Mysterious keyboard behavior: accidental or malicious?
March 19, 2010 10:11 AM Subscribe
My MacBook's keyboard mysteriously changed to Dvorak! How can I tell if someone messed with my computer?
I like to think I'm fairly computer-savvy, but I don't know anything about security, so I have no idea how this could have happened. I don't think anyone could have used my computer but me, since it does have a password, but I know I didn't change it. Could someone have done this remotely? Could it somehow happen by accident? Are there any log files/etc. I could look at?
(I have booted up in Linux to post this and to look up how to change it back to QWERTY. I assume changing it back won't be a problem.)
I like to think I'm fairly computer-savvy, but I don't know anything about security, so I have no idea how this could have happened. I don't think anyone could have used my computer but me, since it does have a password, but I know I didn't change it. Could someone have done this remotely? Could it somehow happen by accident? Are there any log files/etc. I could look at?
(I have booted up in Linux to post this and to look up how to change it back to QWERTY. I assume changing it back won't be a problem.)
If you suspect that someone may have accessed your computer, you can check the log files. In the GUI, you can go to the Utilities folder and open the Console application - a sloppy attacker probably wouldn't have bothered to scrub the log files, and you could see if anyone got in. I would check your firewall settings as well in the Preferences pane - make sure that you are not accepting all incoming connections, and enable stealth mode if it isn't enabled already.
It's entirely possible that the DVORAK change was the result of a random event, too. During the era of OS 9 my Mac was constantly messed up with stuff like this - clock weirdness, language reverted to default English even though my language was changed, etc. - until I finally figured out that my battery was faulty. I also learned about zapping the PRAM - it was a legendary OS 9 cure all back in the day. So it's entirely possible that this is a hardware problem or even something introduced by a software installation.
Good luck - I hope you can resolve it!
posted by Despondent_Monkey at 11:28 AM on March 19, 2010
It's entirely possible that the DVORAK change was the result of a random event, too. During the era of OS 9 my Mac was constantly messed up with stuff like this - clock weirdness, language reverted to default English even though my language was changed, etc. - until I finally figured out that my battery was faulty. I also learned about zapping the PRAM - it was a legendary OS 9 cure all back in the day. So it's entirely possible that this is a hardware problem or even something introduced by a software installation.
Good luck - I hope you can resolve it!
posted by Despondent_Monkey at 11:28 AM on March 19, 2010
Response by poster: I know how to look at Console, but there are dozens of different logs in there. What log files should I be looking at, and what would I see in those files if someone else had accessed the computer?
That shock thing is bizarre! I don't think that's what happened to me. Also, in case it matters, I'm running Mac OS 10.5.8.
posted by k. at 11:52 AM on March 19, 2010
That shock thing is bizarre! I don't think that's what happened to me. Also, in case it matters, I'm running Mac OS 10.5.8.
posted by k. at 11:52 AM on March 19, 2010
Response by poster: The firewall was turned on (with exceptions for certain programs that need incoming connections), but not stealth mode. Also, I did not turn the computer off during the time when the switch occured, only put it to sleep. I have re-started it once since then and it was still Dvorak.
I am running some non-standard software: the driver for a Microsoft keyboard (a System Preferences plugin and a kernel extension) and "Logitech Control Center" for a Logitech mouse (a daemon that runs under my username). I haven't actually been using those devices, though.
posted by k. at 12:09 PM on March 19, 2010
I am running some non-standard software: the driver for a Microsoft keyboard (a System Preferences plugin and a kernel extension) and "Logitech Control Center" for a Logitech mouse (a daemon that runs under my username). I haven't actually been using those devices, though.
posted by k. at 12:09 PM on March 19, 2010
One possibility is someone you let borrow the computer switched it to Dvorak for their own use. In the menu bar you might see an icon that says DV. If you click on that you should drop and you'll see a little US flag icon (or whatever language/country region). It's possible that you inadvertently switched it using that menu bar icon. It would only take an accidental mouse click or two.
If that's not there (it'd be somewhere on the right side of the menu bar) then you can change it back under System Preferences. It's somewhere under Language or International or Keyboard or Regional. I don't have my Mac handy so I forget exactly which, but it shouldn't be hard to find.
As for how this happened, if it wasn't an accidental switch with the menu bar icon, maybe someone is playing a prank? Who else has access to the computer? I kind of doubt it's some malicious thing.
posted by 6550 at 12:17 PM on March 19, 2010
If that's not there (it'd be somewhere on the right side of the menu bar) then you can change it back under System Preferences. It's somewhere under Language or International or Keyboard or Regional. I don't have my Mac handy so I forget exactly which, but it shouldn't be hard to find.
As for how this happened, if it wasn't an accidental switch with the menu bar icon, maybe someone is playing a prank? Who else has access to the computer? I kind of doubt it's some malicious thing.
posted by 6550 at 12:17 PM on March 19, 2010
Response by poster: I didn't knowingly let anyone borrow the computer. (I have changed it back now; I had forgotten the setting was under "International". I don't have that menu bar thing turned on since I never change from QWERTY voluntarily.)
posted by k. at 12:30 PM on March 19, 2010
posted by k. at 12:30 PM on March 19, 2010
If you have it enabled, there is a default Keyboard shortcut of Command + Space to change input source (keyboard). You can check under System Preferences: Keyboard: Keyboard Shortcuts. It will or will not be in the list on the right (this is on Mac OS X 10.6).
posted by qwip at 1:39 PM on March 19, 2010
posted by qwip at 1:39 PM on March 19, 2010
I wouldn't worry too much about the possibility of someone messing with your machine; it's pretty easy to accidentally hit the keyboard shortcut to change input sources. (Deliberately so, since the people who actually need this feature use it frequently.) That's almost certainly what happened here.
If this keeps happening, just open up prefs and disable the shortcut or change it to something harder to hit by mistake. (In 10.6 it's under "Language & Text" -> "Keyboard Shortcuts"; but I don't remember if 10.5 was different.)
posted by ook at 8:58 AM on March 20, 2010
If this keeps happening, just open up prefs and disable the shortcut or change it to something harder to hit by mistake. (In 10.6 it's under "Language & Text" -> "Keyboard Shortcuts"; but I don't remember if 10.5 was different.)
posted by ook at 8:58 AM on March 20, 2010
This thread is closed to new comments.
I'm not dismissing the possibility that someone else changed it, but here's another possibility: my previous iBook used to change from English to Cyrillic or Norwegian at least once a winter. I finally realized that I was building up a small static charge in the dry winter weather, and occasionally failing to discharge it before touching my iBook. Once I started being more careful about the static charge, the keyboard switch stopped happening.
That's right: evidently, I shocked my computer into a (seemingly but not actually spontaneous) change of language.
posted by Elsa at 11:02 AM on March 19, 2010