Ticket Options

Question Details

TICKET ARCHIVE -> Odd Behavior: Cursor moving around by itself...

sunporchct - Jan 3, 2006 - 5:01 pm

System:
iMac G5 running OS X 10.3.9 Panther
Connected to work LAN, behind NetGear Firewall

Geek (me):
20 years pc/windows experience
1 year mac osx experience (very limited, only assist others with the macs, don't use one daily)
4 years unix experience 20 years ago (in school).

users:
business/sales staff

Observations:
periodically (either around every 10 minutes, or after some activity, not sure which) - the mouse cursor moves around the screen, generally from where it is up and to the left, clicks a few times, moves back down and to the right, repeats a few times, clicks a few times, and stops.
This behavior repeated identically each time I observed it, and I observed it about 10 times over the course of an hour or so.
In looking around, it appeared that there were 2 copies of MSN Messenger in the startup items, as well as the Microsoft AutoUpdate Daemon.

Things I tried to stop the behavior:
:dicsonnected from network - no change
:closed ms explorer, safari, acrobat pro - no change
:ran ps -alx a few times and saved to a file. - no change (of course).
:closed MSN messenger
:restarted machine - no change
:killed Microsof AU Daemon, so far it hasn't returned.

Questions:
Has anyone seen this? Is there any known explanation? Is it known behavior for malware? Is there any known diagnostic that can track it down?

Comments:
This sure sounds like a hoax program intended to goof on the user. Our user is not aware of anything they did that specifically could have caused this behavior.

Any help with a method for eradicating this is appreciated.

Thanks,
-james mcfarland
sunporch structures.

ishan - Jan 3, 2006 - 7:51 pm

Launch the Activity Monitor application in your Utilities folder and when you notice this activity with the cursor, see what processes are running. Do any of them look odd, i.e., third party? This is either an Applescript or Automator script which runs periodically or someone controlling the cursor via Apple Remote Desktop (but you said the behavior persisted even off the network, so that's not likely). There's no malware to speak of on the Macintosh.

A guaranteed way to get rid of this behavior is to do a fresh install of the OS after backing up irreplaceable files.

Also, you may want to check in your Accounts prefpane and see what Login Items are listed. If anything nonessential is running, delete it.

HTH and please let us know what happens.