PDA

View Full Version : How do you stop something that takes over the keyboard, mouse, and closes every windo


GUI_Tex
February 26th, 2006, 08:23 PM
How do you stop something that takes over the keyboard (types letters frequentl), mouse (moves it around), and closes every window that is being open? so you can't kill it with task manager, a third party taskmanager they will be closed, cant run spyware, or antivirus, because it will close those windows before they can do a scan, Is there such as way to stop it besides restarting, Is going into safemode the only possible solution? :-\

maybe freezing all processes except ones that are whitelisted.. but how?

BlueZannetti
February 26th, 2006, 08:37 PM
-{ Quote: "How do you stop something that takes over the keyboard (types letters frequentl), mouse (moves it around), and closes every window that is being open? so you can't kill it with task manager, a third party taskmanager they will be closed, cant run spyware, or antivirus, because it will close those windows before they can do a scan, Is there such as way to stop it besides restarting, Is going into safemode the only possible solution? :-\

maybe freezing all processes except ones that are whitelisted.. but how?" }-If safemode doesn't work, I'd probably try two things before just saying the heck with it and reformatting... Boot with a BartPE environment and try to manually locate and deal with the situation. As a first step, I'd clean out all temporary locations, remove suspect downloaded program entries, cleanout the prefetch folder, make the standard search for executables with random letter/number names, run McAfee Stinger from this state and anything else I could readily use (check the plugins list) and see if that stabilized the system enough for rationale cleanup from a normal boot.
Pop the drive into a working system as either a slave drive, or if I had a USB enclosure sitting around, pop it into that and connect via USB. Scan and manually assess the drive. Clean up as above.If the system didn't have a lot of stuff I wanted to save, and I had all the needed discs and serial keys/key files already assembled elsewhere, I'd probably do a simple reformat and start over.

Blue

WSFuser
February 26th, 2006, 08:54 PM
if ur talking about a hypothetical situation, then i think processguard (paid) could prevent such chaos.

GUI_Tex
February 26th, 2006, 09:35 PM
I guess I did neglect saying that I was just asking a serious question, if this did happen, hypothetically, and it was not prevented.. what could be done?

hackers.. scriptkiddy.. have easy access to programing and joke programs (http://www.rjlsoftware.com/software/entertainment/mousemove/) they can modify, or even create their own to work as intended, including doing malicious things...

BlueZannetti, that's a good tip you've provided.. making precautionary backups is a good idea..

appreciate your concern..

sorry for not clarifying.. If there's any damage done.. physical.. psycological i'll see if i can pay for it :P

WSFuser
February 26th, 2006, 09:41 PM
assuming teh damage is done, then id use either safe mode or follow BlueZanetti's tips. i think PG is installable in safe mode too.

Slovak
February 27th, 2006, 05:34 AM
format c:

trickyricky
February 27th, 2006, 06:51 AM
-{ Quote: "format c:" }-
Indeed. If the system is that infested, a clean start is probably the most sensible solution. Of course, you keep frequent backups, so that option shoudn't be a problem. ;)