mysterious clicking=virus?
June 26, 2011 6:50 PM Subscribe
Do I have a virus? The only symptoms that I notice are:1) mysterious Internet Explorer clicking sounds & 2) window focus is changing without my direction.
This is Windows 7. I did a quick scan with Microsoft Security Essentials. I ran Hitman Pro. I ran HijackThis but the results are incomprehensible to me. I'll throw a log in as a comment, I guess. I did a system restore. The restore point was before I upgraded to firefox 5 and it broke firefox. It didn't make the sounds disappear, so I undid it. Firefox was still broken after the undo.
I reinstalled firefox 5 and I seem to be back where I started: I'm not sure about the window focus thing. It hasn't happened while I've been composing this question and that's been a while. On the other hand, the mysterious IE style clicking sounds haven't disappeared.
How do I find out which process is making a noise?
Is there any possible benign explanation for this? There are no IE or windows explorer windows open. Does that sound occur when some legitimate Windows process is working in the background?
What else should I try to figure out what's wrong? Where else can I get some expert eyes on a HijackThis log? I remember HijackThis being helpful years ago. Is it still worthwhile?
This is Windows 7. I did a quick scan with Microsoft Security Essentials. I ran Hitman Pro. I ran HijackThis but the results are incomprehensible to me. I'll throw a log in as a comment, I guess. I did a system restore. The restore point was before I upgraded to firefox 5 and it broke firefox. It didn't make the sounds disappear, so I undid it. Firefox was still broken after the undo.
I reinstalled firefox 5 and I seem to be back where I started: I'm not sure about the window focus thing. It hasn't happened while I've been composing this question and that's been a while. On the other hand, the mysterious IE style clicking sounds haven't disappeared.
How do I find out which process is making a noise?
Is there any possible benign explanation for this? There are no IE or windows explorer windows open. Does that sound occur when some legitimate Windows process is working in the background?
What else should I try to figure out what's wrong? Where else can I get some expert eyes on a HijackThis log? I remember HijackThis being helpful years ago. Is it still worthwhile?
Yeah, it's probably your keyboard, or if you have a wireless mouse the battery is low/signal is weak. For your keyboard, unplug it first and then go through and tap on each key in turn- see if any seem to not come back cleanly. If you have a wireless mouse, plugging in a wired one for a day, and see if the problem goes away.
posted by hincandenza at 7:11 PM on June 26, 2011
posted by hincandenza at 7:11 PM on June 26, 2011
Response by poster: This is a laptop. No mouse.
It's very comforting to think that this is a keyboard problem. That's much better than malware stealing my brokerage account credentials. But, I don't understand how this could be a stuck key. I have no problems typing and there are no mysterious letters popping up or other evidence of errant key presses. I just spent a minute mashing all the keys on the keyboard and they seem to operate as expected.
The keyboard is really gross, but... Are all the details I just added still consistent with a stuck key?
posted by stuart_s at 7:16 PM on June 26, 2011
It's very comforting to think that this is a keyboard problem. That's much better than malware stealing my brokerage account credentials. But, I don't understand how this could be a stuck key. I have no problems typing and there are no mysterious letters popping up or other evidence of errant key presses. I just spent a minute mashing all the keys on the keyboard and they seem to operate as expected.
The keyboard is really gross, but... Are all the details I just added still consistent with a stuck key?
posted by stuart_s at 7:16 PM on June 26, 2011
I don't think a stuck key is very plausible. It's conceivable that some malware is running a hidden IE window and surreptitiously refreshing some webpage in the background. One way to check:
- close every application that you can find, system tray and everything, especially ones that access the Internet
- Start -> Run, type "cmd", right-click the cmd.exe that appears in your search results and "run as administrator" (you must be in an administrator command prompt to run the next command)
- type "netstat -b" and let it run. This will give you a report of which connections your machine is making, and which application is creating them. This could give you a clue to start with.
The list also includes recently made connections as well as current ones. You may want to let your system idle for awhile (after closing apps) before doing this to filter out normal activity.
posted by neckro23 at 7:20 PM on June 26, 2011
- close every application that you can find, system tray and everything, especially ones that access the Internet
- Start -> Run, type "cmd", right-click the cmd.exe that appears in your search results and "run as administrator" (you must be in an administrator command prompt to run the next command)
- type "netstat -b" and let it run. This will give you a report of which connections your machine is making, and which application is creating them. This could give you a clue to start with.
The list also includes recently made connections as well as current ones. You may want to let your system idle for awhile (after closing apps) before doing this to filter out normal activity.
posted by neckro23 at 7:20 PM on June 26, 2011
Response by poster: Thanks, neckro23. I tried to follow your advice as best I could. I closed as many apps as I could and ran netstat. I didn't understand a lot of what it said. Well, any of what it said really.
But the clicking hasn't happened since I closed all of the apps in the tray. Maybe it was something in there. I'm going to reboot and try to disable them more systematically.
There's nothing new in the tray so this new behavior is still pretty unsettling.
posted by stuart_s at 7:56 PM on June 26, 2011
But the clicking hasn't happened since I closed all of the apps in the tray. Maybe it was something in there. I'm going to reboot and try to disable them more systematically.
There's nothing new in the tray so this new behavior is still pretty unsettling.
posted by stuart_s at 7:56 PM on June 26, 2011
Scan your system with Malware Bytes and report back. It's free to download.
posted by smithsmith at 8:13 PM on June 26, 2011
posted by smithsmith at 8:13 PM on June 26, 2011
P.S. out of interest does your laptop touchpad have two finger scrolling? It could be that when you are scrolling you are also zooming in and out on the window.
posted by smithsmith at 8:17 PM on June 26, 2011
posted by smithsmith at 8:17 PM on June 26, 2011
Did you update to service pack 1 on windows 7 when the focus problems started? I had an incomplete service pack installation which caused an odd recurring focus loss issue not unlike what you are describing (not the IE problem though).
I originally thought it may have been a virus but Malware Bytes, amongst other things, came up clean. I ended up restoring the system to the check point before the service pack installation and everything was fine again.
If you want to try this, go to backup and restore and look to see what restore points you have available.
posted by NormieP at 8:51 PM on June 26, 2011
I originally thought it may have been a virus but Malware Bytes, amongst other things, came up clean. I ended up restoring the system to the check point before the service pack installation and everything was fine again.
If you want to try this, go to backup and restore and look to see what restore points you have available.
posted by NormieP at 8:51 PM on June 26, 2011
I'm going to go with "stuck key" because I've had the same thing happen.. thought the same as you did... and it was just a stuck key.
posted by j03 at 11:35 PM on June 26, 2011 [1 favorite]
posted by j03 at 11:35 PM on June 26, 2011 [1 favorite]
Try repeatedly tapping on every key on your keyboard while it is off. If you do run HijackThis, post the results to Pastebin (to keep the thread clean and also so you can delete it afterwards).
HijackThis is still used quite a bit in the field. There's also OTL and GMER which have gained ground as being more comprehensive for detecting more recent threats.
posted by samsara at 4:44 AM on June 27, 2011
HijackThis is still used quite a bit in the field. There's also OTL and GMER which have gained ground as being more comprehensive for detecting more recent threats.
posted by samsara at 4:44 AM on June 27, 2011
This thread is closed to new comments.
I captured that log before the whole system restore debacle, but anything fishy should be there then and now, right?
posted by stuart_s at 6:56 PM on June 26, 2011