If you don't want to read all of the details, skip to the bottom; I'll make a summary.
I created a computer program as a proof of concept (I threw it together in 12 hours, so I wrote it in Visual Basic to get it done quickly). Normally I'd be using Linux but my client wanted a Windows version, so I resorted to VB.
Anyway, the program was designed for a computer rental company; if a computer is rented to a customer is lost, stolen or the customer stops paying, the computer can be remotely locked and tracked. I got the proof of concept working and installed it onto 4 computers running Windows XP. I showed those 4 computers to my client and demonstrated the software to them.
Once I'd finished the demonstration, I returned the computers back to my office and they've been turned off ever since. However, today (2 days after the demonstration) I noticed a computer check into my online service (e.g. my program was installed onto another computer). The model of the computer was completely different to the computers I was using and the serial number was reported as 'None'.
Also, I noticed the same computer check in 4 times within the space of 2 minutes from different locations in the world (according to IP address lookup). It's possible that it was 4 identical computers in different locations running the software at almost exactly the same time (The serial number was 'None' so I couldn't tell if they really were different computers or not).
I don't understand how this happened because I created the software on a Virtual Machine running a clean install of Windows XP with antivirus (the host machine was running Linux). The 4 demonstration machines were also clean installs with antivirus and they were fully updated. This means that during the 15 minutes those computers were connected to my clients' network, the program somehow got leaked. The computers never left my sight, nobody other than myself have ever accessed them.
How is that even possible and why would malware target a .exe file?
- Created software on a clean install of Windows XP in a virtual machine (host was running linux)
- Installed the software onto 4 computers and connected them to an unknown network for no more than 15 minutes
- Nobody touched the computers besides myself
- The software was then run from 4 different internet connections on what seems like the same computer two days after I unplugged the computers from the unknown network (the computers were never turned on again after being connected to that network).
Software is closed-source and was never given to anyone.
If it was malware, why did it steal an .exe?