Strange behaviour again

**Bijo** · 08-24-2007, 02:16

It seems I could not easily erase certain directories in a directory. Apparently some files were "used by another person or program". That there quoted looks suspicious to me. How can an .exe file (that regards the installation of a game) be in use by another person or a program?

And so it was with other directories on the same level of that directory. Data that simply exists on the disk and is not supposed to be in use unless I touch it.

Then I commanded to erase the whole directory (that has the separate ones) and after some jerkiness of the disk and some rubbish here and there deletion finally took place.

Strangely, at that moment, when deletion was completed, the software that's about anti-virus and anti-this-and-that was suddenly disabled. It returned to its (supposedly) normal status shortly after. Suspicious.

Can something/someone have slipped into my system during the brief deactivation? Is it possible something/someone had already influenced my system and if so what are the probabilities and to what possible (estimated) degrees? What other important things, ideas, clues, etc., should I heed (according to you)?

The thing is just fresh. If it gets messed up so quickly, heads will roll. I don't know whose heads yet, but they will roll certainly. The first heads I'm thinking of are the ones of the computer store.

**Blodrast** · 08-24-2007, 07:13

The deletion issue isn't necessarily suspicious - it's perfectly possible. Did you try to delete that directory first thing after a reboot ?
Also, it's perfectly possible that the files were in use by some antivirus software, for example. There are several possible explanations, not necessarily related to anything dangerous/malicious.

It also depends on what exactly you were trying to delete (e.g., a directory where a program that is currently running (such as a firewall/antivirus/fraps/whatever) is installed).

I'm not sure about the brief deactivation of your antivirus thing - you're being way too vague about this. What does "brief" mean ? What antivirus are you using ? How do you know it was deactivated (i.e., how could you tell) ? Have you ever seen that before ? How long have you been using that piece of software ? See, like I said, you're way too vague; you need to provide more details for anybody to be able to make an educated guess, otherwise, we're all down to uneducated guesses :)

As for whether something nasty happened to your machine while the antivirus was disabled - well, scan your system and you'll find out.

**Husar** · 08-24-2007, 10:10

It's best not to have anti virus software because that prevents you from deactivating it.

Anyway, I don't think the guys at the store are at fault, unless they hacked into your PC themselves. Like Blodrast said, it's possible that the application was indeed in use. Did you start it before? If you did and it crashed, it can happen that it wasn't stopped correctly and was still running in some way.

I don't know about anti virus software behaving in weird ways for reasons stated in my first sentence. Things never found anything on my system anyway.

**Bijo** · 08-24-2007, 14:51

Hmm, I see.

How could anti-this-and-that software use the data in question if it is not scanning it? Are there valid reasons and explanations? The data was also not installed software or anything of the like that could be in process: just raw separate files, data, and such, and no program should have the data opened/read unless I do so myself. What could be the explanation for this one?

Naturally, it would leave me to suspect external malicious influence ("a person" (using "a program")). But perhaps I am too quick to conclude.

**Blodrast** · 08-24-2007, 16:27

Originally Posted by Bijo

Hmm, I see.

How could anti-this-and-that software use the data in question if it is not scanning it? Are there valid reasons and explanations? The data was also not installed software or anything of the like that could be in process: just raw separate files, data, and such, and no program should have the data opened/read unless I do so myself. What could be the explanation for this one?

Naturally, it would leave me to suspect external malicious influence ("a person" (using "a program")). But perhaps I am too quick to conclude.

Your av software might "lock" the data if it's scanning it (although not necessarily), or if it's quarantined some of those files (although that usually happens in a different directory).

The data, whatever it was, I'm assuming was opened with a program... sometimes, various programs don't let you delete, for example, the last file you opened in them (the most recent example I can think of is a savegame from a heroes game; fresh reboot didn't help, the game was obviously not running, etc, etc. Trying to delete the savegame resulted in a popup saying that it's in use by an application. Not a big deal for me at the time, could have booted in linux and deleted it at any point, but it's worth mentioning the issue, I reckon). Mind you, this is faulty behaviour.

So yes, there could be valid reasons and explanations. Did you scan your system ?

**Bijo** · 08-24-2007, 16:57

But there's the thing: it was a directory with separate directories whose data were merely existing. No scan was active nor was a program opening it nor had data been quarantined (as I've checked it)... I also did not open any file in it whereafter I closed its related program... or perhaps it was a program or process I did not control(?) (which lead me to suspect possibly malicious outside activity.)

The fact that the protecting software was briefly disabled after the data's deletion (which was a slow process) fortifies my suspicion. As if something/someone wanted to enter quickly.

But perhaps I'm missing a point and it is merely what you say it could be or some other reason.

Yes, I initiated a scan which took shortly and the only negative things found were some tracking cookies. Any ideas?

**Bijo** · 08-25-2007, 20:02

What could be the reason for a mouse cursor suddenly disappearing while moving and reappearing some seconds later? I thought all was well, but it appears it's not. It seems heads must roll after all.... where's my sword again.... I shall provide the people from the lovely computer store with a little visitation to show them my gratitude for their... excellent work. Not that it is necessarily their fault, but someone must pay

**Husar** · 08-25-2007, 20:28

Originally Posted by Bijo

What could be the reason for a mouse cursor suddenly disappearing while moving and reappearing some seconds later? I thought all was well, but it appears it's not. It seems heads must roll after all.... where's my sword again.... I shall provide the people from the lovely computer store with a little visitation to show them my gratitude for their... excellent work. Not that it is necessarily their fault, but someone must pay

First off, I still don't know how it could be the fault of your computer shop people, and secondly, a mouse pointer disappears sometimes, at least when any sort of overlay is present on the screen it can happen. Just yesterday or today I was on some video webpage and while moving the mouse pointer over the page, it diappeared right after leaving a video overlay, well, it reappeared a few pixels further. Not really an issue.if it just disappears on the desktop without you doing anything, then I would be more worried(unless your screensaver starts...).