Okay, I have a tough one for you guys, mostly because I have to relay the symptoms 2nd hand. I have not sat down at this computer because it's pretty far away, and I would wait to ask here until I had messed with it, but they're in a bit of a rush.

The user believes that her problems started when opening an email from someone she knew, and believes to have vision problems. The issue is that now her computer is going nuts with effects that appear as if someone went and loaded a slew of accessibility apps on her computer. She's getting really large text, strange reactions from typing, and random text-to-speech. Also, when she tried restarting, when she tries logging in, every time she hits the "s" key, the product is actually "sdfjkl return" which naturally makes her fail her login. Now she can't even access her computer. While she was logged in, I had her go to the accessibility options in control panel, but nothing was enabled.

Has anyone heard of such a thing happening?

Keyboard failing? Some Windows accessibility stuff turns itself on if it suspects you're not managing to use the keyboard properly, e.g. keys held down a lot.

Peter

It's possible. She didn't have any keyboards handy, so I'm not sure.

*edit*
Apparently she just restarted for the fourth time and now it's magically working again. Go figure...

I'll second the possibility of a failing keyboard, or simply a loose keyboard plug.

But if it happened immediately after the email, maybe it was an email-borne virus, perhaps one that exploited a web preview or outlook preview feature. But there's equal odds that the email is unrelated to the behavior.

Note: If the accessibility features got turned on because of the failing keyboard, the user is going to have to figure out how to turn them all off again.

Oh, third possibility: The user has one of those macro-capable keyboards and it got programmed with a macro.

The old Gateway Anykey keyboards were notorious for this. One accidental press of one of the keys on the keyboard (it happened to be an easy to hit key on the upper right corner), and you were instantly (and without warning) in Macro-Creation mode. Anything you typed after that was a macro. So for example, you would press the S key and it didn't do anything. So you'd pound on asdfjkl to see if they worked. They didn't. Well, what you didn't realize was that you just programmed the S key to play back a macro of asdfjkl. And now every time you press S...

Anyway, that *also* sounds like the symptoms. But hopefully this user doesn't have one of those kinds of keyboards, otherwise they would have already run into this problem *years* ago.

Or something fell on the keyboard. I have that happen quite often and some accessibility feature will get turned on.

Or maybe it was the Windows-U key command, which launches Utility Manager. It's an accessibility feature not listed in the control panel. And after launching it with Win-U, the text-to-speech engine starts squawking at you, increasing the distracting WTF-factor as you fumble to turn it off.

But read the above linked article for some really fun info about utilman.exe. Win-U will launch it even before you're logged in, running as the SYSTEM. Replace utilman.exe with a malicious script and you've got yourself a backdoor that's only two keyboard presses away. Nice.

In order to replace utilman.exe, you need to already have sufficient privileges, which means you already 0wn the box. Not a security hole in itself.