OK, so there are some areas you can check to ensure that this was a malware trojan or other type of init , and not a direct streaming connection to
your computer.
1. The startup folder. Use a DOS command and navigate to your desktop startup folder. Type attrib *.* -r -h -s
(this will unhide anything that may have been deposited there)
Look for any program or command shortcut that is not what you would expect. Any executable or .cmd (batch, .bat) file in here automatically gets
executed when you log in to your account (or start your computer when you do not have a password enabled)
2. Search the registry for a run or runonce entry that will execute a command script or executable when the machine starts. this is typically :
(use a command prompt and type REGEDIT32)
Examine these keys:
HKEY_LOCAL_MACHINE/Software/Microsoft/Windows/CurrentVersion/Run
HKEY_CURRENT_USER/Software/Microsoft/W/ndows/CurrentVersion/Run
HKEY_LOCAL_MACHINE/Software/Microsoft/Windows/CurrentVersion/RunOnce
HKEY_CURRENT_USER/Software/Microsoft/Windows/CurrentVersion/RunOnce
You should look for any subkey or value under these keys for anything that attempts to run something you do not expect at startup.
98% of all malware uses one of the above methods to get a foothold in your system. You may have something else more sinister that may require
scanning your system with: MalwareBytes, SuperAntiSpyware or AVG - all available for free on the net.
3. Also, you should also issue a netstat -a command from the command prompt window, just to see if something you do not recognize has established a
connection with you over the internet. You will need some further help with this and that is beyond what I can help here with
4. Go to the Control panel and pull up the sounds applet. Click on the "sounds" tab and make sure that no windows events or keystrokes are assigned
to a waveform file that could have been deposited somewhere in your computer.
Good Luck and hope this helps.
edit on 23-6-2011 by charlyv because: (no reason given)
edit on 23-6-2011 by charlyv because: paste wiped delimiters off
registry keys, restored.
edit on 23-6-2011 by charlyv because: (no reason given)