Finding out which app is using the webcam

Question

Yesterday I was working on my laptop. Suddenly I noticed that the indicator light of the webcam was on, despite the fact that I wasn't making a video call or using the webcam in any other way at the moment.

It freaked me out.

It freaked me out that some unknown application on my computer was using my webcam without my permission, and possibly sending that video stream to god knows where on the Internet.

In the end, it turned out to be Skype which was in the process of crashing. (Despite me making no calls at the time.) So that story ended well.

But next time I see the webcam indicator light, I want to be ready. I want to be able to know exactly which app is using the webcam so I could destroy it.

Does anyone know how I can find out which app is using the webcam?

(I'm on Windows XP.)

Solution 1

As already suggested by harrymc, you can use Process Explorer to easily find out which programs currently use your Webcam. All you need to do is to find your Webcams Device Handle and search for it in Process Explorer.

First, search for your Webcam in the Device Manager, it should be under "Imaging devices" but can also be under "Sound, video and game controllers" if it has a built-in Microphone (like in my case).
Beware that it has two Device Handles in that case.

Right-click and select Properties (or Double-click), go to the Details Tab and search for "Physical Device Object name" in the Properties dropdown list and copy the value.

Now go to Process Explorer and click on "Find", then "Find Handle or DLL..." (or press CTRL+F) and enter your previously copied Device Handle.
Click search and after a bit of wait you will get a list with Processes using your Webcam.

Again: Beware that your Webcam's light might also be on because a built-in Microphone is in use, in which case you will also have to search for the Microphones Device Handle as well!

Solution 2

My idea is that maybe you could use Process Explorer to search out which program has opened the device.

Try it first when it is open by Skype or some other known program. Process Explorer can show you which files and devices are opened by this program, to find out what is the name of the device. You could then use the Search function with the device name to see if it does find this program.

If this works, then in the future Process Explorer can find for you which program is using the webcam.

_{(Sorry, I don't have a webcam for testing this out.)}

Solution 3

Applications using "handles" to access various interfaces provided by OS. Device handles is actually "file handles".

Process Hacker ( http://processhacker.sf.net/ ) can search handles in all processes (Ctrl+F to open "Find handles and DLL's").

My webcam device handle was

\Device\USBPDO-6

I found that after comparing all \Device* handles opened by skype.exe while my webcam is on and off.

Comments

[Admin]

Rut Row. . . Malware spying on you!!

[Admin]

Frankly, I'd consider putting a sticker over the webcam unless you're using it. There's been a few bad people taking advantage of webcams: wired.com/threatlevel/2011/09/sextortionist

[Shaul Behr]

+1 IMO this should be the accepted answer - much more useful than the currently accepted answer...

[jeremyalan]

+1 Awesome, thanks for taking the time to add details, very helpful!

[Jonathan]

I had the light on and no results in the search. Probably something crashed and left it running. I'll re plug it in

[tibbus]

same for me, no results

[Shawn]

0 matching intems.

[Suncatcher]

This is not working!