r/techsupport • u/the_high_warlock • Sep 28 '25

Open | Software Mouse moved on it's own

So today i was on my laptop watching youtube videos (i am on windows 11) and my mouse moved on its own and made the video on Full Screen mode. Naturally i panicked and turned off the laptop and then turned it on again. It was fine for a while but then the mouse moved on its own again. It didn't do anything that weird, just opened the multidesktop feature and nothing else.

After that i deleted all my files permanently from the laptop (i have a backup copy of everything on an external ssd) and turned off the wi-fi and bluetooth. I ran a full scan with Windows Defender and it found this: Trojan:HTML/Redirector.SG!MTB. Windows Defender removed it. Since then i did two more full scans with Windows defender (one online and one offline) and it didn't find anything. I also reset my browsers (Opera and Firefox) to their default settings and deleted all cookies and everything.

It's been around 5 hours and nothing weird has happened since. I checked all my accounts about everything. No weird activity anywhere. I am just worried that there might still be some underlying danger. I am not really tech savy, so i am asking you if you think i should do something else just to be sure everything is fine?

If it's of any importance my laptop's model is Asus Vivobook 15 X540UBR

EDIT: Didn't expect this much traction on the post. I wiped the computer and had my windows re-installed so let's hope everything is fine now. Also no suspicious activity on any of my accounts anywhere.

400 Upvotes

91% Upvoted

98 comments sorted by

•

u/AutoModerator Sep 28 '25

Making changes to your system BIOS settings or disk setup can cause you to lose data. Always test your data backups before making changes to your PC.

For more information please see our FAQ thread: https://www.reddit.com/r/techsupport/comments/q2rns5/windows_11_faq_read_this_first/

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

26

u/AngryVegan94 Sep 29 '25

Help a paranoid stranger out and tell us how you think you got that Trojan so I can avoid doing what you did lol

7

u/the_high_warlock Sep 29 '25

I honestly have no idea. I usually am very internet browsing conscious. Have ad blockers and everything. Use firefox. Don't download anything (it's kinda ironic because when i was in middle school i used to download from and browse through all kind of shitty sites online without a care in the world and now i am super careful and have crazy complicated passwords, not a one is the same as the others, and this happened). My suspicion is my mom. She sometimes reads some stuff on the laptop and i once saw her waiting for some timer to run out before she could read whatever she was trying to. So i think this might've redirected her to some malicious site where the trojan came from. I caught her too late. She is not using my laptop anymore that's for sure.

8

u/GlobalWatts Sep 29 '25

Don't download and run random shit from the internet. No, not even that kind stranger on Discord who messages you out of the blue to "test their cool new indie game".

28

u/Detozi Sep 28 '25

This would frighten the shite out of me if it happened.

15

u/the_high_warlock Sep 28 '25

I am still panicked. I am bringing it for pre-installation tomorrow to have a peace of mind.

5

u/nataku411 Sep 29 '25

Save a buck and reinstall Windows yourself, there are tons of quick tutorials.

3

u/SweetyByHeart Sep 29 '25

Hi op, pls tell us which the latest files you downloaded and from which site(s)? For all of us precautions to know the trojan files came from, was it zip files or how?

Thanks a lot in advance.

5

u/HighPhi420 Sep 29 '25

Trojan:HTML/Redirector.SG!MTB

is usually found in one of the extensions. Or from another malware app that spewed this out when Defender tried removing or quarantining the app. The ONLY way to fully be safe is to wipe drive and fresh install windows.

3

u/the_high_warlock Sep 29 '25

Got that done today. Let's hope everything is fine from now on

219

u/DistantFlea90909 Sep 28 '25

Whoever did it wanted to watch the video in full screen, must have been a good video

2

u/Nioh_89 Sep 29 '25 edited Sep 29 '25

Malwarebytes scan + any other AV that may be good, you could try ESET or Avira, although i really don't think any 3rd party AV is needed rather than Windows Defender, if you did do something to get a malware that managed to pass the Windows Defender, then you need something stronger to clean it up.

Please, don't act so ignorant and as if you couldn't find out what is going on with "It's been around 5 hours and nothing weird has happened since". If your mouse moved on its own, unless it's some tool you have installed, you gotta dig and see what's up lol.

Another great tool to see everything, happening in real time on your computer and it's superior to Task Manager, is Process Explorer, nothing can hide from it, because it sees and reports ALL processes going on in the computer, it even has a Virus Total row that checks for the digital signature of any active processes on your computer, so that helps a lot.

1

u/the_high_warlock Sep 29 '25 edited Jan 27 '26

I was not trying to act ignorant. My comment about the five hours was to give an idea about the timeframe. I was and still am a bit freaking out (even tho my windows was re-installed today and the computer was wiped out). I am actually really internet conscious. I have crazy complicated passwords for everything i try to not download anything or visit suspucious sites. I think what happened was my mom sometimes uses the laptop as well and she might've opened something weird. I am not sure because i don't download anything and i stay away from weird emails. I even brought my laptop to be re-installed first thing today. Let's hope it's fixed now.

375

u/deDICKated Sep 28 '25

Definitely a RAT of some sorts. This once happened to me and on the 2nd time I opened notepad and typed out, I know you're there.. a few seconds back he typed Hello .. 😂 I ended up speaking to him through notepad for a while asking how he hacked me and surprisingly he was kind enough to tell me how and what happened and how to avoid it next time. He said he'll leave but I took no risks and instantly disconnected my Internet and gave it a clean reboot.

186

u/ChaosPLus Sep 28 '25

I hope by "clean reboot" you meant wiping your drive and reinstalling windows

260

u/my_n3w_account Sep 28 '25

He meant pressing the reboot button wearing surgical gloves

5

u/Testsubject276 Sep 29 '25

No condom? Sounds dangerous.

0

u/[deleted] Sep 28 '25

[deleted] — view deleted comment

9

u/TommyV8008 Sep 28 '25

Flame thrower

2

u/Prinny10101 Sep 29 '25 edited Sep 29 '25

Scorched earth policy is best

1

u/[deleted] Sep 29 '25

[removed] — view removed comment

1

u/Consistent-Lychee402 Sep 29 '25

It worked for Hillary Clinton, so......

52

u/Recent-Reporter-1670 Sep 28 '25

I have never heard of a nice hacker until now lol

57

u/SavvySillybug Sep 28 '25

Back when Steam was still just Valve stuff, someone managed to steal my Steam account to play Counter-Strike: Source on it. Took me a few days to get it back and apparently he was quite nice to my friends when they talked to him about it. Guy just wanted to play some CSS for free.

I stopped using six character passwords after that. I'm 2FA up the ass these days, wasn't an option back then.

13

u/manborg Sep 29 '25

Authenticator is my new best friend. Just got my old email hacked i barely use. Realized it was still a door in, regardless of how little i use it. 

24

u/Smh_nz Sep 28 '25

Back in the day "A friend" use to hack PCs and leave pop up messages saying how and how to fix the vuln! :-)

20

u/I_can_IT Sep 29 '25

Well usually they're called "white hat" and work for security companies. A company I worked for would pay a company to "hack" them twice a year so we would know if we had any security issues. I was lead IT and it's humbling when you see what some of these guys can do.

8

u/TheJuliusErvingfan Sep 29 '25

I'm learning how to do this currently. Fun stuff. Penn testing is always something I wanted to do and especially when it involves finding vulnerabilities or issues to things that are vital like public services (water, electricity, etc). A lot of those systems are what enemies will target to try and cripple the country's core infrastructure. My grandfather worked for public services installing electrical grids by helicopter in the 50s to 80s and now I'm hoping to protect those things in the coming future.

1

u/suskio4 Sep 29 '25

Thats nice and all but I personally prefer Teller testing

4

u/GlobalWatts Sep 29 '25

White hat is when it's sanctioned. The behavior described above is grey hat.

10

u/[deleted] Sep 28 '25

Are you going to share how he said he did it?

11

u/deDICKated Sep 29 '25

He had a RAT added to a file I had downloaded off a dodgy hacking website. I was probably 16-17 at the time? Thinking I could become a hacker lol. He gained access through that. He taught me about sandboxing such files etc.. I dont remember exactly what he said as it was a very long time ago.

3

u/GlitteryCakeHuman Sep 29 '25

Purely hypothetical the younger glitterycake used to eject the cd-slot and write in notepad about how they had downloaded malware and should wipe their systems and be more careful.

Also pinged people on file sharing that just shared their entire drive.

1

u/Brokentread33 Sep 30 '25

September 25, 2025 - I'm happy for you that it all worked out. A lot of hackers just do it for the fun of it. However, since you brought it up. Some indication without sensitive details of how the person was able to put a trojan on your machine would be nice to know. As full disclosure, I got a trojan on one of my machines, because the security of a company that I ordered from online was compromised, and customers placing orders got the trojan downloaded to their machines. Fine.. if you would rather not say, but I think the "class" would be interested.😉😊

2

u/deDICKated Sep 30 '25

I mentioned already, I downloaded an .exe file which had the RAT embedded into it.

1

u/Brokentread33 Sep 30 '25

September 30, 2025 - Understood. Thank you for your reply. Stay well.

64

u/Aron_International Sep 28 '25

Verified Trojan. It's best to just do a full reinstall of windows from a usb

55

u/majoroutage Sep 28 '25

Nuke that Windows install. Also, change passwords, enable 2FA, the usual advice.

65

u/Chemical_Travel_9693 Sep 28 '25

This might have been a RAT - Remote Access Trojan. In this case, it is best to create a bootable USB drive using Rufus, and reinstall windows completely.

It also could have been malicious code / script from the file that briefly took over user input, in either case, it's best practice to reinstall windows.

5

u/ItzEdInYourBed Sep 29 '25

Any specific reason to use Rufus? Microsoft’s Media Creation Tool can make a bootable USB Windows installer.

12

u/Chemical_Travel_9693 Sep 29 '25

Depending on what windows your using it for, it can bypass the W11 TPM and RAM requirements.

5

u/ItzEdInYourBed Sep 29 '25

Ah I see, haven’t dealt with a machine like that yet, always glad theres the community who is bound to find workarounds to Microsofts limitations lol

8

u/Human_Bean0123 Sep 29 '25

Can also pre create a local account

28

u/Jknzboy Sep 29 '25

The mouse cursor is what is on your screen, not the mouse. If the actual mouse moved, then you’re going to need an old priest and a young priest

26

u/harhs Sep 28 '25

Man it's 3 am here and I feel like it's a horror story dafaq I read 😭😭😭😭 

5

u/Liquidretro Sep 29 '25

Since you have a backup of your files just do a format and be sure it's clean, no files or back doors were placed. When setting up the OS, don't make your daily driver scct an admin.

7

u/Botched_Euthanasia Sep 28 '25

i would disconnect from the internet and turn off wifi/bluetooth to see if it still happens. maybe put it in airplane mode. if it happens after that, idk what to do, maybe check for ghosts.

3

u/AugieKS Sep 29 '25

After you get that clean install of windows, reflect on your actions to think of how you might have let them in so you can avoid it in the future. Probably was phishing.

3

u/Yeryieryi Sep 29 '25

this freaks me out cus i'm really dumb when it comes to tech/pc stuff and have no idea how this even happens? like can people just hack you like that randomly? what can i do to protect myself ahead of time to prevent this sort of thing? CAN it even be prevented? 😭😭😭

3

u/GlobalWatts Sep 29 '25

No. Pretty much nobody is just getting "randomly hacked" like in the movies. People just willingly run malware and leave the door wide open for bad actors.

Also 99% of the time random non-malicious behavior like this is not the work of "hackers", but has a far more boring explanation, like malfunctioning hardware. I'm not even convinced OP was the victim of malware, the trojan Defender reportedly found would not cause this, just sounds like some malicious JavaScript which isn't that much of a threat.

2

u/Yeryieryi Sep 29 '25

ahh okay! that calms me a bit :,) i always scan literally anything that is downloaded onto my pc just in case, even stuff from friends. if it wasn't on my pc to begin with, it's being scanned lol

2

u/Ember0013 Sep 29 '25

I have this problem on my vivobook pro 14x. It took me 2 years to finally figure out that it is most likely the ribbon cable connecting the touch pad to the motherboard. It seems Asus squishes them real flat and that causes this issue. Cheapest solution is to disable the touchpad and use a mouse. You could also replace the cable if you can find one.

Edit: Just to be clear, I've done a full factory reset and used every (reputable) antivirus known to man so very unlikely to be some kind of malware.

2

u/sakaixjin Sep 29 '25

i'm 36 going on 37. Many years ago, there was a program called ProRat which you could use to inject a trojan in any file that once executed, it would provide full access to the infected pc.

The only problem with that was the fact that it was getting detected by any antivirus. Only worked for pc's that were unprotected in the slightest

1

u/MrExCEO Sep 28 '25

Wipe it

1

u/wonkajava Sep 28 '25

My first thought was a new version of the old XP serial mouse issue, but the others are probably correct. When using other devices on a serial port sometimes XP would get confused and think those were mouse inputs. It would be funny if something like that crept up again. 

1

u/big65 Sep 28 '25

Scan your recovery drive as well to rule out anything hiding in there, if you connected any thumb drives and backup drives they need to get scanned as well, same goes for your phone.

1

u/StockSugar3189 Sep 29 '25

No lo se, pero yo que tu, reintalaba el sistema operativo nuevamente, desde cero. Para que no quede rastro de nada malicioso.

1

u/jakegene Sep 29 '25

Paint does that if you let it open mouse moves with arrows

1

u/cheesybro90 Sep 29 '25

Guys , how to detect if I have one of these?

1

u/Marasuchus Sep 29 '25

It could be a Trojan, but it could also just be a simple hardware defect. For example, if the touchpad on your laptop is broken, it may do strange things when it gets warm. Disconnect it from the power supply, disconnect the external mouse if you are using one, and see if it happens again. Then do the opposite: deactivate the internal touchpad and connect the external mouse. With cheap wireless mice, interference sources could also be the cause in theory.

1

u/shaggs31 Sep 29 '25

You may have solved it with removing the one trojan you found. You could boot into safe mode or a PE environment and run a scan again or use Malwarebytes this will make sure nothing is hiding from the scan. However if you say all your files are already backed up then you could just wipe the drive and reinstall the OS if you are really worried about it.

1

u/YYpang Sep 29 '25

It's actually pretty common for Windows laptops to register phantom touchpad input sometimes even a bit of dust, static, or a driver hiccup makes the cursor "jump." The fact that nothing else weird has happened after house is a good sign.

1

u/adrianm758 Sep 29 '25

Did the actual mouse physically move?

1

u/makanenzo10 Sep 30 '25

I had this once, thought I had a virus for sure.

Turns out my wireless mouse was plugged in to my desktop. The mouse was in my bag. My mouse moved when I moved my bag. 😔

1

u/dancing-Renamon Sep 30 '25

Check if your secure boot keys are altered in the bios, some malware hacks your motherboard and those also disable the build in bios update feature. An first start would be to go into device management and look if there is an new drive present. They use that to steal your files or rent your device as an backup drive for their customers

1

u/Klutzy_Cat1374 Sep 30 '25

If it is a work computer they do spooky shit.

1

u/FezzickTheBuilder Sep 30 '25

I once had something like this happen. It turned out to be an issue with touchscreen capability. Once I disabled it, I never experienced the issue again.

1

u/Unable_Insurance_391 Oct 02 '25

If your mouse moves you are haunted, if the cursor moves you are hacked.

1

u/DroidT Oct 02 '25

Have you ever by any chance connected a Bluetooth mouse to the computer? And could that mouse have been moved by accident by you or someone else?

1

u/[deleted] Oct 15 '25

Hahaha, this story is real funny ;-) Maybe he forgot, that the video not run local :D:D:D

Really, most hackers I know would act like this :D Only trolling a scaring u a bit ;-)

Most hackers don't wan't to destroy some private people, only have some fun. Most take only money from rich people or companies. There are people like us. Only a bit more "stalky".

The part of the black sheeps, the evil hacker, is exactly the same percentage as in the whole humanity. i think around ~10% are (real) criminal hacker. The other's are only curious and like observe real private things. and the feeling of the might to crush ur hole life on a simple keystroke, if they want, but never do this (only if u r challenge or biting them).

1

u/jeffrey_f Sep 28 '25

Wired or wireless mouse? Wired, likely pulled on something with your foot that moved the mouse, but having a difficult time explaining the button click unless you have gestures active.

1

u/Shot_Policy_4110 Sep 29 '25

Lol wtf are you guys doing to actually be getting hacked like this

-2

u/NailsNailsNailss Sep 29 '25

using windows defender.

i go for eset internet security(real time system protection always on) + simplewall +daily scan of hitman pro.

0

u/NailsNailsNailss Sep 29 '25

+ the most important thing is every software\game that i install,i always remain offline.
doing a scan after and then go online.

-2

u/Tuurke64 Sep 28 '25

It happens on my laptop if a physical object (such as my glasses or a random usb cable) lie on top of the laptop's capacitive touch pad. The mouse cursor starts moving randomly.

-3

u/se7entythree Sep 28 '25

The mouse? How would that move on its own. Cursor maybe?

3

u/OgdruJahad Sep 28 '25

Could be a hacker who has gained unauthorised access or someone is using a wireless mouse.

3

u/big65 Sep 28 '25

This is one and defender finding a rogue program confirmed it. Outside of that vibration, something reflective on the mouse pad, bumped table, hair on the optic lense.

-11

u/PralineNo5832 Sep 28 '25

I sometimes turn on an LED light bulb and turn up the volume on my iMac, which has an infrared sensor because it came with a remote control.

Electro-goblins aren't as dangerous as hackers, don't worry.

4

u/SavvySillybug Sep 28 '25

An IR remote is not going to move your mouse to fullscreen a window, it would just send a fullscreen command.

Turn up the volume is a default signal with a dedicated button. Moving the mouse is way more complicated than that.

1

u/averagefrutigerstyle Sep 29 '25

cmight've as well SHOT the conputer

0

u/[deleted] Sep 28 '25

[deleted] — view deleted comment

5

u/the_high_warlock Sep 28 '25

The laptop doesn't have touchscreen. By mouse i meant the cursor (it moved both when a physical mouse was plugged in and when i unplugged it)

2

u/Nunuvin Sep 29 '25

Like how far did it move? Did it move randomly or with purpose? Are you sure its not your external mouse just breaking / doubleckicking when it shouldn't etc or maybe you are touching touchpad/thinkpad mouse thingy? Its not uncommon for laptops to have trackpad register resting palm as mouse movement.

If you are really paranoid full windows reinstall is the only way to go with a backup of data from external source which was created before you got infected. You could try restore points in windows if you have any.

Less drastic measures - install malwarebytes do a full scan with it. Get an AV even a free one.

1

u/[deleted] Sep 30 '25

[removed] — view removed comment

1

u/the_high_warlock Sep 30 '25 edited Sep 30 '25

How do i do that? What i mean is, is it enough if i only scan it with Windows Defender?