Windows xp remote control

Hello there
administrating a network of 400 PCs running XP.
3 Cases in which somebody controlled a user machine remotely, mouse moving
user watching!
the connect remotely is not enabled, but the remote assistance is.
Norton antivirus is installed on all machines and updated.
is there any vulnerability that can do that?
which software if not the MSN?
Your replies are highly appreciated.
Regards
Sameh

Robert
Sun Nov 30 07:15:34 CST 2003

Sameh Ahmed wrote:
> Hello there
> administrating a network of 400 PCs running XP.
> 3 Cases in which somebody controlled a user machine remotely, mouse
> moving user watching!
> the connect remotely is not enabled, but the remote assistance is.
> Norton antivirus is installed on all machines and updated.
> is there any vulnerability that can do that?
> which software if not the MSN?

There is *no end* of software out there that can do this. WinVNC springs to
mind but there are many many other things that can do this. Rather than us
listing them all and missing a few, I'd strongly suggest that what you need
to do is take an afflicted machine out of service for a few days and compare
it to your "standard" build and see what different processes are running,
and go from there.


--
--
Rob Moir
Microsoft MVP for servers & security
http://www.robertmoir.co.uk
"802.11bofh - the *other* power over ethernet standard"

David
Sun Nov 30 14:40:48 CST 2003

It is worth checking that this isn't a mouse-related practical joke.

It is pretty easy to connect a second mouse, or even just switch mice.

David

"Sameh Ahmed" <essoplus@hotmail.com> wrote in message
news:O676vbztDHA.1996@TK2MSFTNGP12.phx.gbl...
> Hello there
> administrating a network of 400 PCs running XP.
> 3 Cases in which somebody controlled a user machine remotely, mouse moving
> user watching!
> the connect remotely is not enabled, but the remote assistance is.
> Norton antivirus is installed on all machines and updated.
> is there any vulnerability that can do that?
> which software if not the MSN?
> Your replies are highly appreciated.
> Regards
> Sameh
>
>

Sameh
Sun Nov 30 21:26:31 CST 2003

wish it was
happened on three different computers.
the network is completely isolated so at least it's not from the internet
also
it's an internal attack!
the bad thing is that the computers are totally virus free no Trojan and no
softwares installed that might be an agent or a server!
any ideas?
regards
thanks everybody
"David Barnard" <msdn.newsgroups@didactylos.net> wrote in message
news:#BKzaJ4tDHA.560@TK2MSFTNGP11.phx.gbl...
> It is worth checking that this isn't a mouse-related practical joke.
>
> It is pretty easy to connect a second mouse, or even just switch mice.
>
> David
>
> "Sameh Ahmed" <essoplus@hotmail.com> wrote in message
> news:O676vbztDHA.1996@TK2MSFTNGP12.phx.gbl...
> > Hello there
> > administrating a network of 400 PCs running XP.
> > 3 Cases in which somebody controlled a user machine remotely, mouse
moving
> > user watching!
> > the connect remotely is not enabled, but the remote assistance is.
> > Norton antivirus is installed on all machines and updated.
> > is there any vulnerability that can do that?
> > which software if not the MSN?
> > Your replies are highly appreciated.
> > Regards
> > Sameh
> >
> >
>
>

Bill
Mon Dec 01 21:09:51 CST 2003

Wireless mice/keyboards?

"Sameh Ahmed" <essoplus@hotmail.com> wrote in message
news:%23iYmNr7tDHA.1088@tk2msftngp13.phx.gbl...
> wish it was
> happened on three different computers.
> the network is completely isolated so at least it's not from the internet
> also
> it's an internal attack!
> the bad thing is that the computers are totally virus free no Trojan and
no
> softwares installed that might be an agent or a server!
> any ideas?
> regards
> thanks everybody
> "David Barnard" <msdn.newsgroups@didactylos.net> wrote in message
> news:#BKzaJ4tDHA.560@TK2MSFTNGP11.phx.gbl...
> > It is worth checking that this isn't a mouse-related practical joke.
> >
> > It is pretty easy to connect a second mouse, or even just switch mice.
> >
> > David
> >
> > "Sameh Ahmed" <essoplus@hotmail.com> wrote in message
> > news:O676vbztDHA.1996@TK2MSFTNGP12.phx.gbl...
> > > Hello there
> > > administrating a network of 400 PCs running XP.
> > > 3 Cases in which somebody controlled a user machine remotely, mouse
> moving
> > > user watching!
> > > the connect remotely is not enabled, but the remote assistance is.
> > > Norton antivirus is installed on all machines and updated.
> > > is there any vulnerability that can do that?
> > > which software if not the MSN?
> > > Your replies are highly appreciated.
> > > Regards
> > > Sameh
> > >
> > >
> >
> >
>
>
>

Sameh
Tue Dec 02 02:44:53 CST 2003

nah:(
checked!
Thanks for caring to reply anyway:)

"Bill Sanderson" <Bill_Sanderson@msn.com.plugh.org> wrote in message
news:eluYDHIuDHA.3196@TK2MSFTNGP11.phx.gbl...
> Wireless mice/keyboards?
>
> "Sameh Ahmed" <essoplus@hotmail.com> wrote in message
> news:%23iYmNr7tDHA.1088@tk2msftngp13.phx.gbl...
> > wish it was
> > happened on three different computers.
> > the network is completely isolated so at least it's not from the
internet
> > also
> > it's an internal attack!
> > the bad thing is that the computers are totally virus free no Trojan and
> no
> > softwares installed that might be an agent or a server!
> > any ideas?
> > regards
> > thanks everybody
> > "David Barnard" <msdn.newsgroups@didactylos.net> wrote in message
> > news:#BKzaJ4tDHA.560@TK2MSFTNGP11.phx.gbl...
> > > It is worth checking that this isn't a mouse-related practical joke.
> > >
> > > It is pretty easy to connect a second mouse, or even just switch mice.
> > >
> > > David
> > >
> > > "Sameh Ahmed" <essoplus@hotmail.com> wrote in message
> > > news:O676vbztDHA.1996@TK2MSFTNGP12.phx.gbl...
> > > > Hello there
> > > > administrating a network of 400 PCs running XP.
> > > > 3 Cases in which somebody controlled a user machine remotely, mouse
> > moving
> > > > user watching!
> > > > the connect remotely is not enabled, but the remote assistance is.
> > > > Norton antivirus is installed on all machines and updated.
> > > > is there any vulnerability that can do that?
> > > > which software if not the MSN?
> > > > Your replies are highly appreciated.
> > > > Regards
> > > > Sameh
> > > >
> > > >
> > >
> > >
> >
> >
> >
>
>