Haunted Computer

[Poppa_Meth]

I rebuilt my girlfriend's PC a few months ago after the Mobo went in the old one. It's an i3 built running Win7 Home x64. Recently, she's had an issue with a search result box popping up at random with nothing in it. I thought it was spyware at first but multiple scans with MBAM, SAS, Avast, and Defender have found nothing. Today she called and I logged in with Teamviewer to see it first hand. She said the Start menu opens, and then a search windows pops up. The search phrase was "asasas" with no results found. I'm tempted to think that maybe her keyboard is at fault here. Could it be possible that the keyboard is dying and sending random signals? It's a Saitek Eclipse board that she had on the old build. I may swap it out for a spare board and see if this continues. It was doing it fairly frequently for a while but it's been over a month this time. Nothing seems out of the ordinary other than this.

[jagabo]

Wireless keyboard?

[freebird73717]

Possible stuck keys. Only sticking sometimes.

I'd switch the keyboard to test.

[hech54]

There are some Google entries for "asasas malware". If not the keyboard....have you run the anti-spyware in Safe Mode?

[Poppa_Meth]

It's a wired USB keyboard.

I'll trying looking into spyware a bit deeper. Maybe run a rootkit detector. This installation is only a few months old and no other problems have presented. None of the malware topics on this list the current behavior as symptomatic of this infection.

[lordsmurf]

Run it through Combofix: http://www.bleepingcomputer.com/combofix/how-to-use-combofix

This is a very powerful tool -- be sure the system has important workfiles backed up.
It can be more effective than the normal malware and AV tools.

I've used it before -- very effective.

[Ditka1985]

I think it is more than coincidence that it is repeating keys that are physically right next to each other. While it certainly could be malware, the possibility of a bad keyboard seems strong to me. See if you can borrow one or swap in an older one and see if it goes away.

[edDV]

Bad to fix a GF's computer. Even after she breaks up with you, or you break up with her, she expects warranty repair.

[lordsmurf]

Bad to fix a GF's computer.
Even after they break up with you, or you break up with her, she expects warranty repair.

The trick here is break it more next time.

Install all the helper bars you can, load the HOSTS file to block her favorite sites, set it to run all kinds of updates throughout the day + start/shutdown, add a RAM drive to suck up all the RAM. She'll think you're an incompetent bastard, but at least she'll go away now.

[classfour]

edDV: That's why you marry them - so they can't make you fix everything, LOL.

My vote for malwarebytes or superantispyware in safe mode - or try rkill on the process and run them in windows just to see if there's something working "haunting" in the background.

[edDV]

edDV: That's why you marry them - so they can't make you fix everything, LOL.

You have to be kidding. They all maintain a "HoneyDo" list and are relentless.

[Ditka1985]

yeah... I built my (future wife) a computer 21 years ago... we've been married ever since... Be careful out there!

[Poppa_Meth]

I've considered combofix. I know if can break software if you aren't careful with it. I may run it anyway after a full backup. Hopefully I can find a different cause before that.

And as for marriage...I ain't gonna do it!!!!

[Poppa_Meth]

I rescanned again with updated MBAM, SAS, and Avast boot scan. Then I ran Combofix.

Combofix found one instance of inst.exe in the roaming folders. I uploaded it for further testing and so far there doesn't seem to be any legitimate infection.

Avast found one instance of a trojan in a backup archive from the old computer, but it was compressed and encrypted so it seems unlikely that it would have escaped into the rest of the machine.

So far it hasn't done it since these scans, but if it occurs again, she has a spare keyboard on hand to swap into place.

[aedipuss]

sounds like it might have been a soda spill that dried into key sticking goo.... my eclipse has been through 4 computers and still working great, hard to find a better one.

[Poppa_Meth]

She just called me. 6 search windows were open when she knocked off the screen saver. I told her to swap the keyboard. If that doesn't do it, I have no idea where to start looking next. Maybe the Saitek game controller software is shooting out random macros.