Malware that disables ENTER key

Learn about Computer Security General Security Questions and Comments
#1

I’ll do my best to describe this. IN a particular Yahoo Chatroom, twice now I have found my ENTER key disabled (also the backspace key and the | key, so its as if whatever is doing this is disabling a section of keys.

Others in the chatroom are also affected. A USB keybd will work fine. (I am on a HP Laptop Win7).

The only fix is to remove the keybd completely (pull the ribbon cable from the ZIF connector) and reinstall.

I scanned the system with CCleaner and both times have found the only Registry error to be something labeled “test app”. Removing this did not fix. Also looked at installed programs and found something called “tech kit” which supposedly was installed as a Microsoft application … that I never knowingly installed.

I do not know if these 2 items are malware or not… neither Comodo Firewall or Antivirus, or Malwarebytes Anti-Malware found them suspicious.

2x this has happened. I expect my Security software to protect me from such things. I will wait for some responses before launching into paranoid rantings of what else evil people might be doing inside my PC without my knowledge.

LarryJ

#2

Should this have been posted in “Defense”?? If so, move it if you can.

#3

Hey and warm welcome

Malwarebytes rarely gives FP. Could you show them to us. Did you get a warning from CIS? if you did what did you do?

Please provide us your d+ rules

Regards,
Valentin N

#4

Hello Valentin,

I received no warnings from Comodo of any kind. I only suspect the files mentioned prior because they looked strange and unknown to me. These would be “test app” that showed up as a registry error in CCleaner, and “tech kit” which showed up in the list of installed files. I cannot say that either had anything to do with the Enter key problem.

As I also said, several other people in this Yahoo Chatroom said they experienced this same issue, so it sounds like the work of a cyber vandal, as yahoo chat is rife with botters/booters/ and other malevolent beings.

As to my Defense+ rules, how do I send them to you/Comodo? I looked under this tab and see no specific mechanism to bundle them for transmission.

My main purpose in posting here was to make Comodo aware of this event (2 times now) and ask if anyone else has ever experienced such an attack. Again, the only fix was to disconnect the laptop keyboard power up with a USB keybd attached and then reinstall the laptop keybd.

LarryJ

#5

Hi Guys,

1st I must disagree, but that is not the point here

The OP (larryj ) stated

So what are you actually requesting, Valentin? Probably I’m missing something ???

Then the description of the problem by larryj is not clear at all… at least for my taste.

Why would you suspect a malware in the 1st place ?

When it’s happening

?

What about other chat rooms & alike? Same effect? Most likely not (correct me if I am wrong)… but have you tested that?

Further, what that suppose to mean

can you please clarify this? What is the keyboard you have that does not work (compare to USB one)? Are other users in the same Yahoo Chatroom can confirm that when they change their keyboard to USB one are able to work fine too?

Basically, why would you worry at this stage and expecting

Finally just posting “names” like “test app” & “something called “tech kit” will not do any good, since nobody can ever evaluate this. That is not a proper malware investigation by any means
… including the fact that neither CCleaner nor any other Reg cleaner can be considered being a Tools for malware fighting/research. etc.

No need to be frustrated &/or paranoid [at] this point . If you suspect “tech kit” or something just submit file(s) belonging to it to any vendor you want and/or on-line

Contact Yahoo support. I’m almost sure that could be the case taking into the account similar trouble other users of the chat are experiencing.
Post more details about the keyboard ; read this forum searching “keyboard” & find how other users suspected malware when that was just hardware issue or … again an issue with the particular Software

Hope that will help

Cheers!

#6

My keyboard is a laptop keyboard. I had to disassemble it from the laptop to remove it.

The USB keyboard is precisely what it sounds like… an external keyboard that plugs into a USB port.

As to proper malware investigation, this is not my expertise. As such when something like this happens I approach the people who provide my security software for potential answers.

I thought I was describing my issue as completely as I could. I post “names” because this is information that I thought “might” be of some value, as in someone might recognize these “names”.

As for the chat rooms, I have asked people in other chat rooms and they have never been troubled by this issue… in this one chat-room, Yahoo Politics Lobby: 2, several people spoke up that they too had experienced this condition. People often gravitate to specific chat-rooms and stay there… so I was suspect that this room has a code vandal with some new trick. And again… having a problem that appears to be an outside entity gaining access to my computer and doing naughty things… it seemed “reasonable” to me to query the people who produce my Security software.

Perhaps I should have just posted this question: “Has anyone ever heard of an attack that can disable a section of a keyboard?”

BTW… Before I ever posted I searched for anything related to “keyboard” and got zero results.

#7
I'll do my best to describe this. IN a particular Yahoo Chatroom, twice now I have found my ENTER key disabled (also the backspace key and the | key, so its as if whatever is doing this is disabling a section of keys.

So, The Enter and | and Backspace key works every where else but this chatroom?

Could you Please Download This Tool and Run As Administrator and Post the Report on your next reply

Thanks

#8

Hi again,

Please do what Jacob said - that is his approach. I have nothing against it. Probably worth trying
… but while Jacob posted I was preparing this reply , so you may be interested:

======= here we go

Not sure how that happened but attached image shows 2 pages of search using “keyboard” as a keyword. Try going to the home page of a forum and search again

Yes I know what is USB keyboard & I’m using one on my laptop as well.
Then as pointed sometimes laptop’s keyboard and mouse pad can misbehave
That happens to many users. After one of MS updates mine stopped working properly as well (flickering; cursor was moving like crazy in any edit box, etc.) All you have to do in most cases – go to the laptop vendor site & download/reinstall respective updated drivers.

Current lack of experience in investigation procedure is not a problem – you’ll get one if you have will to learn. And the that’s why I posted one of possible steps (submitting) if you are suspecting particular Software.
Note: Add as much info about your system as a matter of fact: OS Service Pack, platform (32bit or x64); main Security; additional security if any… and so on
As for the answers from people who provide you security – that was my other point – as I can see it that is not a security issue. But if it is – there is a procedure here , which describes how to file a report in case you think that you security is failing to protect you or having a bug.

well that’s fine and that’s why I asked. Thanks for answering. But the essence of my message was: please test any other chat room yourself using you laptop keyboard.

Sure any decent malware writer can attack that or the whole keyboard. That can be written in 10 min. What is the point unless the attacker is a simple “amateur learning newbie” in the 1st place?
That would be identified practically by any security … no questions about Defense+ or decent Behavioral Blocker
Who would do that instead of trying to install a sophisticated keylogger, for example?

Then, simple hardware issue (including incorrect driver) can be easily mixed with malware having similar symptoms
What I’m trying to convey - I still believe (according to the description provided by you) that the issue is on a server site/ Yahoo chat only at the moment

Have you contacted Yahoo admins, as it was asked above?

Finally, you may or you may not believe to what I’m saying – That’s fine & in addition we all can be wrong sometimes.
Therefore, if you still think that it’s a malware on your and other Yahoo Chat users computers – important!!! but not a bug or malicious probe on a server site please consider posting and addressing/investigating the issue properly

There are several respective sites where you can join / post a description of an issue/ and follow the instructions by certified malware fighter professional, who will gather needed info about you computer in particular and then lead you through the process if any suspects found “locally” so to speak

If you are ready to do that - just let us know & we can post links to such sites, otherwise you will be in the dark as long as you want

My regards

[attachment deleted by admin]

#9

Here’s a summary if you’re in a hurry:

  1. Clean the keyboard. It might actually help.
  2. Check for conflicts.
  3. Do a clean reinstallation of the Yahoo!/pseudo-Yahoo! app.
  4. Contact Yahoo!.
  5. See a technician. The keyboard may be faulty.
  6. To suspect that it is caused by malware just doesn’t add up. I am not stating that your system is perfectly clean, only that malware causing this kind of problem is improbable.

-------------------------------------------------FULL MESSAGE BELOW-------------------------------------------------
If I may…

I agree with SiberLynx. There isn’t much information provided. A guide format for posting problems is provided somewhere in the forums.

Did a little searching and here you are: https://forums.comodo.com/bug-reports-cis/format-please-use-it-t61845.0.html (Yes, I know it’s for bugs, but the info included can point you where to begin. Edit it and fill out whatever is applicable).

I can imagine only three possible explanations for your current trouble:

  1. It would seem that the problem would be on the keyboard. I have experience concerning malfunctioning laptop/desktop/USB/Bluetooth keyboards. Most of the time, they require cleaning and/or are damaged (the wiring and/or probably the keys themselves. You did say that it was the backspace, | and enter key, right? These three are commonly in line with each other. Perhaps the keyboard has a problem or requires cleaning).

  2. If not, then it is quite possible that the problem is with the yahoo! application itself (not the servers. They do not produce these kinds of problems). Usually, the problem is caused by a corrupt installation due to conflicting software/corrupt installers/outdated yahoo! applications (i don’t know why, but it’s a pattern i observe in other systems) or pseudo-yahoo! apps/etc. Reinstallation could fix this.

  3. Or it could be another bug from the Yahoo! application. Yahoo! Messenger has been known to contain bugs involving unrecognized keystrokes, invisible characters, uneditable chatbox, etc. (mostly concerning chatting and typing). At this point, seek help from Yahoo!.

Yes, of course, malware is a suspect, but to disable only a section of the keys is not worth doing at all if not for anything but educational purposes only. Even then, detection would not be a problem. Moreover, the USB keyboard worked fine. If it was a malware focused on disabling keys, the problem would have persisted. So no need to worry about it being a malware-caused. However, I advice that you have those two unrecognized items checked out. Do a little googleing (I can’t believe I just used “googleing”) and to be on the safer side of the road, have their executables checked out on http://www.virustotal.com

Hope that one of these could resolve your problem or help at least. Don’t hesitate to ask though I’m thinking that at this point, you could either pm us (Jacob, SiberLynx, Valentin, and I) or continue posting in General discussion (i’m not saying you posted wrongly. You did think before that it was caused by malware so it was once a security issue).

Then again, posting here would increase your chances of receiving answers since this is more frequently visited and any other person having the same suspicion would find it easier to find this and resolve his/her troubles…I retract what I said. PM us or keep posting (here). ;D

Have a nice day.

#10

This thread can be considered solved as a hardware issue.

A circumstance that seems to happen during a specific activity (Yahoo Chat) but really apparently only “seems” to because of the vast % of time spent in this activity.

The major complicating factor was when other people in the chat room said they were experiencing the same thing. This I cannot explain. A new replacement laptop keyboard has corrected this intermittent problem.

While this is of course technically embarrassing, I am semi-vindicated of my paranoia by one of the above posts stating that … “Sure any decent malware writer can attack that or the whole keyboard. That can be written in 10 min. What is the point unless the attacker is a simple “amateur learning newbie” in the 1st place?”

The spiteful malicious nonsense that goes on by a certain techno-malicious sub-culture in chat perpetually amazes the people in chat who simply wish to talk about the subject matter of the forum… This is after all the reason security software exists; isn’t it. Now if we could only do something about the same caliber of people when they urinate on public toilet seats on purpose!

Anyways… problem solved. Thanks for the indulgence… I have learned perhaps a little thru the experience.