1

I was writing some text on my Windows 10 computer and suddenly characters and words that I wasn't typing showed up.

I removed the mouse and keyboard dongle and turned on airplane mode but it didn't stop. Still, text that I soon recognized as a comment I wrote on some website one month ago continued to appear.

It was written at the exact same pace I had, and all the operations I did were repeated, like writing some words, then going back to change them. Here's a little video I took after turning of the keyboard:

text self writing

Unfortunately I didn't think about checking the running processes before restarting the computer. For now, the problem didn't come back.

I did full scans with multiple softwares like Microsoft Defender, Malwarebytes, Sophos and Kaspersky Virus removal tools... but without any result.

At first I though that it could be some kind of keylogger, but what would be the purpose of replaying these keystrokes on my computer?

What could be the cause of this behaviour?

Note: I see my question as been marked as duplicate of this one but I'm not asking how to remove malicious spyware from my PC. I was just searching to understand this strange behaviour, as I would have expect from a keylogger to collect data without me knowing.

Improve this question
1
  • We cannot tell you what software or source is doing this. The issue is most likely that you have malware, and so this IS a duplicate and should remain closed.
    – music2myear
    Oct 8, 2020 at 4:22

2 Answers 2

Reset to default
3

This is extremely strange behaviour. There is no bug or native feature that might cause the behaviour you are experiencing. It could indeed be malware, but i am unsure of what the end goal may be other than to instil fear into the user. Generally unwanted services or applications being launched without your intent would point to some form of malware, but again this is a very confusing issue, never seen something like this before. You are likely correct in assuming it would be best to start from fresh.

#Edit: One other possibility I have just thought of, is perhaps you have a macro keyboard and at one point hit record, and did not notice. This could have resulted in a whole session of logged keystrokes, and typing, to the point that it is perfectly emulating your behaviour. If you then accidentally replay this macro, you could then experience the situation you have described above

Improve this answer
4
  • 2
    Thank you. You've got a point,what would be the purpose of a malware to do this? I would expect a keylogger to collect data and send them to the hacker without me knowing about it.
    – Michaël Polla
    Sep 29, 2020 at 19:06
  • 1
    The fact that it has keystrokes "saved" and is capable of replaying them, yes I would expect so. Honestly it could be the case that the replaying of keystrokes is an unintentional side effect. One other possibility I have just thought of, is perhaps you have a macro keyboard and at one point hit record, and did not notice. This could have resulted in a whole session of logged keystrokes, and typing, to the point that it is perfectly emulating your behaviour. If you then accidentally replay this macro, you could then experience the situation you have described above.
    – paddywan
    Sep 30, 2020 at 7:21
  • 1
    THANK YOU SO MUCH! I have a logitech G915 keyboard allows to record macros. I didn't know but I should have created one by accident. It was defined on the G5 key, which is just next to the CTRL key. Probably when I was typing some keyboard shortcut involving this key, I typed the wrong one (the G5), thus launching the macro.
    – Michaël Polla
    Sep 30, 2020 at 18:59
  • 1
    No problem, glad you did not have to format.
    – paddywan
    Sep 30, 2020 at 19:33
2

Given that you removed the mouse and keyboard (assuming no other devices connected over USB that aren't identified) then it can only be a software issue. This is very weird and in my own opinion can only be the work of malware such as a keylogger somehow playing back the keys (or a remote process injecting keystrokes - which still is a result of an infection).

I would immediately shut down and boot into a live Linux USB (or mount your HDD/SSD into an external enclosure) to get your sensitive files, and then wipe the drive. Afterwords, or at the same time from a known secure computer or your phone you should change ALL of your passwords for anything remotely sensitive. Whatever it is has clearly demonstrated recording your keystrokes which means you can assume whatever you type (including passwords) have been compromised.

Check on your email service if your account has been accessed from another location to see if you have been compromised further.

Improve this answer

Not the answer you're looking for? Browse other questions tagged .