Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Malware Hooked Into Welcome Screen?


  • Please log in to reply
4 replies to this topic

#1 Graeme308

Graeme308

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Australia
  • Local time:07:25 PM

Posted 19 June 2006 - 11:18 PM

I think someone has accessed my computer through a trojan or worm, but am not sure. I sign on to windows(xp home/sp2) with a password, and I used to have the screensaver set to resume on welcome screen, which would bring up the password sign-on box. A few days ago, I started to use the computer after it had been idle for a while and the screensaver had come on. On moving the mouse,the welcome screen came up, and I signed on. It went to the next screen but then froze. The only way I could get any response was to wait until the screensaver came on again, and then try to restart from the welcome screen. When I did this a window came up which said "Other people are using this computer and restarting could cause them to lose unsaved data. Are you sure you want to restart?" As I am the only person who uses this computer, I was surprised, to say the least. After trying a few things, I found that if I disabled the 'resume on welcome screen', the screensaver would turn off normally. I have not re-enabled it in case this is how they are accessing. if they actually are. If I have some type of malware, why has nothing picked it up? ZA Pro told me Messenger was trying to monitor activities on my computer, so I have stopped it running with process explorer.

I have Zone Alarm Pro and BOClean(both run on startup), Spyware Doctor(both antispyware and antivirus),Spybot, and Adaware. Task Manager and Process Explorer both say I am the only user logged on when I check them. I have run Rootkit Revealer and Blacklight. Both come up clean. HijackThis scan showed two items concerning Messenger: one was an extra tool menuitem, the other an extra button. I fixed both. I have not enabled the 'resume on welcome screen' since, and windows will restart or shutdown normally, so I don't know if I still have a problem.

Has anyone heard of this happening, or had a similar problem?

BC AdBot (Login to Remove)

 


#2 BobbySocks

BobbySocks

  • Members
  • 50 posts
  • OFFLINE
  •  
  • Local time:04:25 AM

Posted 20 June 2006 - 07:32 AM

your situation is a bit confusing :thumbsup: have you scanned your computer with all those antispyware and antivirus programs? have they found anything?
I use Spy Sweeper.

#3 Graeme308

Graeme308
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Australia
  • Local time:07:25 PM

Posted 20 June 2006 - 04:00 PM

Thanks for the reply

Yes,I have scanned with all those programs (regularly) and they have found nothing.

#4 Albert Frankenstein

Albert Frankenstein

  • Members
  • 2,707 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Michigan, USA
  • Local time:05:25 AM

Posted 20 June 2006 - 04:12 PM

Let me take a stab at this. At first glance it does not seem like malware at all, but simply that your computer froze.

If I understand the story correctly, you signed in and the computer froze, after a period of time the screensaver came on and when you moved the mouse you were prompted to sign in (and this was normal). When you tried to sign on you received a message :"Other people are using this computer and restarting could cause them to lose unsaved data. Are you sure you want to restart?" . It is my estimation that the other people is you from when you tried to log in the first time but it froze.

I don't know where to go with this. Perhaps you could satisfy yourself that no one is using your computer by disconnecting it from the internet, and then repeat the scenario above. If you get the same results, then it is not from someone remotely connected to your computer as it will not be connected to the internet.

That might be a place to start.
ALBERT FRANKENSTEIN
I'M SO SMART IT'S SCARY!


Currently home chillin' with the fam and my two dogs!


#5 Graeme308

Graeme308
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Australia
  • Local time:07:25 PM

Posted 21 June 2006 - 03:52 PM

Good morning,guys

Sorry I take a while to reply, but with the time difference and shiftwork, it is hard to reply immediately. This morning I re-enabled the "resume on welcome screen" and have tried it numerous times. Each time after signing in,the desktop has come up immediately. So it looks as if everything is working ok again. Albert, maybe your suggestion was right, but ZAPro did warn me twice that Messenger was trying to monitor my activities, so maybe fixing the two items in the HJT scan and killing Messenger and its process tree with Process Explorer fixed the bug? (I had tried disconnecting from the net, but it did not help)

Anyway I am hoping the problem has gone. Thanks for your answers and help.

Graeme.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users