RE: Odd typing in MSWord

["Federated Information Security" <FederatedInformationSecurity () federatedinv com>]

Thanks to all who replied, I'm pretty sure it was the microphone, I'm in
the process of verifying.  As a side note, I've seen the press on MS
root kits, but are they all that common?  How often do you run across
them in a corporate environment, and how good are standard protections
(antivirus, firewall, non-admin) at preventing them?

Thanks again!
sid


-----Original Message-----
From: Federated Information Security 
Sent: Friday, March 04, 2005 9:50 AM
To: incidents () securityfocus com
Subject: Odd typing in MSWord


I ran across something rather odd today I'm hoping someone might have
thoughts on.  One of my users had their XP SP1 laptop on the corporate
network and was editing a Word document with office 2002.  They pasted
something in a table, and it looked like someone started typing in their
document.  It was slow, typical typing speed, and lasted for about 10
minutes (I actually got a chance to see it).  The text was nonsense
words, like the kind you often see in spam nowadays.

The machine's fully patched, up-to-date anti-virus and a personal
firewall.  Don't see any signs of spyware, nothing in the registry.  I
checked all the files modified today hoping to find a keylogger or
something similar, and the only thing I found was a seemingly encrypted
file on the root of c:\ called "comply.ini", which isn't normal for our
config, but may not be related.  IE was open at the time this happened.
I issued a netstat -a command while the typing was going on, but all the
connections were legit--domain controller, file & print servers.  I
checked the running processes and everything seemed pretty typical,
although I hit 

Anyone run across anything similar lately, or have any suggestions?

Thanks!
sid