Investigating Unexplained Remote Access: A Personal Experience

In the world of IT support, encountering unusual issues is part of the job. However, some occurrences can leave even seasoned professionals baffled. Recently, I found myself grappling with a mysterious incident involving remote access to my computer, specifically through Firefox. Here’s a detailed account of what transpired and the steps I took to mitigate the situation.

The Incident

One day, while I was attending to other tasks, I noticed my computer being manipulated remotely. Without my input, Firefox was opened, and a series of actions unfolded:

1. A new tab was opened (Firefox was already active).
2. The search term “Google” was entered in the address bar, albeit with a typo.
3. Subsequently, a cryptocurrency game name was searched.

Alarmed by this intrusion, I immediately disconnected my network cable to regain control over my system.

Steps Taken to Secure the System

In a proactive effort to secure my computer, I undertook several actions:

• Disabled remote access settings on my device.
• Uninstalled AnyDesk, which I had used for work purposes.
• Conducted thorough scans with Malwarebytes and its rootkit scanner, both of which returned no results.
• Altered my local security policy to prevent any form of network connections.
• Deleted several recently installed applications, including ClipClip and Winamp.

Despite running the latest version of Windows and ensuring that Microsoft Defender was active, I struggled to make sense of the situation.

Questions That Arise

Two main questions lingered in my mind: How did this happen? and Why would someone search for that particular game? While the ‘how’ is challenging to ascertain, the ‘why’ is perplexing. What motive could there be behind searching for a random game?

Update on Investigation

Deciding to take further precautions, I opted to reinstall Windows 10. Throughout this process, I removed any browser extensions except for LastPass, uBlock, and Dark Reader, which I deemed essential. I developed a habit of shutting down my computer when not in use and locking it whenever I stepped out of the room. Although I removed AnyDesk, I considered re-adding it for outbound connections while blocking any incoming ones. This adjustment was made to better manage potential risks.

To my dismay, the mystery reoccurred. It appeared to stem from Firefox, prompting me to uninstall the browser altogether. To ensure better safety moving forward