I got a call from a friend who was sure his PC was hacked because his CD-ROM drive kept randomly opening and closing. After looking at the machine I found a .vbs file in his appdata folder named RandomlyOpenCD.VBS (surprisingly It randomly opens and closes the CD drive) and nothing else that looked like an APT.
After making a copy of the code, deleting the file and rebooting his PC it was fine and his CD drive was back to a non-hacked state.
The practical joker in me makes it nearly impossible to not share the code:
Dim smax, smin, rmax, rmin, start, repeat
smax=900000
smin=300000
rmax=600000
rmin=100Set oWMP = CreateObject(“WMPlayer.OCX.7”)
Set colCDROMs = oWMP.cdromCollectionRandomize
start=(Int((smax-smin+1)*Rnd+smin))
wscript.sleep startdo
if colCDROMs.Count >= 1 then
For i = 0 to colCDROMs.Count – 1
colCDROMS.Item(i).Eject
Next
For i = 0 to colCDROMs.Count – 1
colCDROMs.Item(i).Eject
Next
End IfRandomize
repeat=(Int((rmax-rmin+1)*Rnd+rmin))
wscript.sleep repeatloop