While watching a video on my Dell G3 3500, I was not touching the mouse or trackpad when the cursor began moving around, clicking things, zooming, changing tabs, and opening windows. Unplugging the USB mouse did not stop it, although I was also trying to regain control with the trackpad. I eventually shut the computer down, and the cursor behaved normally after restarting.
I disconnected Wi-Fi and ran Microsoft Defender Offline, followed by a longer scan. Both found no malware. The offline scan unexpectedly requested my BitLocker recovery key. Windows also reported that Memory Integrity was disabled because of ftdibus.sys, associated with an older FTDI USB-to-serial driver listed as oem146.inf. I have also noticed brief black command windows appearing over the past few months and occasional unusually loud fan activity.
My computer is currently offline and waiting for the BitLocker key, but I am having trouble signing into my Microsoft account to retrieve it. I am worried about malware and do not want to factory-reset the system because many files are stored only on the desktop and are not fully backed up. What should I do next, and could the cursor behavior have been caused by a hardware or peripheral problem instead?
3 Answers
ftdibus.sys is normally an FTDI USB-to-serial driver, so its presence alone does not indicate malware. Memory Integrity commonly flags older or incompatible drivers. The cursor incident could still have been caused by a faulty mouse, trackpad, touchscreen, Bluetooth device, stuck input, or another USB peripheral; random input is not proof of remote access.
First, recover and record the BitLocker key from your Microsoft account using another trusted device, then copy important files to an external drive from a clean environment. After that, update or remove unnecessary peripheral drivers and test with the mouse, Bluetooth, touchscreen, and other USB devices disconnected. If suspicious behavior returns, change important passwords and consider having the machine professionally examined or reinstalling Windows after your files are safe.
Before assuming malware, check for simpler sources of input. A stuck or failing touchpad, touchscreen, wireless keyboard, Bluetooth keypad, game controller, or USB device can generate clicks and movement even after the main mouse is unplugged. Booting normally and having the issue disappear also fits an intermittent hardware or driver problem.
The black command windows and loud fans are not conclusive either; scheduled tasks, update utilities, and background programs can cause those symptoms. Once you regain access, review startup apps and scheduled tasks, install Dell and Windows updates, run Defender and a reputable second-opinion scan, and back up your files before making major changes.
The BitLocker prompt can appear after certain firmware, boot, hardware, or security-state changes; it does not by itself mean someone broke into the computer. Repeated sign-in attempts can also temporarily trigger Microsoft account errors, so stop trying for a while and use the recovery options from a separate device. Do not disable BitLocker just because it requested the recovery key—save the key somewhere secure instead.
Enable two-factor authentication, change passwords from a clean device if you remain concerned, and check recent account sign-in activity. Keep the computer offline until your important files are backed up and you have completed additional scans.
Related Questions
Can't Load PhpMyadmin On After Server Update
Redirect www to non-www in Apache Conf
How To Check If Your SSL Cert Is SHA 1
Windows TrackPad Gestures