Yep, it's pretty specific, I know..
I have a user that has this issue:
While using his laptop (ThinkPad T420) and having any number of windows opened, something will close them every 12.3 seconds (Yes I used stopwatch :) ) and then a single left mouse click is emitted.
I prepared a setup and took a video that demonstrates is pretty well I hope, please see the video for yourself or check out the gif animation below:
It is recorded of a remote connection, since I don't have physical access to the machine. You can see the single click right after the windows (including the Task Manager) are minimized, it is reopened right away automatically thanks to the click being emittet (while the cursor is above it's icon in the bottom bar).
Curiously this doesn't happen when I am logged in as local adminstrator, but when I created a brand new user account the issue presented itself again!
I just can't find what is doing this.. so to the actual question:
1) Is there a way to find out what/how is it minimizing the windows?
I checked the PC with MSSEC, which found and removed one infection and then also with ASET NODE 32 which found nothing anymore. I checked the registry with Autoruns for Windows which found:
with Name: 3673029395 Type: REG_SZ Data: C\PROGRA~3\msodud.exe This is what VirsuTotal has to say about that file.
Anyways so I removed the file but something stayed behind and won't let me remove that registry entry. As seen below:
Alternatively here's a link to the video.
Those two issues might not be connected but they also might!
So the question two is:
2) Is there a way to find out which application is listening to changes on a certain registry record?
Thanks for reading this wall of text with 50MBs of GIFs, I really have no ideas how to deal with this anymore..