Strange Virus

[gentobu]

I was working on a customers computer today and she had a virus that would type odd things in microsoft word. For example, she would start typing and then all of a sudden the computer would take over and start typing out strange (almost nonsense) sentences. What freaked us both out was that it had recorded us talking and played the recording back about 10-15 minutes later! I went searching on google and the symantec web site, but I was unable to find a virus that would do these things. I was also thinking that it could have been a trojan horse or something but if that were the case then the sentences that are typed out in MS word would have made more sense. Anyway if anyone has heard of virus doing this please tell me what its called. thanks

 

[minendo]

Have you tried running a virus scan?

 

[gentobu]

No I did not. All I was supposed to do was replace thier HDD and make sure that the problem did not exist on the new one. So now I just want to know what virus it was.

 

[WarCon]

Sounds like more than a virus. Really sounds like a trojan and someone was having fun with her. Does she have DSL or Cable (if so then its time for a better firewall maybe)?

Another more sinister cause could be some kind of joke trojan that some relative or friend might of put on to mess with her. The recording your voice is kinda freaky (but cool....), and I haven't heard of any virus that does stuff like that. Maybe someone she knows sent her a nasty Word virus with some pretty intense macro's imbedded. You might wack her install of Office. Wipe out all common files and any directories and then reinstall. If it is a macro virus then unless you can get a cleaner, she won't be able to open any document that she has recently opened. I would back them all up to a CD or floppy and remove them from the system. You might look in her email folders for .doc attachments for the culprit.

This is a new one to me. Kinda want a copy if its benign..............

P.S. Does this wierdness only happen when Word is running? If so then its probably a macro virus.

 

[gentobu]

Thanks I was also thinking that it could have been a macro type virus. and yes she has a cable connection. so maybe someone was recording our conversation, then played it back later. As for the sentances in word, they are really strange I wish I could remember exactly what they where. She let it run overnight and it had 'typed' about 2 1/2 pages of weird stuff. It also would not let her type in internet addresses in explorer. This is also a refurbished system so perhaps the virus was on it before she got it and when the drive was reimaged the virus was left intact. Oh and as a spooky side note, she told me that one night she was home with two other people and the computer typed out something about killing three people in a house :Q. Yeah I know its probably just a coincidence, but still, if it were me I would have been pretty freaked out too.

 

[WarCon]

She has probably been hacked and now has a running trojan program. Someone might of been listening when they were talking (or even looking out of her camera) and seen/heard that there were three people and was messing with them. Not cool though.

I would format that hard drive with the manufacturers software (just to make sure the MBR gets rewritten). If she has partitions, then change the size slightly so all the info has to be refreshed. Tell her she needs a better firewall. What software firewall is she running? Her cable box should have a built in hardware firewall also, but it might not be very restrictive. If I ever get a dedicated connection (like DSL or Cable) I am going to insert a linux box in between for haxor's to play with. Make it a nice compact install that can be reloaded in minutes if need be.

 

[gentobu]

acctually the infected drive is being sent back. I just replaced it with a new one ran a virus scan (none found) on it and left. Now I kind of wish that I had imaged the drive onto cd-r with ghost. I really want to know what virus (or trojan or whatever) this is.

 

[n0cmonkey]

Make sure she runs an up to date anti-virus program.

 

[HappyPuppy]

Does her computer have a microphone attached to it?