computer. But sometimes, some backdoors use port knocking (they wait for specific packets with a particular flag enabled for example) to hide (SAdoor uses this).

You can run chkrootkit and rkhunter commands on your system too. But it won't detect tweaked backdoors.

You can get other useful advices on the cheatsheet here: http://www.sans.org/score/checklists/ID_Linux.pdf

Not the answer you're looking for? Browse other questions tagged .