Windows 7 mouse cursor moves by itself

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by tailah0731, Nov 26, 2014.

  1. tailah0731

    tailah0731 Private E-2

    About 2 weeks or so ago I started having issues with my mouse moving however it pleased. If I was typing it would move after each letter faster than I could type all the way back to the farthest position to the left. If I tried to open a folder or file, same deal. Cursor moved to the uppermost file. It's immensely frustrating. I read the post above and downloaded the removal tools listed on the thread for Brazstar and I have my logs. 2 of the 4 programs found nothing, but RogueKiller and HitmanPro found a lot of malware. I did as instructed and did nothing about deleting or quarantining. I ignored them and saved the logs. Just trying to log into something is a nightmare as it moves my cursor as I type in the wrong direction. Please help. I can't get anything done this way.
     

    Attached Files:

  2. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    Despite this fact, you need to attach ALL of the requested logs. Thanks.
     
  3. tailah0731

    tailah0731 Private E-2

    I have the Malwarebytes report but the directions said not to save a report if no threats were found on tdsskiller.
     

    Attached Files:

  4. tailah0731

    tailah0731 Private E-2

    Should I scan again with tdsskiller and save the log? Thanks.
     
  5. tailah0731

    tailah0731 Private E-2

    Kestrel, I'm so sorry. Apparently I ignored the directions and saved it anyway. It was in my recycle bin. It's been a long day.
     
  6. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Just complete all the instructions all the way thru and including MGtools and attach the logs. While your first logs did show some junkware, it is not likely these are causing your problems with the mouse. 99.9% of the time these kinds of issues have been hardware related not malware.
     
  7. tailah0731

    tailah0731 Private E-2

    I apologize. Please see the attached log for MGTools. I don't think I missed anything this time. It looked like the tdsskiller log didn't go through the last time so I saved it as a txt file instead. I tried to update my mouse driver and it said I had the most current driver already. I tried slowing cursor speed and that did nothing either. Thank you for your help.
     

    Attached Files:

  8. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You're welcome.

    Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista or Win 7, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1:9421;<local>
    O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
    O2 - BHO: Trend Micro Toolbar BHO - {43C6D902-A1C5-45c9-91F6-FD9E90337E18} - (no file)
    rtual_keyboard_plugin.dll
    O2 - BHO: (no name) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - (no file)
    O18 - Protocol: tmtb - {04EAF3FB-4BAC-4B5A-A37D-A1CF210A5A42} - (no file)


    After clicking Fix, exit HJT.


    Please download OTM by Old Timer and save it to your Desktop.
    • Run OTM.exe by double clicking on it (Note: if using Vista, Win7 or Win8, don't double click, use right click and select Run As Administrator).
    • Copy the lines from the below codebox to the clipboard by highlighting ALL of them and pressing CTRL + C
      (or, after highlighting, right-click and choose Copy): Do not include the word Code: which is just a title line of
      the code box
    Code:
    :Processes
    explorer.exe
    
     
    :Files
    C:\Program Files (x86)\Conduit
    C:\Users\Tammy\AppData\Local\Conduit
    C:\Users\Tammy\AppData\Local\Cool_Mirage
    C:\Users\Tammy\AppData\LocalLow\Conduit
    C:\Users\Tammy\AppData\Roaming\Mozilla\Firefox\Profiles\krv47qyu.default\smartbar
    C:\Windows\TEMP\*.*
    C:\Users\Tammy\AppData\Local\Temp\*.*
    
    :Reg
    [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{18B9B16E-716F-43DF-A6AD-512C7D2EB983}]
    [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{C007DADD-132A-624C-088E-59EE6CF0711F}]
    [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{43969E3F-3E7C-4911-A8F1-79C6CA6AC731}]
    [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C815E3DA-0823-49B0-9270-D1771D58B317}]
    [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{EE95078D-518C-4FD2-8093-FD1D4E33D3CA}]
    [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\AppID\{18B9B16E-716F-43DF-A6AD-512C7D2EB983}]
    [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\AppID\{C007DADD-132A-624C-088E-59EE6CF0711F}]
    [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3c471948-f874-49f5-b338-4f214a2ee0b1}]
    [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7E84186E-B5DE-4226-8A66-6E49C6B511B4}]
    [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{80922ee0-8a76-46ae-95d5-bd3c3fe0708d}]
    [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FE9271F2-6EFD-44b0-A826-84C829536E93}]
    [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{43969E3F-3E7C-4911-A8F1-79C6CA6AC731}]
    [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C815E3DA-0823-49B0-9270-D1771D58B317}]
    [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EE95078D-518C-4FD2-8093-FD1D4E33D3CA}]
    [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{62155D33-3CE2-401E-8967-5A270628A3D5}]
    [-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Conduit]
    [-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{62155D33-3CE2-401E-8967-5A270628A3D5}]
    [-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}]
    [-HKEY_USERS\S-1-5-21-2336601722-4126326798-2071301291-1000\Software\AppDataLow\Software\SmartBar]
    [-HKEY_USERS\S-1-5-21-2336601722-4126326798-2071301291-1000\Software\Conduit]
    [-HKEY_USERS\S-1-5-21-2336601722-4126326798-2071301291-1000\Software\iLivid\ (iLivid)
    [-HKEY_USERS\S-1-5-21-2336601722-4126326798-2071301291-1000\Software\Microsoft\Internet Explorer\SearchScopes\{3BD44F0E-0596-4008-AEE0-45D47E3A8F0E}]
    [-HKEY_USERS\S-1-5-21-2336601722-4126326798-2071301291-1000\Software\Microsoft\Internet Explorer\SearchScopes\{4B81C3A0-99D3-49DB-992D-1AEB4D29557C}]
    [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}]
    [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{43C6D902-A1C5-45c9-91F6-FD9E90337E18}]
    [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FDAD4DA1-61A2-4FD8-9C17-86F7AC245081}]
    [-HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{0BC6E3FA-78EF-4886-842C-5A1258C4455A}]
    [-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{0BC6E3FA-78EF-4886-842C-5A1258C4455A}]
    [-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{4B81C3A0-99D3-49DB-992D-1AEB4D29557C}]
    :Commands
    [purity]
    [EmptyTemp]
    [start explorer]
    [Reboot]
    • Return to OTM, right click in the Paste List of Files/Folders to Move window (under the yellow bar
      ) and choose Paste.
    • Now click the large [​IMG] button.
    • If OTM asks to reboot your computer, allow it to do so. The report should appear in Notepad after the reboot.
    • Close OTM.
    Now navigate to the C:\_OTM\MovedFiles folder ( assuming your Windows drive is C). This is where your log will be
    saved in the form of Date and Time mmddyyyy_hhmmss.log. Just look for the most recent .log file. Attach
    this log file to your next message.

    Now please download Junkware Removal Tool to your desktop.
    • Shut down your protection software now to avoid potential conflicts.
    • Run the tool by double-clicking it. If you are using Windows Vista or Seven, right-mouse click it and select Run as Administrator.
    • The tool will open and start scanning your system.
    • Note: That JRT may reset your home page to a google default so you will need to restore your home page setting if this happens.
    • Please be patient as this can take a while to complete depending on your system's specifications.
    • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
    • Attach JRT.txt to your next message.
    Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, Win7 or Win8, don't double click, use right click and select Run As Administrator).

    Then attach the below logs:
    • the C:\_OTM\MovedFiles log
    • the JRT.TXT log
    • C:\MGlogs.zip
    Make sure you tell me how things are working now!
     
  9. tailah0731

    tailah0731 Private E-2

    I'm sorry to say my computer is still doing the possessed mouse trick. One of the files below MGTools didn't have listed. It was this one:
    rtual_keyboard_plugin.dll

    I checked the list 4 times for it and it wasn't there.

    Also, I searched my computer for file C:\_OTM\MovedFiles log and could find it nowhere. However I had a new file, the only extra file on my desktop that is unaccounted for, procdll.txt.

    I don't know if this helps but there is one other weird thing my computer has been doing. It does it only during a reboot. When the computer is rebooted after the Dell logo comes up on the screen my computer will make a really loud beeping noise. If I press the Shift key or the NumLk key 2 or 3 times it stops and continues to reboot normally, except it has been kind of loud about it lately. The fan makes a lot of noise now. It's not non-stop, just at first and off and on sometimes, depending on what I am doing.

    Thanks so much for your help.
     

    Attached Files:

  10. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Yes as expected because as I stated earlier, your problem is not due to malware.

    It is right where stated. I can see the below in your MGlogs.zip file
    Code:
    -c--a-w            12,436 2014-11-27 18:16:10  C:\_OTM\MovedFiles\11272014_121607.log
    But we don't need it now as what we wanted to fix was fixed. I suggest that you post about your mouse problems in the Software Forum but first I would try a new mouse and also a different USB port.

    Sounds like a hardware problem so again this could be a reason for your problem.
     
    Last edited: Nov 27, 2014
  11. tailah0731

    tailah0731 Private E-2

    Thank you so much for all your help. I tried changing mice several times but I never changed the USB port. I changed the mouse and the port and it seems fine so far. Thanks again so very much.
     
  12. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You're welcome.


    If you are not having any other malware problems, it is time to do our final steps:
    1. We recommend you keep Malwarebytes Anti-Malware for scanning/removal of malware.
    2. Renable your Disk Emulation software with Defogger if you had disabled it in step 4 of the READ & RUN ME.
    3. Go to add/remove programs and uninstall HijackThis. If you don't see it or it will not uninstall, don't worry about it. Just move on to the next step.
    4. If running Vista, Win 7 or Win 8, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    5. Now goto the C:\MGtools folder and find the MGclean.bat file. Double click ( if running Vista, Win7, or Win 8 Right Click and Run As Administrator ) on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.
    6. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    7. If you are running Win 8, Win 7, Vista, Windows XP or Windows ME, do the below to flush restore points:
      • Refer to the instructions for your WIndows version in this link: Disable And Enable System Restore
      • What we want you to do is to first disable System Restore to flush restore points some of which could be infected.
      • Then we want you to Enable System Restore to create a new clean Restore Point.
    8. After doing the above, you should work thru the below link:
     
  13. tailah0731

    tailah0731 Private E-2

    Thanks so much, Chaslang. :)
     
  14. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You're welcome. Surf safely!
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds