Odd typing in MSWord

From: Federated Information Security (FederatedInformationSecurity_at_federatedinv.com)
Date: 03/04/05

  • Next message: Jeff Garrett: "Re: Odd typing in MSWord" 
    Date: Fri, 4 Mar 2005 09:50:14 -0500
To: <incidents@securityfocus.com>

    I ran across something rather odd today I'm hoping someone might have
    thoughts on. One of my users had their XP SP1 laptop on the corporate
    network and was editing a Word document with office 2002. They pasted
    something in a table, and it looked like someone started typing in their
    document. It was slow, typical typing speed, and lasted for about 10
    minutes (I actually got a chance to see it). The text was nonsense
    words, like the kind you often see in spam nowadays.

    The machine's fully patched, up-to-date anti-virus and a personal
    firewall. Don't see any signs of spyware, nothing in the registry. I
    checked all the files modified today hoping to find a keylogger or
    something similar, and the only thing I found was a seemingly encrypted
    file on the root of c:\ called "comply.ini", which isn't normal for our
    config, but may not be related. IE was open at the time this happened.
    I issued a netstat -a command while the typing was going on, but all the
    connections were legit--domain controller, file & print servers. I
    checked the running processes and everything seemed pretty typical,
    although I hit

    Anyone run across anything similar lately, or have any suggestions?

    Thanks!
    sid

  • Next message: Jeff Garrett: "Re: Odd typing in MSWord"

    Relevant Pages

    • Re: Odd typing in MSWord
      ... On Fri, 4 Mar 2005, Federated Information Security wrote: ... One of my users had their XP SP1 laptop on the corporate ... > network and was editing a Word document with office 2002. ...
      (Incidents)
    • Re: Single domain two IP subnets
      ... hardware or any of the complexities of "network hardward ... I never criticize anyone's typing as long as the words can ... Cisco ISL VLANS are history. ... Newer Cisco switches don't even support ISL ...
      (microsoft.public.win2000.dns)
    • Re: Remote Desktop Connection
      ... Doing so, instead of typing the computer name, into the Remote Desktop Connection was the solution. ... This is one of my clients. ... Also, depending on the VPN client, you could tell it to use the DNS servers on the client network when the VPN tunnel is opened. ...
      (microsoft.public.windows.server.general)
    • Re: Remote Desktop Connection
      ... typing the IP address is what I did. ... into the Remote Desktop Connection was the solution. ... This is one of my clients. ... servers on the client network when the VPN tunnel is opened. ...
      (microsoft.public.windows.server.general)
    • Re: Return focus to word and Activate
      ... How about activating the Word document itself? ... Word 2007, the Word doc becomes visible and the cursor is visible, but you ... If you start typing before you click with the mouse in the Word doc, ... you are typing on the msAccess form that was on the screen when the ...
      (microsoft.public.word.vba.beginners)