Question

Locked

Strange scripts

By sentience ·
We run a keylogger on some of our desktop machines at work. This is because a while back we caught someone stealing valuable company data, and since then have warned staff that they will be monitored in this way. I have lately become concerned because on three out of the 12 desktop machines I keep seeing entries like this presenting themselves in the logs of the keylogger (not always the same keypresses)

*/{PgUp}{Scroll Lock}{Ctrl}{F12}{Back Space}{F9}{F7}{F4}{F8}{F1}9[{Enter}02{Right}{Down}{Left Win}{Left Win}{Left Win}{Left Win}{Left Win}{Left Win}{Left Win}{Left Win}{Left Win}{Left Win}{Left Win}{Left Win}{Left Win}{Left Win}{Left Win}{Left Win}{Left Win}{Left Win}{Left Win}{Left Win}{Left Win}{Left Win}{Left Win}{Left Win}{Alt}{Alt}{Alt}{Alt}{Alt}{Alt}

This always happens in the early hours of the morning when it is not possible for anyone to gain entry to the office

My question is, how do I start tracing the root cause of this and how do I prevent this happening? Does anyone know what this could be?

Some facts: There are no event log entries corresponding to this set of events. Sometimes the desktops have no open apps running when it happens and no startup entries defined that would achieve this effect.
I thought I would add another set of keypresses from a different machine so you will have more info

{Ctrl}c{Ctrl}v{Back Space}{Home}{Del}{Del}
{Scroll Lock}{PgUp}{Shift}*{Back Space} ={Enter}
{F10}{F9}3{F3}2{F2}{F8}{F9}{F10}{F3}{F2}45
45rtyh ,{Right Win}{Ctrl}1{Left}{Right}52

I would be grateful if someone could even tell me a little more about what might be happening. Thank you .

This conversation is currently closed to new comments.

3 total posts (Page 1 of 1)  
| Thread display: Collapse - | Expand +

All Answers

Collapse -

Weird

by seanferd In reply to Strange scripts

Looks like some auto keystroke software or macro. Odd behavior, though, whether it is some type of malware, or something set to respond to a program to keep it running automatically. Could it be something that is simply trying to defeat a power management or screensaver setting?

Anyone have AutoIt or similar installed?

Collapse -

no luck yet

by sentience In reply to Weird

Thanks for the replies.

Its not the keylogger software because the problem only occurs on 3 machines and 12 have the software.
There are no programs to defeat powersaving etc. I an getting drawn to the view that they could be Office macro's from microsoft office. Is there any way to disable scripts of any kind running on the computer but still allowing javascript in the web browsers when they want it ?

Collapse -

I would say it would be your key logging system.

Since you said "it is not possible for anyone to gain entry to the office". So i would trace this back to your key logging program/system.
Or there might be a few keys that are sticking on some keyboards. So get some new keyboards and see if this fixes the issue.

Please post back if you have any more problems or questions.
If this info is useful, please give a thumbs up. Thanks

Back to Desktop Forum
3 total posts (Page 1 of 1)  

Related Discussions

Related Forums