Malware stole an executable file on my computer? Seems unlikely

Question

If you don't want to read all of the details, skip to the bottom; I'll make a summary.

I created a computer program as a proof of concept (I threw it together in 12 hours, so I wrote it in Visual Basic to get it done quickly). Normally I'd be using Linux but my client wanted a Windows version, so I resorted to VB.

Anyway, the program was designed for a computer rental company; if a computer is rented to a customer is lost, stolen or the customer stops paying, the computer can be remotely locked and tracked. I got the proof of concept working and installed it onto 4 computers running Windows XP. I showed those 4 computers to my client and demonstrated the software to them.

Once I'd finished the demonstration, I returned the computers back to my office and they've been turned off ever since. However, today (2 days after the demonstration) I noticed a computer check into my online service (e.g. my program was installed onto another computer). The model of the computer was completely different to the computers I was using and the serial number was reported as 'None'.

Also, I noticed the same computer check in 4 times within the space of 2 minutes from different locations in the world (according to IP address lookup). It's possible that it was 4 identical computers in different locations running the software at almost exactly the same time (The serial number was 'None' so I couldn't tell if they really were different computers or not).

I don't understand how this happened because I created the software on a Virtual Machine running a clean install of Windows XP with antivirus (the host machine was running Linux). The 4 demonstration machines were also clean installs with antivirus and they were fully updated. This means that during the 15 minutes those computers were connected to my clients' network, the program somehow got leaked. The computers never left my sight, nobody other than myself have ever accessed them.

How is that even possible and why would malware target a .exe file?

Summary

• Created software on a clean install of Windows XP in a virtual machine (host was running linux)
• Installed the software onto 4 computers and connected them to an unknown network for no more than 15 minutes
• Nobody touched the computers besides myself
• The software was then run from 4 different internet connections on what seems like the same computer two days after I unplugged the computers from the unknown network (the computers were never turned on again after being connected to that network).

Software is closed-source and was never given to anyone.

If it was malware, why did it steal an .exe?

Answer 1

The most important part of this post is "with antivirus".

Do you have automatic submissions turned on? If so, those computers might have sent in an 'automatic submission' to the AV mothership at some point. It might have been flagged for evaluation, and possibly run in a controlled environment to see what behavior it would exhibit. These environments are often global, as sometimes malicious software does different things if run from a different subnet/country.

The other possibility (discussed by others) could be that it's random port scan or POST engine looking for vulnerabilities on the particular port you are using. You should enter the IP addresses that are contacting you into an abuse list, and see if they are known scanners.

Mike

Answer 2

sounds like your software should have some sort of authentication with your 'online service'

If your online service gets pinged, would it report that as a connected user? It is possible its just a robot hitting your online service?

Answer 3

To be honest, this sounds to me like someone or some other program made an error and contacted your server instead of the one they had to contact. But if you really want to test, just track their computer. That will work if they're running your software and throw up an error if they aren't. To be honest, I really doubt that someone with the skills required to access your filesystem in 15 minutes would be so careless as to leave traces that they stole your program.