Help with unknown virus

There is a virus (possibly trojan) on my mum's laptop. The only thing that it appears to do is that when my mum is typing an email in Outlook Express it will randomly insert '1QA\' and 'zzzzzzzz' into the typing field. The laptop is running Windows ME.

- Searched here and found nothing.
- Searched at Symantec and found nothing.
- Searched at Mcafee and found nothing.
- Nothing dodgy (as far as I can tell) in the Run keys (Run, RunOnce etc.) in the registry.
- Got latest virus definitions for Norton AntiVirus 2002, but it does not detect anything.

I initially thought it was just a trojan a la Sub7, but when I searched Google it returned with a site where someone had experienced the exact same problem ('1QA\' and 'zzzzzzzz' being typed in). Unfortunately there was not further information on the site. Does anyone have any ideas as to what this could be, or what I might be able to do to get rid of it?

-toad

Some thoughts:

Installed a new virus scanner, and that find something?

Disconnect the laptop from any network, and see if the problem persists. If it does, you can rule out a trojan.

If a trojan is not ruled out, try looking for trojans trough one of the methods mentioned in this thread (by alittlebitnumb)

Did you install all windows updates? Maybe it's some weird bug.

If all else fails, and you decide to reinstall, I seriously recommend using any other operating system than Windows ME. Both Windows 98 (which is a little bit older) and Windows 2000 or more stable. If your mother isn't very computer literate, and the machine is strong enough, you could consider installing Windows XP - it's quite user-friendly, after everything is installed...

Good luck!

one the page your talking about she also mentions aaaaaaa. searching for this +1qa leads to quite a few macro discriptions.

try an online virus scan norton could have been affected by it

As Tedib1 suggested... Do an free online virus scan at the URL http://housecall.antivirus.com
and see what that turns up.

Also try Sophos, you can get a free trial with definitions and no restrictionsSophos
We used this trial to sweep our servers and it found around 8-10 backdoors and virii that McAfee's did not, including unix backdoors and such. It's always a good thing to have multiple scanners around.

I did a google search on "1QA and zzzzzzzz" and it came back with 3 hits. All of them seem to refer to a Japanese character set. This may mean you have a keyboard problem, you might want to check the settings.


Cheers:

Disconnected laptop from network and it is still occurring. So it isn't a trojan. Tried Sophos Evaluation version and it did not detect anything. Tried online virus scan (Housecall) and it did not detect anything. I also tried AVG 6.0 Free Edition and it also did not detect anything. I ran one more scan with Norton for good measure - still nothing. Regional settings and keyboard settings are all good as well. Couldn't find macros in Outlook Express so not sure what is happening there.

It really is quite an odd thing, I have seen it happen on several more occasions since I posted it here. Sometimes it turns caps lock on, sometimes it goes to the drop-down menu in the new message box. Anyways, since I can't fix it, I will have to format - thanks a heap for all your trouble people, it is much appreciated :)

-toad

A friend introduced me to a great little anti-virus program called AVG. It is a free download that you can get at grisoft.com. From what I have seen that makes this program different from some of the more well known anti-viruses is that the other programs look for known viruses. AVG looks for characteristics that are common in viruses. You have to tell it to “use heuristics” to do this but it is easy to find in the control center.

I have put this program on 2 computers. Both computers had existing anti-virus programs on them. Before installing the program on both computers I upgraded the existing anti-virus and ran it. Both programs found 0 viruses. When AVG was installed, updated and ran it found 3 viruses on 1 computer and over 5000 on the other computer. All of the viruses appeared to be from a virus called the love letter and copied files form the computer and added the extension “.vbs” on it.

Try this to find out if there is a virus on your computer. I also have a program that is a Trojan hunter that but do not have that link handy. If this does not fix your issue I will hunt for the link to that download.

Yeah, I installed AVG on the laptop, set it to use heuristics and then did a virus scan. I also typed stuff in Outlook Express until it started inserting characters, and AVG still didn't pick it up. I will have to format, which isn't much trouble thankfully since most of the important stuff is backed up. Thanks for all your suggestions :)

Just a thought Powaertoad...
Did ya try new keyboard drivers?.. ie delete the keyboard in Device manager and restart the lappie?

worth a go b4 reinstalling

Cheers U02

I didn't try new keyboard drivers unfortunately, and I have already formatted and reinstalled all the software. It definitely looked like a non-keyboard related problem, as towards the end it also started to insert strings like 'ZONE' - crazy stuff. Thanks for the suggestion anyway :)

-toad

weired Ok, certainly gives the impression of a form of malware...

ok 2 bad I was so late in replying..

Cheers

Hi,

Well before looking for viruses, are you sure that the keyboard is working well. Laptop will do such a thing if any liquids have been spilled on it.

What i would do, is connect an external keyboard to the PS/2 port and see if it's still happening while using the external keyboard only. If so, you can eliminate the keyboard itself and concentrate on the software part of it.

Good luck.

Clesius.

You didn't mention what version of MS Office she was running, but be aware that Office XP comes speech enabled. If she has a microphone installed, the office application will listen for a voice and interpret sounds and therefore insert random text into the speech enabled fields. I ran into this problem with my machine and thought I was going crazy.

If this starts happening again, you may want to turn off speech recognition, if she has office xp.