Help! My computer is being taken over by my partner!

[Guest]

We have a home network where two computers are linked to one printer and a
router. Suddenly this last week my computer gets "taken over" by my partners,
and whatever he is typing takes over whatever program I am in and types on
the screen. We have tried everything we can to disable it, but can't find the
source. Does anyone have any suggestions of where we can look? I'm using XP
Home version; he's using XP Professional.

 

[Carey Holzman]

You must have some wires crossed somewhere...

Carey

 

[Guest]

You must have some wires crossed somewhere...

Carey

We haven't changed any of the hardware configuration, which has never done
this before. We did have a problem for a while after I installed Service
update pack 2 where I couldn't see the printer (which is attached to my
partner's computer), but that got sorted when we unhid the icons for
networked UPnP devices. I have disallowed sharing of all my folders, but I
suspect it is something where I have given him permission to alter my files
(only can't see where).

 

[Malke]

We haven't changed any of the hardware configuration, which has never
done this before. We did have a problem for a while after I installed
Service update pack 2 where I couldn't see the printer (which is
attached to my partner's computer), but that got sorted when we unhid
the icons for networked UPnP devices. I have disallowed sharing of all
my folders, but I suspect it is something where I have given him
permission to alter my files (only can't see where).

Most peculiar. It sounds as though he's got Remote Desktop on (or is
somehow automatically connecting through a third-party remote control
app like pcAnywhere) but I don't see how that could happen without him
knowing he's doing it.

Start troubleshooting with his machine. Boot it into Safe Mode by
repeatedly tapping F8 as the computer is starting up to get to the
right menu. Once in Safe Mode, do Start>Run msconfig [enter] to see
what programs and processes are starting with his machine. Set it up to
do a clean boot. Here are links to help you with the clean boot and to
identify the items you see with msconfig:

http://support.microsoft.com/default.aspx?kbid=310353 - How to Perform a
Clean Boot in Windows XP
http://www.pacs-portal.co.uk/startup_index.htm
http://www.blackviper.com/
http://www.liutilities.com/products/wintaskspro/processlibrary/

You didn't say, but I assume that your network is wired, using ethernet?
Take him off the network by physically disconnecting the cable to his
nic while you're troubleshooting.

Also, all the usual advice about making sure both computers are 100%
virus and spyware-free applies. Let me know if you need details on how
to accomplish that.

Start with the troubleshooting above and post back with results.

Malke

 

[Guest]

Malke,

We checked what was running on the machine and can't see any programs that
shouldn't be there running. He has not got PCanywhere loaded or running. It
is worrying and is continuing to happen. Any further suggestions for
troubleshooting this?

We haven't changed any of the hardware configuration, which has never
done this before. We did have a problem for a while after I installed
Service update pack 2 where I couldn't see the printer (which is
attached to my partner's computer), but that got sorted when we unhid
the icons for networked UPnP devices. I have disallowed sharing of all
my folders, but I suspect it is something where I have given him
permission to alter my files (only can't see where).

Most peculiar. It sounds as though he's got Remote Desktop on (or is
somehow automatically connecting through a third-party remote control
app like pcAnywhere) but I don't see how that could happen without him
knowing he's doing it.

Start troubleshooting with his machine. Boot it into Safe Mode by
repeatedly tapping F8 as the computer is starting up to get to the
right menu. Once in Safe Mode, do Start>Run msconfig [enter] to see
what programs and processes are starting with his machine. Set it up to
do a clean boot. Here are links to help you with the clean boot and to
identify the items you see with msconfig:

http://support.microsoft.com/default.aspx?kbid=310353 - How to Perform a
Clean Boot in Windows XP
http://www.pacs-portal.co.uk/startup_index.htm
http://www.blackviper.com/
http://www.liutilities.com/products/wintaskspro/processlibrary/

You didn't say, but I assume that your network is wired, using ethernet?
Take him off the network by physically disconnecting the cable to his
nic while you're troubleshooting.

Also, all the usual advice about making sure both computers are 100%
virus and spyware-free applies. Let me know if you need details on how
to accomplish that.

Start with the troubleshooting above and post back with results.

Malke
--
MS MVP - Windows Shell/User
Elephant Boy Computers
www.elephantboycomputers.com
"Don't Panic!"

 

[Guest]

In scouting around both our computers we have found that both computers have
port 1025 open (which Norton identifies as an Unused Windows Services Block).
It may be possible that in some way we are sharing the information via this
port. Do you think this is possible? At any rate, Norton identifies this as a
security risk (inspite of having Norton's firewall turned on to maximum
settings on my machine). But I don't know how to close this port. Any ideas?

 

[Malke]

In scouting around both our computers we have found that both
computers have port 1025 open (which Norton identifies as an Unused
Windows Services Block). It may be possible that in some way we are
sharing the information via this port. Do you think this is possible?
At any rate, Norton identifies this as a security risk (inspite of
having Norton's firewall turned on to maximum settings on my machine).
But I don't know how to close this port. Any ideas?

I have no idea what is going on, but I would do as I originally
suggested:

1. Physically disconnect both machines.
2. Do all the following malware removal steps using updated tools in
Safe Mode. It is a lot of work to make sure both computers are
thoroughly clean, but it is essential in narrowing down the problem.
You simply *must* know that you are working from a clean baseline.

1) Scan in Safe Mode with current version (not earlier than 2003)
antivirus using updated definitions.

2) Remove spyware with Spybot Search & Destroy and Ad-aware. These
programs are free, so use them both since they complement each other.
There is a new version of CWShredder from Intermute. I would not
install the other Intermute programs, however. Alternately, there are
CoolWebSearch malware removal steps at SilentRunners.

Be sure to update these programs before running, and it is a good idea
to do virus/spyware scans in Safe Mode. Make sure you are able to see
all hidden files and extensions (View tab in Folder Options).

HijackThis is an excellent tool to discover and disable hijackers, but
it requires expert skill. See below for HijackThis links. A combination
of HijackThis and About:Buster works well in removing the About:Blank
homepage hijacker. Again, this is an expert tool and novices should get
help with it.

3) If you are running Windows ME or XP, you should disable/enable System
Restore because malware will be in the Restore Points. With ME, you
must disable System Restore completely. With XP, you can delete all but
the most recent (presumably clean) System Restore point from the More
Options section of Disk Cleanup (Run>cleanmgr).

4) Make sure you've visited Windows Update and applied all security
patches. Do not install driver updates from Windows Update.

5) Run a firewall.

Links to help with malware:

Software/Methods:
http://www.safer-networking.org - Spybot Search & Destroy
http://www.lavasoftusa.com - Ad-aware
http://www.majorgeeks.com - good download site
http://www.intermute.com/spysubtract/cwshredder_download.html
http://www.silentrunners.org/sr_cwsremoval.html. - SilentRunners

HijackThis:
http://www.aumha.org/a/hjttutor.htm - HijackThis tutorial by Jim
Eshelman
http://spywarewarrior.com/viewforum.php?f=5 - Spyware Warrior HijackThis
forum
http://www.wilderssecurity.com/
http://forums.tomcoyote.org/
http://www.spywareinfo.com/forums/

General:
http://forum.aumha.org/ - look under "Security" for various forums
http://rgharper.mvps.org/cleanit.htm
http://mvps.org/winhelp2002/unwanted.htm
http://www.aumha.org/a/parasite.htm - The Parasite Fight
http://www.spywarewarrior.com/rogue_anti-spyware.htm

After you've done the above to ensure that both computers are 100%
spyware and virus-free, you can bring the network up again. However, do
not bring the network up or go on line without a firewall in place. You
will need to enter your home network IP range as Trusted in the
firewall's Exceptions. How you do this will depend on the firewall
used.

Malke

 

[Malke]

I had another thought, although I still think you need to be sure the
computers are clean. Try making a new user account on his machine; you
could name it something like "Test". Then log him out - don't just use
Fast User Switching - and log in as the new account. I don't know if
it's necessary, but it wouldn't hurt for you to reboot your machine and
relog in as yourself. See if the same behavior on your machine starts
when you do things on the Test account on his machine. If it doesn't,
then you know it's definitely something about his account. That should
help narrow down the cause.

Malke

 

[Guest]

Malke,

We think we've identified the source of the problem -- it's not the network,
because the keystrokes still appear on my screen when physically disconnected
from both the ethernet and the internet. We both have wireless MS keyboards
and mice, and this is what we think is doing it. I am in one office (the
front bedroom) and he is in the other (in the back bedroom). His transmitting
keyboard has not been moved, neither has my receiving device. The really
weird thing is that when we switch keyboards, I then start transmitting my
keystrokes on HIS machine. Any ideas (short of one of us getting a
nonwireless keyboard)?

 

[Malke]

Malke,

We think we've identified the source of the problem -- it's not the
network, because the keystrokes still appear on my screen when
physically disconnected from both the ethernet and the internet. We
both have wireless MS keyboards and mice, and this is what we think is
doing it. I am in one office (the front bedroom) and he is in the
other (in the back bedroom). His transmitting keyboard has not been
moved, neither has my receiving device. The really weird thing is that
when we switch keyboards, I then start transmitting my keystrokes on
HIS machine. Any ideas (short of one of us getting a nonwireless
keyboard)?

I'm so glad you posted back. I've wondered about you and your mysterious
problem. You've solved it, Sherlock. I don't know if the problem is a
function of having two wireless keyboards of the same brand or there is
something wrong with your particular device. Maybe one of you could try
a different brand wireless keyboard and see if that takes care of the
problem.

Thank you so much for coming back with the answer.

Good luck,

Malke

 

[Leythos]

Malke,

We think we've identified the source of the problem -- it's not the network,
because the keystrokes still appear on my screen when physically disconnected
from both the ethernet and the internet. We both have wireless MS keyboards
and mice, and this is what we think is doing it. I am in one office (the
front bedroom) and he is in the other (in the back bedroom). His transmitting
keyboard has not been moved, neither has my receiving device. The really
weird thing is that when we switch keyboards, I then start transmitting my
keystrokes on HIS machine. Any ideas (short of one of us getting a
nonwireless keyboard)?

Yea, it's working like it's suppose to work. You can't switch keyboards
once they've made a connection to the wireless dongle at the computer
and expect it to just start working on the nearest dongle.

In order to switch where the keyboard is communicating, you have to
reset the dongle and keyboard so that they work with each other only -
they use a keying method so that two people sitting in the same room
don't interfere with each other. We have an office full of wireless
keyboards and mice, as long as you reset it you're going to be fine.

There should be a small reset button (you'll need a pen to get it) on
each device (in most cases) and you'll both have to reset in order to
not cause problems.

Why in the world would you trade keyboards?