Malware

I was reading my email, logged in on my account non-administrator acct and the mouse started acting as if I wasn't controlling it. I was not trying to open any attachment etc, just logged into my normal email and reading(I do not allow HTML on any email until I know it is safe), I didn't have any other programs running, just IE and normal boot items--I quickly shut down my internet connection and looked at the logs and saw the security message.


There are no programs set up to run under the guest acct--I tend to not allow automatic scans etc as I like to do all computers at same time and as my schedule varies it doesn't make sense to schedule something that won't run.

BTW it is only my husband and I @ the home,but he just happened to be at work when this happened. (He has his own laptop anyway)

I had a similar incidence happen in June, where on 4 occasions at unrelated times this occurred-- I purchased the computer November and began having the suspicious logins in June (I hadn't added any new programs since January) by the end of June, after trying to locate why it started, I decided to do a clean install and get rid of any junk that might have caused it... I only have purchased software on the machine.

Maybe a ghost was doing it. LOL

I am still confused.

Thanks, I have a similar document but that would have been great info. I still just can't quite figure out how it would have occurred. I could understand more if I was doing something or I saw it occur all the time. Lately I only use the computer to access my yahoo group and or for email.

I appreciate the suggestion. First here's what I was doing... I was reading my email, logged in on my account non-administrator acct and the mouse started acting as if I wasn't controlling it. I was not trying to open any attachment etc, just logged into my normal email and reading(I do not allow HTML on any email so that also couldn't be it), I didn't have any other programs running, just IE and normal boot items--There are no programs set up to run under this acct nor were there any programs scheduled to run. In any case, those have been setup to use the my user or admin acct.
I quickly shut down my internet connection and looked at the logs and saw the security message. BTW it is only my husband and I @ the home,but he just happened to be at work when this happened. (He has his own laptop anyway or a desktop he can access)

As for your suggestion of getting rid of the account, thanks, that would appear to be a solution-- I was taught long ago that implicit denial is usually greater security for a computer and it allows for tracking events. By getting rid of the account you can leave a gaping hole in your defense, by leaving it you can control it by DACL "Creating a proper discretionary access control list (DACL) is a necessary and important part of application development. Because a NULL DACL permits all types of access to all users, do not use NULL DACLs."http://msdn.microsoft.com/en-us/library/ms717798(VS.85).aspx
or " In NT, the Guest account lets people log on to an NT computer when they don't have a personal account defined on the computer, in the computer's domain, or in any of the domains that the computer's domain trusts. Like the Administrator account, the Guest account is a built-in account with a fixed SID; although you can rename the account, it can't?by default?be deleted. Unlike the Administrator account, the Guest account doesn't require a password for logon, which is why it's disabled by default."

http://www.windowsitsecurity.com/article/articleid/24054/deleting-the-nt-guest-account.html