Keyboard wont work on XP after virus, HELP!

[ClickRight]

Keyboard wont work on XP after virus, HELP! (solved)

A client's machine (Toshiba A110 laptop) was in for a virus removal. After taking out several viruses, the keyboard was not working and was showing Code 12 in the device manager. It appeared that there was a resource conflict between the keyboard and the touchpad.

After some digging around, I determined the code 12 error was caused because the following registry key was missing the Upperfilters for the keyboard:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E96B-E325-11CE-BFC1-08002BE10318}

So, I added the UpperFilters Key, set it to kbdclass, rebooted, and bam, no more code 12!

I thought I was good to go, but then went to type and nothing happened. I plugged in an external keyboard, and the same thing! I've been through everything I can think of to get it working but to no avail. Does anyone have a suggestion?

 

[nXtGenPC]

Nuke and Boot????

I havn't seen something like this in a long time.. usuly they go after the mouse... those tricky bastards

 

[drewster]

I've seen this same thing with a virus that corrupted/modified(?) the kbdclass.sys file. Restored from a known good copy and was good to go.

 

[iisjman07]

More than likely when you scanned the pc it had an infected driver, and instead of cleaning it, the AV deleted it. I'd compare it with a machine of the same OS and see if any are missing (try kbdclass.sys first, like Drewster said)

 

[ClickRight]

Thanks, trying a known good copy of kbdclass.sys was my second idea. Unfortunately it also didn't work. I tried restoring the registry to a time when the keyboard was working, but that didn't work either, so I know it's a file issue, just which one!?

 

[ClickRight]

I tried restoring the registry to a time when the keyboard was working, but that didn't work either, so I know it's a file issue, just which one!?

I take back this comment! I searched through the registry for every instance of kbdclass.sys, until l finally I came across:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Kbdclass

and I noticed that the "Parameters" key was missing. I exported the key from a known good registry, rebooted, and voila, keyboard! Thanks so much for pointing me in the right direction, drewster & iisjman07!

In case this happens to anyone else, here's the registry information I exported that fixed the issue.

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Kbdclass]
"ErrorControl"=dword:00000001
"Group"="Keyboard Class"
"Start"=dword:00000001
"Tag"=dword:00000001
"Type"=dword:00000001
"DisplayName"="Keyboard Class Driver"
"ImagePath"=hex(2):73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,44,00,\
52,00,49,00,56,00,45,00,52,00,53,00,5c,00,6b,00,62,00,64,00,63,00,6c,00,61,\
00,73,00,73,00,2e,00,73,00,79,00,73,00,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Kbdclass\Parameters]
"ConnectMultiplePorts"=dword:00000000
"KeyboardDataQueueSize"=dword:00000064
"KeyboardDeviceBaseName"="KeyboardClass"
"MaximumPortsServiced"=dword:00000003
"SendOutputToAllPorts"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Kbdclass\Enum]
"0"="Root\\RDP_KBD\\0000"
"Count"=dword:00000002
"NextInstance"=dword:00000002
"1"="ACPI\\PNP0303\\4&5289e18&0"

 

[iisjman07]

I say well done Drewster, good call on the kbdclass.sys file. Thanks ClickRight for actually posted how you fixed it instead of just saying 'its fixed!', this is useful information that you never know when you might need