[DOZ1T]

So for the last few days I've noticed that right after I turn my computer on, as I surf the web or whatever my cursor moves by itself, as if someone was alerted everytime my computer was turned on. I've also been getting constant windows prompts saying "You must restart your computer to apply these changes". Any advice on how to deal with this? Or how to check if anyone has been accessing my computer remotely? I ran Malwarebytes and it returned nothing fishy.

[oscast]

If you are infected/backdoored I suggest you wipe your pc ASAP

[.Astro]

Can you run your computer in Safemode? If you can, do that and run it with networking. Download a program called Hijack This (http://www.majorgeeks.com/files/details/...kthis.html).
Run it, save the log, and post it on Pastebin. You can either PM or post the Pastebin link here for further instructions.

[DOZ1T]

Thanks for the reply @inShane I PM'ed you the pastebin since I can't post links just yet.

[Knautschtabak]

Hi BOZ1T

Please read through the points below before we start.

• Read my instructions thoroughly, and carry out each step in the specified order.
  


• Do not run any tools or take any steps other than those I provide for you. Independent efforts may make matters worse, and will affect my ability in providing the best set of instructions for you.
  


• Please backup important files before proceeding with my instructions. Malware removal can be unpredictable at times.
  


• If you come across any issues, please stop and inform me of the issue in detail. Do not hesitate to ask before proceeding.
  


• I will notify you when I believe your computer is free of malware. The absence of symptoms does not necessarily mean that your computer is clean.
  


• If I do not reply within 48 hours, write a PM. I might have just overlooked your thread. Keep in mind that we likely live in different time zones.
  


• I might abandon your thread if you do not reply within five days. I take only as many logs as I can handle.
  

------
Step 1: Farbar Recovery Scan Tool (FRST) Scan

• Please download Farbar Recovery Scan Tool (x32) or Farbar Recovery Scan Tool (x64) and save the file to your Desktop.
  


• Note: Download and run the version compatible with your system (32 or 64-bit). Download both if you're unsure; only one will run.
  


• Right-Click FRST.exe or FRST64.exe and select Run as Administrator
  


• Click Yes to the disclaimer.
  


• Ensure the Addition.txt box is checked.
  


• Click the Scan button and let the program run.
  


• Upon completion, click OK, then OK on the Addition.txt pop up screen.
  


• Two logs (FRST.txt & Addition.txt) will now be open on your Desktop. Copy the contents of both logs and paste them to pastebin.com. Post the link here.
  
  

Step 2: TDSSKiller Scan

• Please download TDSSKiller and save the file to your Desktop.
  


• Right-Click TDSSKiller.exe and select Run as Administrator
  


• Click Change parameters. Place a checkmark next to Detect TDLFS file system and Verify file digital signatures.
  


• Click Start Scan. Do not use the computer during the scan.
  


• If objects are found, change the action to skip.
  


• Click Continue and close the window.
  


• A log will be created and saved to the root directory (usually C:\). Paste the file contents to pastebin.com and post the link in your next reply.
  

------------------------

In your next reply I get from you

• FRST.txt
  


• Addition.txt
  


• TDSSKiller log
  

[Elitas]

I doubt someone is waiting for your computer to turn on to move your cursor.

It could be a virus though.

Does it click anything? If it's just randomly moving; it's probably an error with your touchpad, might be too sensitive and think it's being touched.

[GontaJones]

Lol, this is so bleepingcomputer!
Old times.

[JoshuTee]

How is the cursor moving? Erratically or as if it's being moved by a person?