Possible Virus or Spyware?

[Elmar66]

I've had a couple of users recently that have been prompted to change their MS domain password while in the middle of working on an application or in e-mail.

Odd thing is this prompt not only asks for their domain but their exchange server name as well.

This seems VERY suspicious!

 

[aquias]

On these systems, have you run any antivirus/spyware removal tools?

 

[MichealC4]

I had a user (just a single user, haven't heard from anybody else yet) that had that happen while she was in the middle of an Excel spreadsheet. I couldn't find anything suspicious on her pc though, and she had already gone through typing in her password and such before she called me, so I didn't get to see it unfortunately. I have never heard of it before, so no clue.

----------------------------
"Will work for bandwidth" - Thinkgeek T-shirt

 

[aquias]

My thoughts on this, if/when a user is prompted start off running hijack this!. If this is indeed a "rogue" process it should be caught and listed.