Very odd..

Chives · 18 Dec 2010 at 13:55

Going through my pictures earlier and discovered a folder called "screenshots" and in there is a load of screenshot which I have not taken, they are just screenshots of me writing on here, using msn, playing games ect. How can I stop it and more importantly why is it happening, I have done a virus scan..
Anyway, I deleted them and went back in a few hours later and yes there where more screenshots taken in the last 3 hours..

gillywibble · 18 Dec 2010 at 14:38

What apps are running? Sounds like you've got something going in the background.

Chives · 18 Dec 2010 at 14:45

These are all the processes I have running.

gillywibble · 18 Dec 2010 at 14:48

The only one that looks remotely like it might be involved is snippingtool.exe. Check what settings it has.

Chives · 18 Dec 2010 at 14:49

gillywibble said:
The only one that looks remotely like it might be involved is snippingtool.exe. Check what settings it has.

Thats what I used to take the picture

, isn't usually running.

gillywibble · 18 Dec 2010 at 14:51

Chives said:
Thats what I used to take the picture , isn't usually running.

Don't know then

What's in msconfig?

Lakeland · 18 Dec 2010 at 14:51

Parents checking up on you tbh

Chives · 18 Dec 2010 at 14:53

Lakeland said:
Parents checking up on you tbh

As unlikely as that would be, the computer is passworded so they have no way of accessing it

Chives · 18 Dec 2010 at 14:56

List of proccesses set to launch when windows starts, anything else you need to see?

Pho · 18 Dec 2010 at 14:58

Sounds a bit odd. Sure someone isn't spying on you?

I'd try using Proess Monitor. Go to filter > filter and add a new filter for path contains screenshots. Make sure you click on add:

Then click ok. Leave it going for a while and hopefully when something tries to write to/read from that folder it'll show up here. Keep in mind explorer will show up here if you are browsing the folder in explorer so you can probably ignore it.

gillywibble · 18 Dec 2010 at 14:59

Chives said:
List of proccesses set to launch when windows starts, anything else you need to see?

Can you extend the left hand field so we can see all the names?

Chives · 18 Dec 2010 at 15:00

Pho said:
Sounds a bit odd. Sure someone isn't spying on you?

I'd try using Proess Monitor. Go to filter > filter and add a new filter for path contains screenshots. Make sure you click on add:

Then click ok. Leave it going for a while and hopefully when something tries to write to/read from that folder it'll show up here. Keep in mind explorer will show up here if you are browsing the folder in explorer so you can probably ignore it.

Will try this, thanks.

gillywibble said:
Can you extend the left hand field so we can see all the names?

Nope, won't let me.
I have taken the precaution of taking the computer out of the local network sharing area for now..

Destination · 18 Dec 2010 at 15:02

Well if you've taken it out you won't find out who is spying on you.

Destination · 18 Dec 2010 at 15:03

When you say you ran a virus scan was that using bullguard?

Download and install malwarebytes and run that when you autoupdate it, if you haven't alreayd done so, report back with findings.

You might have a remote access program running, which won't show as a virus. Try mbam anyway.

Chives · 18 Dec 2010 at 15:08

Chives · 18 Dec 2010 at 15:09

Hikari Kisugi said:
Well if you've taken it out you won't find out who is spying on you.

Put it back in.

Hikari Kisugi said:
When you say you ran a virus scan was that using bullguard?

Download and install malwarebytes and run that when you autoupdate it, if you haven't alreayd done so, report back with findings.

You might have a remote access program running, which won't show as a virus. Try mbam anyway.

Yes it was.
Will run malwarebytes now

Pho · 18 Dec 2010 at 15:18

Chives said:

Right, that makes it a bit more complex because svchost could be lots of things.

Try Process Explorer (it's like super task manager

) and look for the process with PID 976 or 1728 (you'll notice it matches up to the PID in ProcMon which seems to be creating the files - this might change so you might have to look for a different PID).

If you double-click the process in Process Explorer for the PID and go to the services tab it should give you some information about what it is behind it.

Chives · 18 Dec 2010 at 15:25

PID 1728 shows up as Bullguard.

Pho · 18 Dec 2010 at 15:35

Hmm I'm not too sure. Either I didn't pick the right process writing those screenshots or it's something I'm missing :/.

Unless Bullguard has some odd auto-screenshot feature?

Chives · 18 Dec 2010 at 15:37

Pho said:
Hmm I'm not too sure. Either I didn't pick the right process writing those screenshots or it's something I'm missing :/.

Unless Bullguard has some odd auto-screenshot feature?

No, I have only just got bull guard in the last few days, before I had norton (Don't ask , dad forced me to have it.), it has been happening since October, I tried to stop it then and failed and so today I decided to make thread here and find out what it is and how to stop it.