Viral Rewind: Trojan.Win32.NuttyMouse

Visit my Linktree to access my socials and other channels: linktr.ee/mausolfb
-----------------------------------------------------------
. NuttyMouse is a trojan horse virus for 32-bit Windows operating systems that upon activation takes control of the mouse cursor and randomly moves it all around the screen. It does not disable mouse input however and so clicking will "click" wherever the cursor lands leading to unintended effects. It can be terminated via the task manager to stop the trojan's effect. It will display a "file not found" error after doing so (this is likely a fake message but could mean the trojan is supposed to call another file if it is force closed). NuttyMouse is likely coded with Microsoft Visual Basic as the trojan calls for MSVBVM50.DLL to run.
NuttyMouse while behaving much like a "joke" program is actually classified as a trojan as a joke program only causes effects to annoy a user; it does not drop files or modify the system in any way. This modifies the win.ini run line to execute a program called "??.exe" on Windows start but fails to drop the file it needs as question marks are an illegal character to use for filenames. This will cause Windows to display an error message on startup stating it cannot find the specified file. Removing the added line from win.ini solves the issue.
#malware #mouse #windows
-------------------------
Like the Facebook page: / brian.mausolf
Follow me on Twitter: / mausolfb

[@OrangeShellGaming]

I think the trojan would work more correctly under a (Simplified) Chinese edition of Windows - I'd imagine it'd drop itself correctly (under a valid file name) and add itself to win.ini correctly as well. The "file not found" error is probably due to this as well; perhaps it's trying to restart itself using that copy that it's supposed to create, but seeing as it failed, it just displays an error.