SOLVED kbdclass.sys DRIVER_IRQL_NOT_LESS_OR_EQUAL

[disassociat911]

As the title would suggest, I'm getting BSOD's that call out the kbdclass.sys file. It seems to be related to USB devices because I can plug in old school mice and keyboards and don't get any BSOD, but as soon as I plug in a USB keyboard or mouse it will crash when I use them. It is most unstable when I'm using more than one at a time.

I tried updating some drivers and I've updated the BIOS, but nothing seems to be making any kind of difference. The strange thing is that in all the minidump files there is one common filename that it id's as a probable cause: ntoskrnl.exe. This is strange because the BSOD always calls out the kbdclass.sys, even though it doesn't always appear to be a problem.

I've attached a few minidump files, any help is much appreciated.

 

[disassociat911]

I've run TDSSkiller and Rkill, both came back with no issues.

I should have provided my system specs, here they are:

Windows 7 Pro 64 SP1

 

[Shintaro]

Welcome to the W7Forums.

So what kind of keyboard are you plugging in? Because you are correct kbdclass.sys is for the keyboard.

 

[disassociat911]

I've tried three different keyboards with a USB connection: Logitech, Dell, Microsoft. Using a keyboard alone doesn't seem to cause the crash. If I use just a keyboard and don't have the mouse plugged in I haven't seen a BSOD...it is just really slow going. When I plug a mouse in, I can type about 5 keys before BSOD. I've tried three different mice with USB as well, and all the combinations. There are 8 USB ports on the computer, I've tried many combinations to almost eliminate the possibility of a shorted USB connectoin.

I'm using a Microsoft v1.0 keyboard right now with the PS/2 connection as well as a mouse with the PS/2, which is stable and doesn't cause the BSOD.

 

[Shintaro]

Mate,

Best to start off with a virus scan.

When you have completed each one, take a screen shot and post it to the forum.

1. Download and run TDSSKiller.
2. Install Malwarebytes (Free Version) and scan your computer.
3. Please download and run Windows Defender Offline. It will create a CD / DVD / USB and will boot and scan your hard drive offline.
4. Download CPU-Z and run it. Go to the "About" tab and save it as a txt (text) file. Upload the text file to the forum.

 

[Shintaro]

The reason I am asking you to run a virus scan, even though you probably have an Anti-virus installed, is that it sounds like a virus is trying to steal your key strokes (aka keyboard sniffer, stealing the IRP packets). The thing is it is probably poorly written driver/program. And possibly the virus programmer assumed that nobody uses PS/2 connections anymore. Hence why PS/2 is ok.

Well that's my theory anyway, BUT I could be wrong.

 

[disassociat911]

Well, I'm still waiting for the Windows Defender Offline to finish scanning...going on 5 hours now. I did the quick scan already, it came back clean. It is now running the full scan.

I've attached images of the TDSS and Malwarebytes scans. I had already run the TDSS, had the same result. The MBAM scan found a few things, but I don't think it is related to the issue I'm having. I will post when the defender finishes, as well as the "about" tab for the CPU-Z. Note that there are screenshots of the CPU-z in an earlier post as well.

Thanks for the input.

 

[disassociat911]

The windows defender finally finished, see attached "screenshot" of the scan. I've also attached the .txt version of the CPU-z report.

Thank you!

 

[Shintaro]

Ok, that's strange.

Are you using a USB hub or something similar?

Anyway run Driver Verifier and make it crash. Then please put the crash file in a zip file and upload it to the forum.


Driver verifier

The Driver Verifier tool that is included in every version of Windows since Windows 2000 it is used to detect and troubleshoot many driver issues that are known to cause system corruption, failures, or other unpredictable behavior.

***FIRST: Please backup your stuff and then make sure you've got access to another computer so you can contact us if problems arise.
Then make a System Restore point (so you can restore the system using the Windows 7 Startup Repair feature.)

1. Go to Start and type in "verifier" (without the quotes) and press Enter
2. Select "Create custom settings (for code developers)" and click "Next"
3. Select "Select individual settings from a full list" and click "Next"
4. Select:
   ---- Special Pool
   ---- Pool Tracking
   ---- Force IRQL Checking
   ----Deadlock Detection
   ---- Security Checks (Windows 7 & 8)
   ---- DDI compliance checking (Windows 8)
   ---- Miscellaneous Checks
5. Click "Next"
6. Select "Select driver names from a list" and click "Next"
7. Then select all drivers NOT provided by Microsoft and click "Next"
8. Select "Finish" on the next page.

Reboot the system and wait for it to crash to the Blue Screen.
Continue to use your system normally, and if you know what causes the crash, do that repeatedly.
The objective here is to get the system to crash because Driver Verifier is stressing the drivers out.

How Long should I wait for a crash?

- If it doesn't crash for you, then let it run for at least 36 hours of continuous operation.

How do I turn Driver Verifier off?!

- Reboot into Windows (after the crash) and turn off Driver Verifier by going back in and selecting "Delete existing settings" on the first page.

- Or press the Windows Key + R, and type in "verifier /reset" (Without the quotes)

- Then locate and zip up the memory dump file and upload it with your next post. then locate and zip up the memory dump file and upload it with your next post.

I can't get in to Windows, what do I do?

- If Windows will not start and get to a login screen or desktop, because it crashes too soon, try it in Safe Mode.


- If you can't get into Safe Mode, try using System Restore from your installation DVD to set the system back to the previous restore point that you created.

How do I put the crash dump files in a Zip file?

Instructions on putting files in a Zip file and extracting (Taking them out) again are explained HERE.

 

[disassociat911]

Finally had the opportunity to do this, attached is the memory dump and a screenshot of the BSOD. Note that the BSOD screen that was shown is not the one that the bluescreen viewer will show you. In fact, kbdclass.sys does not even come up (as far as I can tell) as an issue in the memory dump.

Thanks again for your help, this is driving me nuts!

 

[Shintaro]

Mate,

Driver Verifier was not on. Please make sure it is on.

You can check if Driver Verifier is still on by typing in a command prompt:

verifier /querysettings

It should look similar to this:

Enabled Flags Value: 0x0002092B

Standard Flags:
  [X] (0x00000001) Special pool
  [X] (0x00000002) Force IRQL checking
  [X] (0x00000008) Pool tracking
  [ ] (0x00000010) I/O verification
  [X] (0x00000020) Deadlock detection
  [ ] (0x00000080) DMA checking
  [X] (0x00000100) Security checks
  [X] (0x00000800) Miscellaneous checks
  [X] (0x00020000) DDI compliance checking

 

[Shintaro]

Also, open a command prompt as Administrator and type in the following:

wmic recoveros set DebugInfoType = 2

Please make sure you see that the command was "Successful".

 

[disassociat911]

Sorry about that, I had it on the Minidump output instead of Kernel. Here is the new dump file.

Thank you!

PS - Sorry for the delay, I was out of town last week.

 

[Shintaro]

Mate,

No problem about the delay. We are here to help.

What type (Brand / Model No. ) of USB Keyboard are you using?

There is a file in the c:\windows\system32\drivers directory called fwkbdrtm.sys
Could you please take a screen shot of the "Properties" of that file and post it to the forum.

The reason I ask is that I cannot find any information on it. Also it was on the stack prior to the kbdclass driver crashing.

  *** Stack trace for last set context - .thread/.cxr resets it
 # Child-SP  RetAddr  Call Site
00 fffff880`02f99408 fffff880`0f00eaf4 kbdclass!memcpy+0x64
01 fffff880`02f99410 fffff880`0f001338 kbdclass!KeyboardClassServiceCallback+0x164
02 fffff880`02f99490 fffffa80`0dbffdcc fwkbdrtm+0x1338
03 fffff880`02f99498 fffffa80`0dbffdc0 0xfffffa80`0dbffdcc
04 fffff880`02f994a0 00000000`0000000e 0xfffffa80`0dbffdc0
05 fffff880`02f994a8 00000000`00000000 0xe

 

[disassociat911]

Hi Shintaro,

It looks like this is a driver that is part of the Siemens Simotion Software that we use, though it could be from one of the other Siemens applications. I have attached screenshots of the General, Digital Signatures, and Details tabs from the properties window.

Thanks!

 

[disassociat911]

Sorry, forgot to answer your question about the keyboard. The one that I was using during that BSOD was a Key Tronic, P/N: KT400U2 via USB.

 

[Shintaro]

Is it possible to uninstall the Siemens software for a short time? Just to see if the crashes go away?
That Siemens filter driver probably re-maps the keyboard and might be the cause, considering it is a couple of years old.

 

[disassociat911]

Yeah...it's possible. Only slightly less of a pain than wiping the disc and reinstalling Windows, but possible. I'll let you know how it goes.

 

[Shintaro]

I know it's a pain, but it will quickly determine if it is the problem.

Let us know how you go.

 

[disassociat911]

So, I uninstalled all 7 Siemens programs and now seeing what looks like the same BSOD... I've attached the dump file for reference.

I uninstalled the programs using Revo Uninstaller's 'Advanced' mode and removed all the additional registry items, files and folders that were left by they software's uninstaller. Is there a way to remove that driver or have it not called?

Thanks.