60

I have a Microsoft LifeCam HD sitting atop my monitor. Today, completely out of the blue, its light came on -- I was simply browsing the web (in Chrome) when it happened. After about 5 minutes the webcam turned off.

Naturally, I immediately suspected my ex-wife (when in doubt, I always suspect her), but she isn't computer savvy enough.

I looked over the process list and didn't see anything suspicious. I am running a couple of open source projects and free apps (e.g., greenshot, powermenu, supertray), but I've had them for years. Autoruns reports nothing suspicious in the startup and neither does Windows Defender.

Anyways, what could it be? What should I look at next?

18
  • 3
    when it happens again, disconnect your internet, and see if the cam goes dead.
    – 7wp
    May 27, 2011 at 5:42
  • 11
    Is your ex-wife named 'HappyHacker'? May 27, 2011 at 6:09
  • 14
    @muntoo more like 'ReallyAngryHacker'. May 27, 2011 at 6:32
  • 15
    If your computer starts saying things like, "I'm afraid I can't do that, Dave", then you should really worry. May 27, 2011 at 12:17
  • 5
    Are you a student at Harriton High School in Pennsylvania?
    – JYelton
    May 27, 2011 at 15:47

7 Answers 7

39

Process Explorer from Microsoft would be my next guess : http://technet.microsoft.com/en-us/sysinternals/bb896653. Once you have loaded it up, click View -> Lower Pane View -> Handles. Now when you click on each of the processes in the top Pane, you get a report about all of the files and registry keys it has open. The keys are the important bit.

It can list lots of information about currently running processes, and although I don't know for sure if it will definitely tell which process has the webcam open, you might be able to gain hints. I just tried it for OneNote while recording a video, and for my Lifecam VX7000, it had this key open while recording a video, which is almost certainly the webcam (especially seeing as it disappeared once I stopped recording) :

HKLM\SYSTEM\ControlSet001\Control\DeviceClasses\{65E8773D-8F56-11D0-A3B9-00A0C9223196}\##?#USB#VID_045E&PID_0723&MI_00#8&27B22E96&0&0000#{65e8773d-8f56-11d0-a3b9-00a0c9223196}\#GLOBAL\Device Parameters

I don't know what your device will appear as, but keep an eye out for processes which have HKLM\SYSTEM\ControlSet001\Control\DeviceClasses\ keys open, and look for keywords like "USB#VID" in there. Pressing Ctrl+F and searching for the string "USB#VID" should find processes with that key open.

If you want to find out exactly what your USB device is called to windows, open device manager, find your webcam in there, double click on it, then click the details tab. In the drop down box on that page, go to Hardware ids, or check out some of the other details in that dropdown box, and see if you can match it up to a process in Process Explorer.

edit : forgot to mention, this procedure only works while the process is still using the webcam (i.e. the light is still on)

6
  • 10
    Faster method: Hit CTRL+F to search and then enter USB#VID there; or for CLI people there is handle.exe. :) May 27, 2011 at 13:24
  • 1
    ctrl+f while in process explorer that is. Note that the camera's vendor id string can be found in the device manager: dbl click the device, look at the details tab and then pick hardware Ids from the dropdown
    – horatio
    May 27, 2011 at 15:00
  • 2
    @tom ah excellent, I wasn't sure if Ctrl+F would search through all the handle keys as well or just process names. I've never needed to use it as I've always known exactly which process I'm looking for. I'll add that info in.
    – camster342
    May 27, 2011 at 20:24
  • 2
    Very helpful. I found it was my IE8/XP virtual machine (MS's own OVA file downloaded from Modern.ie) that was using the usb camera. VirtualBox allows USB pass-through and while the VM was running, it was turning the camera on. The handle to look for in this case is 'vboxusbwebcam'. Aug 7, 2014 at 13:20
  • My LifeCam has the light always on ever since I took a final exam with Examity, in which an Indian proctor asked me to enable my camera in Examity's browser interface. processexplorer.exe > ctl-f reveal only 2 instance of "#VID", both associated with Skype. Sep 8, 2015 at 18:51
19

Could be flash or another browser plugin.

7
  • 7
    Would flash typically throw up a message box asking if it's ok to use? May 27, 2011 at 6:01
  • 3
    I would hope so, but there may be ways around that. May 27, 2011 at 6:02
  • 11
    Not if you once agreed to allow Flash to always use the camera?
    – Snark
    May 27, 2011 at 9:16
  • 2
    I believe flash asks every single time, and there isn't an "always trust this site" option. I'm a flash developer and Adobe is very paranoid about security exploits so I cannot see it being something like a saved permission or just plain being accessed without permission.
    – user72945
    May 27, 2011 at 12:46
  • 2
    It could be silverlight as well, and silverlight does have an "always trust this site" selection.
    – Barry
    May 27, 2011 at 13:23
11

Cameras (and other recording devices) that you own should NEVER turn on without your consent. If you're not aware of an application that you've configured to do this automatically from time-to-time, then it's time to start figuring out if you have SpyWare on your computer that may be activating it.

Here are two excellent free tools that I trust (there isn't much that I do trust when it comes to security software in particular) and use for removing SpyWare that should be helpful to you:

  MalwareBytes
  http://www.malwarebytes.org/

  SpyBot - Search & Destroy
  http://security.kolla.de/

If I was experiencing this problem, scanning for SpyWare would be a very high priority.

3
  • 2
    "should never turn on without your consent"... is very different from "what actually happens". EX: Most languages let you freely open the soundcard and start recording without alerting the user. So unless your OS somehow has permissions for how code accesses hardware... it's up to the programmer to alert the user or not. May 27, 2011 at 16:42
  • 2
    Java applications by default let's you record audio without alerting the user in any way. "Permission to record sound is controlled separately. This permission should be granted with care, to help prevent security risks such as unauthorized eavesdropping. By default, ... An application running with no security manager can both play and record audio" May 27, 2011 at 16:52
  • @TrevorBoydSmith: +1 for each of those fine contributions. My use of the word "should" was intentional. I think more people should pressure vendors to respect consent for audio and video recording functions. May 27, 2011 at 22:04
3

To add to @Andrew Cooper's answer:

About a year ago there was a big hoopla in the security community over a researcher using what's now known as clickjacking to get Adobe Flash to erroneously think the user agreed to allow webcam access.

That specific vulnerability has been fixed, but there could always be more. The only way currently to prevent clickjacking is using Firefox with NoScript. Chrome/IE8 also have rudimentary clickjacking prevention, but only for sites which support it (which won't help prevent Flash-clickjacking).

1
2

You may not see something wierd in the process list since the "malware" may have injected itself into another application. Most likely a process that is common on all windows systems(explorer.exe as one example).

Unplug internet, see if it turns off. Whenever it happens again start working on finding the process, thats using your webcam, as suggested by another poster, with process explorer.

When you have determined which process you should look at which connections that process has and to which ports. This is also viewable in process explorer.

Note the IPs, post the list on a forum(Can't think of a specific one at the moment) that deals in these sorts of things if you can't determine it yourself.

Save the information from above.

Wipe your system and install from trusted sources.

1

If you have WIA (Windows Image Acquisition) service trying to run in your log and it's disabled, it will log an error (typically, it's auto-start with Windows).

I've had this, and no cam attached, no scanner or digital camera attached, and possibly it could be something invoked by Flash.

-4

Cover your camera. Right-click on a YouTube player window. Click Settings. See the eyeball in a TV image? Click it and deny access to your camera.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .