SOLVED kbdclass.sys DRIVER_IRQL_NOT_LESS_OR_EQUAL


Joined
May 1, 2014
Messages
17
Reaction score
0
As the title would suggest, I'm getting BSOD's that call out the kbdclass.sys file. It seems to be related to USB devices because I can plug in old school mice and keyboards and don't get any BSOD, but as soon as I plug in a USB keyboard or mouse it will crash when I use them. It is most unstable when I'm using more than one at a time.

I tried updating some drivers and I've updated the BIOS, but nothing seems to be making any kind of difference. The strange thing is that in all the minidump files there is one common filename that it id's as a probable cause: ntoskrnl.exe. This is strange because the BSOD always calls out the kbdclass.sys, even though it doesn't always appear to be a problem.

I've attached a few minidump files, any help is much appreciated.
 

Attachments

Ad

Advertisements

Joined
May 1, 2014
Messages
17
Reaction score
0
I've run TDSSkiller and Rkill, both came back with no issues.

I should have provided my system specs, here they are:

Windows 7 Pro 64 SP1
CPU-Z_CPU.png
CPU-Z_Mainboard.png
CPU-Z_Memory.png
 

Shintaro

Moderator
Joined
Mar 1, 2012
Messages
2,137
Reaction score
252
Welcome to the W7Forums.

So what kind of keyboard are you plugging in? Because you are correct kbdclass.sys is for the keyboard.
 
Joined
May 1, 2014
Messages
17
Reaction score
0
I've tried three different keyboards with a USB connection: Logitech, Dell, Microsoft. Using a keyboard alone doesn't seem to cause the crash. If I use just a keyboard and don't have the mouse plugged in I haven't seen a BSOD...it is just really slow going. When I plug a mouse in, I can type about 5 keys before BSOD. I've tried three different mice with USB as well, and all the combinations. There are 8 USB ports on the computer, I've tried many combinations to almost eliminate the possibility of a shorted USB connectoin.

I'm using a Microsoft v1.0 keyboard right now with the PS/2 connection as well as a mouse with the PS/2, which is stable and doesn't cause the BSOD.
 

Shintaro

Moderator
Joined
Mar 1, 2012
Messages
2,137
Reaction score
252
Mate,

Best to start off with a virus scan.

When you have completed each one, take a screen shot and post it to the forum.

  1. Download and run TDSSKiller.
  2. Install Malwarebytes (Free Version) and scan your computer.
  3. Please download and run Windows Defender Offline. It will create a CD / DVD / USB and will boot and scan your hard drive offline.
  4. Download CPU-Z and run it. Go to the "About" tab and save it as a txt (text) file. Upload the text file to the forum.
 

Shintaro

Moderator
Joined
Mar 1, 2012
Messages
2,137
Reaction score
252
The reason I am asking you to run a virus scan, even though you probably have an Anti-virus installed, is that it sounds like a virus is trying to steal your key strokes (aka keyboard sniffer, stealing the IRP packets). The thing is it is probably poorly written driver/program. And possibly the virus programmer assumed that nobody uses PS/2 connections anymore. Hence why PS/2 is ok.

Well that's my theory anyway, BUT I could be wrong.;)
 
Ad

Advertisements

Joined
May 1, 2014
Messages
17
Reaction score
0
Well, I'm still waiting for the Windows Defender Offline to finish scanning...going on 5 hours now. I did the quick scan already, it came back clean. It is now running the full scan.

TDSS Killer screenshot.png
mbam scan report.png
I've attached images of the TDSS and Malwarebytes scans. I had already run the TDSS, had the same result. The MBAM scan found a few things, but I don't think it is related to the issue I'm having. I will post when the defender finishes, as well as the "about" tab for the CPU-Z. Note that there are screenshots of the CPU-z in an earlier post as well.

Thanks for the input.
 
Joined
May 1, 2014
Messages
17
Reaction score
0
The windows defender finally finished, see attached "screenshot" of the scan. I've also attached the .txt version of the CPU-z report.

Thank you!
WinDefOffline_screenshotlr.png
 

Attachments

Shintaro

Moderator
Joined
Mar 1, 2012
Messages
2,137
Reaction score
252
Ok, that's strange.

Are you using a USB hub or something similar?

Anyway run Driver Verifier and make it crash. Then please put the crash file in a zip file and upload it to the forum.


Driver verifier

The Driver Verifier tool that is included in every version of Windows since Windows 2000 it is used to detect and troubleshoot many driver issues that are known to cause system corruption, failures, or other unpredictable behavior.

***FIRST: Please backup your stuff and then make sure you've got access to another computer so you can contact us if problems arise.
Then make a System Restore point (so you can restore the system using the Windows 7 Startup Repair feature.)
  1. Go to Start and type in "verifier" (without the quotes) and press Enter
  2. Select "Create custom settings (for code developers)" and click "Next"
  3. Select "Select individual settings from a full list" and click "Next"
  4. Select:
    ---- Special Pool
    ---- Pool Tracking
    ---- Force IRQL Checking
    ----Deadlock Detection
    ---- Security Checks (Windows 7 & 8)
    ---- DDI compliance checking (Windows 8)
    ---- Miscellaneous Checks
  5. Click "Next"
  6. Select "Select driver names from a list" and click "Next"
  7. Then select all drivers NOT provided by Microsoft and click "Next"
  8. Select "Finish" on the next page.
Reboot the system and wait for it to crash to the Blue Screen.
Continue to use your system normally, and if you know what causes the crash, do that repeatedly.
The objective here is to get the system to crash because Driver Verifier is stressing the drivers out.

How Long should I wait for a crash?

- If it doesn't crash for you, then let it run for at least 36 hours of continuous operation.

How do I turn Driver Verifier off?!

- Reboot into Windows (after the crash) and turn off Driver Verifier by going back in and selecting "Delete existing settings" on the first page.

- Or press the Windows Key + R, and type in "verifier /reset" (Without the quotes)

- Then locate and zip up the memory dump file and upload it with your next post. then locate and zip up the memory dump file and upload it with your next post.

I can't get in to Windows, what do I do?

- If Windows will not start and get to a login screen or desktop, because it crashes too soon, try it in Safe Mode.


- If you can't get into Safe Mode, try using System Restore from your installation DVD to set the system back to the previous restore point that you created.

How do I put the crash dump files in a Zip file?

Instructions on putting files in a Zip file and extracting (Taking them out) again are explained HERE.
 
Joined
May 1, 2014
Messages
17
Reaction score
0
Finally had the opportunity to do this, attached is the memory dump and a screenshot of the BSOD. Note that the BSOD screen that was shown is not the one that the bluescreen viewer will show you. In fact, kbdclass.sys does not even come up (as far as I can tell) as an issue in the memory dump.

Thanks again for your help, this is driving me nuts!:confused:
140509_BSOD screenshot.png
 

Attachments

Shintaro

Moderator
Joined
Mar 1, 2012
Messages
2,137
Reaction score
252
Mate,

Driver Verifier was not on. Please make sure it is on.

You can check if Driver Verifier is still on by typing in a command prompt:
Code:
verifier /querysettings
It should look similar to this:

Code:
Enabled Flags Value: 0x0002092B

Standard Flags:
  [X] (0x00000001) Special pool
  [X] (0x00000002) Force IRQL checking
  [X] (0x00000008) Pool tracking
  [ ] (0x00000010) I/O verification
  [X] (0x00000020) Deadlock detection
  [ ] (0x00000080) DMA checking
  [X] (0x00000100) Security checks
  [X] (0x00000800) Miscellaneous checks
  [X] (0x00020000) DDI compliance checking
 
Ad

Advertisements

Shintaro

Moderator
Joined
Mar 1, 2012
Messages
2,137
Reaction score
252
Also, open a command prompt as Administrator and type in the following:
Code:
wmic recoveros set DebugInfoType = 2
Please make sure you see that the command was "Successful".
 
Joined
May 1, 2014
Messages
17
Reaction score
0
Sorry about that, I had it on the Minidump output instead of Kernel. Here is the new dump file.

Thank you!

PS - Sorry for the delay, I was out of town last week.
 

Attachments

Shintaro

Moderator
Joined
Mar 1, 2012
Messages
2,137
Reaction score
252
Mate,

No problem about the delay. We are here to help.

What type (Brand / Model No. ) of USB Keyboard are you using?

There is a file in the c:\windows\system32\drivers directory called fwkbdrtm.sys
Could you please take a screen shot of the "Properties" of that file and post it to the forum.

The reason I ask is that I cannot find any information on it. Also it was on the stack prior to the kbdclass driver crashing.

Code:
  *** Stack trace for last set context - .thread/.cxr resets it
 # Child-SP  RetAddr  Call Site
00 fffff880`02f99408 fffff880`0f00eaf4 kbdclass!memcpy+0x64
01 fffff880`02f99410 fffff880`0f001338 kbdclass!KeyboardClassServiceCallback+0x164
02 fffff880`02f99490 fffffa80`0dbffdcc fwkbdrtm+0x1338
03 fffff880`02f99498 fffffa80`0dbffdc0 0xfffffa80`0dbffdcc
04 fffff880`02f994a0 00000000`0000000e 0xfffffa80`0dbffdc0
05 fffff880`02f994a8 00000000`00000000 0xe
 
Joined
May 1, 2014
Messages
17
Reaction score
0
Hi Shintaro,

It looks like this is a driver that is part of the Siemens Simotion Software that we use, though it could be from one of the other Siemens applications. I have attached screenshots of the General, Digital Signatures, and Details tabs from the properties window.

Thanks!
fwkbdrtm.sys Properties - Details - Copy.png
fwkbdrtm.sys Properties - Digital Signatures - Copy.png
fwkbdrtm.sys Properties - General - Copy.png
 
Joined
May 1, 2014
Messages
17
Reaction score
0
Sorry, forgot to answer your question about the keyboard. The one that I was using during that BSOD was a Key Tronic, P/N: KT400U2 via USB.
 
Ad

Advertisements

Shintaro

Moderator
Joined
Mar 1, 2012
Messages
2,137
Reaction score
252
Is it possible to uninstall the Siemens software for a short time? Just to see if the crashes go away?
That Siemens filter driver probably re-maps the keyboard and might be the cause, considering it is a couple of years old.
 
Joined
May 1, 2014
Messages
17
Reaction score
0
Yeah...it's possible. Only slightly less of a pain than wiping the disc and reinstalling Windows, but possible. I'll let you know how it goes.
 

Shintaro

Moderator
Joined
Mar 1, 2012
Messages
2,137
Reaction score
252
I know it's a pain, but it will quickly determine if it is the problem.

Let us know how you go.
 
Ad

Advertisements

Joined
May 1, 2014
Messages
17
Reaction score
0
So, I uninstalled all 7 Siemens programs and now seeing what looks like the same BSOD... I've attached the dump file for reference.

I uninstalled the programs using Revo Uninstaller's 'Advanced' mode and removed all the additional registry items, files and folders that were left by they software's uninstaller. Is there a way to remove that driver or have it not called?

Thanks.
 

Attachments


Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Top