0

Yep, it's pretty specific, I know..

I have a user that has this issue:

While using his laptop (ThinkPad T420) and having any number of windows opened, something will close them every 12.3 seconds (Yes I used stopwatch :) ) and then a single left mouse click is emitted.

I prepared a setup and took a video that demonstrates is pretty well I hope, please see the video for yourself or check out the gif animation below:


Gif Animation

It is recorded of a remote connection, since I don't have physical access to the machine. You can see the single click right after the windows (including the Task Manager) are minimized, it is reopened right away automatically thanks to the click being emittet (while the cursor is above it's icon in the bottom bar).

Curiously this doesn't happen when I am logged in as local adminstrator, but when I created a brand new user account the issue presented itself again!

I just can't find what is doing this.. so to the actual question:

1) Is there a way to find out what/how is it minimizing the windows?

I checked the PC with MSSEC, which found and removed one infection and then also with ASET NODE 32 which found nothing anymore. I checked the registry with Autoruns for Windows which found:

HKLM\SOFTWARE\Microsoft\CurrentVersion\Policies\Explorer\Run

with Name: 3673029395 Type: REG_SZ Data: C\PROGRA~3\msodud.exe This is what VirsuTotal has to say about that file.

Anyways so I removed the file but something stayed behind and won't let me remove that registry entry. As seen below:

Registry fun Alternatively here's a link to the video.

Those two issues might not be connected but they also might!

So the question two is:

2) Is there a way to find out which application is listening to changes on a certain registry record?

Thanks for reading this wall of text with 50MBs of GIFs, I really have no ideas how to deal with this anymore..

4
  • Since you know that there was at least one infection, you might try yet another AV, such as Kaspersky or Malwarebytes, perhaps running from bootable media. In addition, you might use Task Manager or Sysinternal's Process Explorer, run as Administrator while in the problematic accounts, sort processes by CPU, and look for an unknown process. For the Registry, you may need to change permissions on a Key. Also check Task Manager for strange tasks. Feb 27, 2015 at 2:48
  • Permissions on a key, that's a good idea. I didn't know that was possible, thanks!
    – nana
    Feb 27, 2015 at 2:53
  • Have you thought about separating this post of yours into two independent questions? I think both of them are quite interesting, but your monolithic one is not so much because most of the backstory is completely unrelated to the questions themselves.
    – julealgon
    May 4, 2015 at 19:50

0

You must log in to answer this question.

Browse other questions tagged .