Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Random Characters Typed


  • Please log in to reply
1 reply to this topic

#1 TKC_Computers

TKC_Computers

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:10:10 AM

Posted 23 April 2010 - 11:55 AM

3 Computers of 5 exhibit this issue

Problem: at different times and different applications, after having not typed anything on the keyboard, she will start typing and it appears to show "random" keystrokes.

after plenty of testing we determined it is not "random", once we determine it has started pressing the same key over and over will cause it to display the the characters in order "!@#$..." going down the qwerty keyboard and starting over once it reaches "bnm,./" the first run is with SHIFT on the second run is non-shifted and continues to repeat.

sometimes opening notepad will cause this to stop, sometimes CTRL/ALT/DEL causes it to stop, sometimes ESC does, we have not found any way to consistently get this behavior to stop.

During the research we have ran, many Anti-Virus, Anti-Malware, and Anti-Rootkit software packages none of which have come up dirty, HiJackThis has been ran with nothing out of the ordinary.

Being a Computer Repair Tech by trade, I have finally exhausted all of my resources and am completely baffled by this issue. So I am asking for some help as you may find something I have missed.

On all 3 computers All software is up to date...


Computer 1:
Age: 5 weeks
Toshiba Satellite L555 Laptop
Windows 7 Premium x64
4GB of ram
All Current Windows Updates
Firefox
Google Chrome
ZoneAlarm Extreme Protection
Spybot S&D
MalewareBytes
SunJava
OpenOffice

Computer 2:
Age: 3 years
Gateway MX6-123
XP Home SP3 32bit
2GB of ram
All Current Windows Updates
Firefox
Google Chrome
ZoneAlarm Extreme Protection
Spybot S&D
MalewareBytes
SunJava
MS Visual Studio 08
MS Office 07 Ultimate Edition

Computer 3:
Age: 2 years
Acer Aspire 4315
Windows Vista Home 32bit
1.5GB of ram
All Current Windows Updates
Firefox
Google Chrome
ZoneAlarm Extreme Protection
Spybot S&D
MalewareBytes
SunJava
OpenOffice

I would say keyboard driver, but the fact that ALL 3 of these computers exhibit this behavior, all 3 are different makes and OS's and this happened all about the same time... makes me say it can be the driver.

Any Ideas? I did find reference while searching for answers to this about a virus that had these same behaviors however the virus was made back in 1992, you would think current Anti-Virus software would be able to detect and clean something from 1992.

BC AdBot (Login to Remove)

 


m

#2 TKC_Computers

TKC_Computers
  • Topic Starter

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:10:10 AM

Posted 23 April 2010 - 03:03 PM

Ok further research, after running "Root Repel" shows that the keyboard "events" are being handled by klif.sys which is made by Kaspersky Labs and installed by ZoneAlarm extreme. The file is part of their Anti-Keylogger system... Which should inject "random" characters to the command stack which most keyloggers read to capture the keystrokes, but will still send the right keys to the window in which you are typing.

What this means is... somewhere the klif.sys has a bug in which the "scrambled" keys are being sent to the window in which you are typing...

Is it fixed? I Contacted ZoneAlarm and they have a new version (odd the auto update didn't say there was one) Downloaded and intsalled... no problems yet...

the file klif.sys is installed with other Anti-Virus products, I am using ZoneAlarm and had this issue so it may only be a ZoneAlarm issue but it could still be something with the klif.sys file and not ZoneAlarm

My klif.sys before updating was version 8.4.0.76
after updating ZoneAlarm it is still version 8.4.0.76

I will let you know once further test has been done




1 user(s) are reading this topic

0 members, 1 guests, 0 anonymous users