Security Incidents mailing list archives

RE: Odd typing in MSWord


From: "Rubin, Benjamin" <brubin () saintpetersuh com>
Date: Fri, 4 Mar 2005 13:57:24 -0500

I have seen this occur as well in Windows XP.  What had happened was that
the user had accidentally turned on the Windows XP speech recognition
'feature' and that Microsoft Word was trying to translate background noise
into text.  I have seen this also happen even if there is not a microphone
connected to the computer.

Microsoft has the following to say about turning off speech recognition in
Windows XP/2000:

http://support.microsoft.com/default.aspx?scid=kb;en-us;326526#4

Benjamin Rubin
Computer Operator II
Saint Peters University Hospital

-----Original Message-----
From: Federated Information Security
[mailto:FederatedInformationSecurity () federatedinv com] 
Sent: Friday, March 04, 2005 9:50 AM
To: incidents () securityfocus com
Subject: Odd typing in MSWord

I ran across something rather odd today I'm hoping someone might have
thoughts on.  One of my users had their XP SP1 laptop on the corporate
network and was editing a Word document with office 2002.  They pasted
something in a table, and it looked like someone started typing in their
document.  It was slow, typical typing speed, and lasted for about 10
minutes (I actually got a chance to see it).  The text was nonsense
words, like the kind you often see in spam nowadays.

The machine's fully patched, up-to-date anti-virus and a personal
firewall.  Don't see any signs of spyware, nothing in the registry.  I
checked all the files modified today hoping to find a keylogger or
something similar, and the only thing I found was a seemingly encrypted
file on the root of c:\ called "comply.ini", which isn't normal for our
config, but may not be related.  IE was open at the time this happened.
I issued a netstat -a command while the typing was going on, but all the
connections were legit--domain controller, file & print servers.  I
checked the running processes and everything seemed pretty typical,
although I hit 

Anyone run across anything similar lately, or have any suggestions?

Thanks!
sid


Current thread: