Undetectable Virus

[tjg79 3]

I'm running Windows 10 Pro 64-bit on a new HP Spectre x360 and ESET Smart Security Premium.

I was hit yesterday with a virus that can't be detected by ESET Smart Security and Windows Defender.

The virus was active when my new HP Laptop was and wasn't connected to the internet.

The virus made the mouse cursor act erratic and was moving all by itself.

It was changing the magnification of my Firefox browser, minimizing it and causing the browser to shimmy back and forth.

The virus was moving icons on the desktop, changed the desktop theme, and opening items in the start menu.

I attempted to purge it from the system with out success.

I disabled the synaptics touch pad, changed the mouse cursor settings, completed disk cleanups with Windows Disk Cleanup and CCleaner, etc..., without success.

I've run Windows Defender in Offline Scan mode and ESET Online scan and nothing was detected.

After several actions to remove the virus, I though I was successful, only to be disappointed a while later when my system started acting erratic again.

I ran Windows Defender Offline Scan last night and shut the system down. So far today, it hasn't started again, but since nothing was detected, I suspect it will return.

I called ESET Support USA and they helped change the ESET settings to perform a more complete scan, but again, nothing was detected.

Do you have any suggestions?

Regards

Edited January 2, 2020 by tjg79

[local 0]

1 hour ago, tjg79 said:

Do you have any suggestions?

Scan with Malwarebytes free or Hitman Pro

[itman 1,659]

Might be Mouse Hunt adware but that is only a guess. Open Win Task Manager and see if mouse.exe is running.

[tjg79 3]

9 minutes ago, itman said:

Might be Mouse Hunt adware but that is only a guess. Open Win Task Manager and see if mouse.exe is running.

I don't see mouse.exe running, but my system isn't acting up at the moment. If it starts again, I'll check again.

Thanks for the tip.

[tjg79 3]

34 minutes ago, local said:

Scan with Malwarebytes free or Hitman Pro

I'll try that if I can do an online scan without having to remove ESET.

Thanks for the tip.

[tjg79 3]

I just ran Hitman Pro and no threats were detected.

[Marcos 5,070]

Could be a hw issue as well. Does the issue occur if you start Windows in safe mode? And what if you boot from a live Linux usb?

[tjg79 3]

I couldn't get into safe mode to check. I don't think it was a hw issue. It behaved just like a virus. It controlled the mouse cursor such that it was a challenge to run programs or try to clean the system.

My system appears to be ok today, but I fully expect a return, because nothing was ever detected.

[itman 1,659]

HP is infamous for installing crud software on new PCs at the factory.

First thing I would check is if HP is using their driver/software for the mouse versus using Win 10 built-in driver/software.

[tjg79 3]

It's got a Microsoft mouse driver installed. I removed all the blotware except for the Microsoft and HP items.

[tjg79 3]

Well, the virus returned and started changing the zoom on my Firefox browser rapidly back and forth from 120% to 140%. The mouse cursor was acting erratic as well. I started an in-depth scan and contacted ESET USA telephone support. The scan ended with out any viruses detected. ESET chat support took control of the desktop and ran some tests, but indicated that there was no malicious software detected as well. 

I expect the virus to return.

Edited January 2, 2020 by tjg79

[itman 1,659]

Use IE11 or Edge for a while and see if this same erratic browser behavior appears in those. If it doesn't, I would say you have an adware/malicious extension installed in FireFox.

[tjg79 3]

The only add-on I've got installed on Firefox is AdblockPlus.

But, the mouse was acting erratic with the browsers closed when this all started.

Edited January 3, 2020 by tjg79

[Hpoonis 7]

Is it not possibe to just install a vanilla Win10 these days?  Using the HP Win10 key and activate using the phone should work.

[peteyt 393]

Sounds odd but are any of your keys stuck as I remember weird stuff happening once because a key on my keyboard was stuck down, probably not this but just wondering. It sounds odd because if it was a virus I'd expect it to do lasting damage e.g. changing settings, removing things etc.

As itman suggested maybe run the pc in safe mode for a while to see if it happens there. You mentioned you couldn't get into it. Did you follow the guide at https://support.microsoft.com/en-us/help/12376/windows-10-start-your-pc-in-safe-mode

If you have came from a previous version of windows you might find it odd as safe mode is accessed slightly differently 

[Patch 16]

What versions of firefox?

I suspect the current firefox is corrupting keyboard / mouse input on one of my computers also. Started after upgrading firefox to the current version.

But perhaps I will need to run Firefox is safe mode and do hardware testing prior to jumping to conclusions.

Edited January 3, 2020 by Patch

[itman 1,659]

Mouse hardware can be defective; even on a new device from the factory. To rule out that possibility, connect another mouse from another PC you have or borrow one temporarily from a relative/friend. Shutdown your PC. Disconnect your existing HP mouse and connect the other mouse. Upon startup of the HP, it will auto recognize the new mouse. Perform normal activities with that mouse including Firefox browsing for a while. If no mouse issues arise, your mouse issue is due to bad hardware.

I suspect your mouse issues are hardware related. I state this because you have stated there are intervals when using the HP where you posted you were not having any mouse related issues. This type of sporadic behavior is symptomatic of failing hardware.

Finally, mouse hardware issues are very difficult to identify since they do manifest with periodic erratic behavior followed by periods with no issues arising. A failing/defective mouse can actually totally lock up a PC.

-EDIT- Appears this PC is a notebook. Assuming are using the built-in mouse pad/buttons, you will have to connect either a USB or wireless mouse to the notebook to test with.

Also do a Google search on this "HP Spectre x360 mouse issues." Multiple HP based postings on it in regards to erratic mouse behavior with various HP recommend fixes. One of the more promising "fixes" is to disable the HP pen driver via Win device manager: https://smithtalkstech.com/2018/03/31/hp-spectre-x360-mouse-cursor-freakout-bug-solved/

Edited January 3, 2020 by itman

[mxp 0]

15 hours ago, tjg79 said:

Well, the virus returned and started changing the zoom on my Firefox browser rapidly back and forth from 120% to 140%. The mouse cursor was acting erratic as well. I started an in-depth scan and contacted ESET USA telephone support. The scan ended with out any viruses detected. ESET chat support took control of the desktop and ran some tests, but indicated that there was no malicious software detected as well. 

I expect the virus to return.

sounds very much like a malfunctioning hardware. have you tried using a different mouse already?

[tjg79 3]

8 hours ago, Hpoonis said:

Is it not possibe to just install a vanilla Win10 these days?  Using the HP Win10 key and activate using the phone should work.

The HP laptop came with Win 10 Home 64-bit. I upgraded via the MS store to Win 10 Pro 64-bit. The upgrade is just a change of key.

I don't think the installed OS is very much different than plain vanilla Win 10 Pro 64-bit.

[tjg79 3]

6 hours ago, peteyt said:

Sounds odd but are any of your keys stuck as I remember weird stuff happening once because a key on my keyboard was stuck down, probably not this but just wondering. It sounds odd because if it was a virus I'd expect it to do lasting damage e.g. changing settings, removing things etc.

As itman suggested maybe run the pc in safe mode for a while to see if it happens there. You mentioned you couldn't get into it. Did you follow the guide at https://support.microsoft.com/en-us/help/12376/windows-10-start-your-pc-in-safe-mode

If you have came from a previous version of windows you might find it odd as safe mode is accessed slightly differently 

It's new hardware and the keyboard is in perfect condition. The is a replacement HP Laptop, because my original had a bad key that felt as though something was stuck under the lower left corner of the key.

It was changing settings. It changed my desktop background. The way the mouse cursor was behaving, it gave all the indications of a virus.

The virus wouldn't let me change anything when it was in hyper-active mode. It took some effort just to reboot the system with the internet disconnected.

I'm still not totally comfortable with Win 10. My Win 10 learning curve is still steep.

[tjg79 3]

6 hours ago, Patch said:

What versions of firefox?

I suspect the current firefox is corrupting keyboard / mouse input on one of my computers also. Started after upgrading firefox to the current version.

But perhaps I will need to run Firefox is safe mode and do hardware testing prior to jumping to conclusions.

Firefox Browser 71.0 (64-bit).

I'm not ruling out a bad program or browser.

Although, when the virus was active, I switched to the Microsoft Edge browser, and still had the virus activity.

[tjg79 3]

4 hours ago, itman said:

Mouse hardware can be defective; even on a new device from the factory. To rule out that possibility, connect another mouse from another PC you have or borrow one temporarily from a relative/friend. Shutdown your PC. Disconnect your existing HP mouse and connect the other mouse. Upon startup of the HP, it will auto recognize the new mouse. Perform normal activities with that mouse including Firefox browsing for a while. If no mouse issues arise, your mouse issue is due to bad hardware.

I suspect your mouse issues are hardware related. I state this because you have stated there are intervals when using the HP where you posted you were not having any mouse related issues. This type of sporadic behavior is symptomatic of failing hardware.

Finally, mouse hardware issues are very difficult to identify since they do manifest with periodic erratic behavior followed by periods with no issues arising. A failing/defective mouse can actually totally lock up a PC.

-EDIT- Appears this PC is a notebook. Assuming are using the built-in mouse pad/buttons, you will have to connect either a USB or wireless mouse to the notebook to test with.

Also do a Google search on this "HP Spectre x360 mouse issues." Multiple HP based postings on it in regards to erratic mouse behavior with various HP recommend fixes. One of the more promising "fixes" is to disable the HP pen driver via Win device manager: https://smithtalkstech.com/2018/03/31/hp-spectre-x360-mouse-cursor-freakout-bug-solved/

I'm using a new Bluetooth rechargeable mouse and I'm not using the Synaptics touch-pad. Yes, this machine is a notebook pc.

I don't have another mouse at the moment to use for troubleshooting.

My system is perfectly stable at the moment. I'll report if it starts trouble today.

I'm not using the HP pen driver. I don't use this notebook in tablet mode.

But, these other options could be causing problems. If my system starts acting up today, I'll disable the pen driver.

I've had this notebook for about six weeks. It's otherwise been flawless.

One think I dislike about Win 10 is updates. You don't have the control over updates as you did in Win 7.

It's very possible to get a bad update, not know when it was installed, and start noticing system problems.

That's one of the reasons why I've avoided Win 10 until now.

Edited January 3, 2020 by tjg79

[ram1220 3]

You had a suggestion to run Malwarebytes. Did you ever run it? Malwarebytes can find malware that Eset can not find. Have you had anyone remote into your laptop recently? If no and you do not have malware then you have a hardware issue. I would return/exchange the laptop.

[tjg79 3]

I haven't run Malwarebytes yet. I did run Hitman Pro and nothing was detected. As I indicated above, ESET USA Support remoted my desktop and ran some tests that didn't indicate any malware.

From my internet searches, I'm suspecting the Firefox browser install.

I had a momentary episode today were something was opening tabs, minimizing the browser, etc...

Whatever it is, I don't think it's hardware, because of they types of actions and random frequency of the episodes.

I'll run Malwarebytes just to eliminate the possibility. I think I'll also uninstall and reinstall Firefox.

Thanks for the tip.

[tjg79 3]

I just ran Malwarebytes. No detection of malware with Malwarebytes.