msheridan69
Topic Starter
Not sure if this is the correct forum to post on but I have a feeling that my issue is Windows/Hardware related.
ISSUE:
1. Users is our firm are randomly getting repeating keystrokes and computer beeping.
2. The repeating key is random for each user but they always experience the issue with that key.
3. We don't have sticky keys set and we have replaced keyboards.
I've included a Hijackthis log file and a detailed decription what our lates user was experiencing. This user frequestly get a repeating 'R' key with computer beeping (not PC Speaker)
THIS IS THE EMAIL HE SENT:
+++ EMAIL SNIP +++
Last night when I arrived in Brisbane and used my laptop in the hotel without a docking station, mouse or external keyboard, I consistently experienced issues with the r key / beeping. I also experienced this today Tuesday when I docked my laptop in the Brisbane office, although after a reboot it has (for now) stopped.
Firstly and as requested by Martin, attached are the hijackthis logs which I captured right at the time that the r key was stuck down, both last night and this morning.
(can't attach documents - I've embedded it at the end of this email)
Secondly, to further expand on my computer's symptoms:
The issue did not occur with continual consistency. At times I could type a whole sentence without the r key doing anything incorrectly, while at other times it would add a single r after I had typed a combination of letters - for example I'd type "th" and up on the screen I'd get "thr". Or, I'd type "an", and I'd end up with "anr". (Brian and Miles have seen this before when I was using my laptop last week.) As discussed with some of you previously, this is almost like an auto text gone wrong, although it happens outside of MS Office and in ANY application - even in the Windows, Start, Run box and notepad.
Sometimes though, r would not work at all until I pressed it several times - after this I would usually end up with a string of rrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrr which would continue sometimes for minutes filling literally the whole screen, other times only a few dozen r's long then stop by itself.. When this long string occurred it would fill a width of the screen almost instantly, compared to several seconds if you try to imitate it by manually holding down a key. (In my view this point alone rules out a physical 'key stuck' issue with my keyboard, as if it was physically stuck, it would be the same as holding down a key, which takes seconds to fill a whole line, not instantly)
Last night while on the laptop undocked, during a beeping session the mouse would stop working. (I believe its because the mouse isn't able to be moved at the same time as a key is stuck down.). Funny though is if I held any other key down, not only would this top the r, but allow me to move the mouse again.
Mirroring previously experiences, winlogon.exe was maxing out the CPU during a key stuck session. I also noticed a process that I haven't seen before up near the top when sorting by CPU usage in igfxsrvc.exe (Intel graphics / input driver I believe?). This is quite possibly a red herring given it was only using around 5% of CPU at the time of a beep, although as per my comment earlier I've never noticed this one up near the top before.
My own experience here may well be something totally different to what our customers are experiencing, but then again this to me would be an amazing coincidence given I'm using a standard firm build laptop.
So, pending everyone else's thoughts, here is what I'm suggesting as next steps:
Analysis into the hijack this logs, to see if this shows anything obvious.
When I return to Sydney on Thursday, I'll put my hard drive in another D410 laptop shell and see if this fixes the issue. If so, we can put this down as a hardware fault with my current D410 shell. If this doesn't resolve the issue (which I'm suspecting), then it has to be software.
We then work out next steps given I can reproduce this issue when working undocked. I welcome any thoughts from the team if we do get to this step. Winlogon.exe's high CPU usage during a beep may well be part of this as I do feel this is odd.
+++ EMAIL SNIP +++
As you can see - we'd really like to get the the bottom of this.
All comments welcome.
Cheers!
ISSUE:
1. Users is our firm are randomly getting repeating keystrokes and computer beeping.
2. The repeating key is random for each user but they always experience the issue with that key.
3. We don't have sticky keys set and we have replaced keyboards.
I've included a Hijackthis log file and a detailed decription what our lates user was experiencing. This user frequestly get a repeating 'R' key with computer beeping (not PC Speaker)
THIS IS THE EMAIL HE SENT:
+++ EMAIL SNIP +++
Last night when I arrived in Brisbane and used my laptop in the hotel without a docking station, mouse or external keyboard, I consistently experienced issues with the r key / beeping. I also experienced this today Tuesday when I docked my laptop in the Brisbane office, although after a reboot it has (for now) stopped.
Firstly and as requested by Martin, attached are the hijackthis logs which I captured right at the time that the r key was stuck down, both last night and this morning.
(can't attach documents - I've embedded it at the end of this email)
Secondly, to further expand on my computer's symptoms:
The issue did not occur with continual consistency. At times I could type a whole sentence without the r key doing anything incorrectly, while at other times it would add a single r after I had typed a combination of letters - for example I'd type "th" and up on the screen I'd get "thr". Or, I'd type "an", and I'd end up with "anr". (Brian and Miles have seen this before when I was using my laptop last week.) As discussed with some of you previously, this is almost like an auto text gone wrong, although it happens outside of MS Office and in ANY application - even in the Windows, Start, Run box and notepad.
Sometimes though, r would not work at all until I pressed it several times - after this I would usually end up with a string of rrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrr which would continue sometimes for minutes filling literally the whole screen, other times only a few dozen r's long then stop by itself.. When this long string occurred it would fill a width of the screen almost instantly, compared to several seconds if you try to imitate it by manually holding down a key. (In my view this point alone rules out a physical 'key stuck' issue with my keyboard, as if it was physically stuck, it would be the same as holding down a key, which takes seconds to fill a whole line, not instantly)
Last night while on the laptop undocked, during a beeping session the mouse would stop working. (I believe its because the mouse isn't able to be moved at the same time as a key is stuck down.). Funny though is if I held any other key down, not only would this top the r, but allow me to move the mouse again.
Mirroring previously experiences, winlogon.exe was maxing out the CPU during a key stuck session. I also noticed a process that I haven't seen before up near the top when sorting by CPU usage in igfxsrvc.exe (Intel graphics / input driver I believe?). This is quite possibly a red herring given it was only using around 5% of CPU at the time of a beep, although as per my comment earlier I've never noticed this one up near the top before.
My own experience here may well be something totally different to what our customers are experiencing, but then again this to me would be an amazing coincidence given I'm using a standard firm build laptop.
So, pending everyone else's thoughts, here is what I'm suggesting as next steps:
Analysis into the hijack this logs, to see if this shows anything obvious.
When I return to Sydney on Thursday, I'll put my hard drive in another D410 laptop shell and see if this fixes the issue. If so, we can put this down as a hardware fault with my current D410 shell. If this doesn't resolve the issue (which I'm suspecting), then it has to be software.
We then work out next steps given I can reproduce this issue when working undocked. I welcome any thoughts from the team if we do get to this step. Winlogon.exe's high CPU usage during a beep may well be part of this as I do feel this is odd.
+++ EMAIL SNIP +++
As you can see - we'd really like to get the the bottom of this.
All comments welcome.
Cheers!
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:39:35 PM, on 7/09/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16876)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
c:\Program Files\CheckPoint\SecuRemote\bin\SR_Service.exe
c:\Program Files\CheckPoint\SecuRemote\bin\SR_Watchdog.exe
C:\WINDOWS\system32\spoolsv.exe
c:\centenn.ial\audit\CAgent32.exe
c:\centenn.ial\audit\xferwan.exe
C:\Program Files\Olympus\DeviceDetector\DM1Service.exe
C:\Program Files\McAfee\Common Framework\FrameworkService.exe
C:\Program Files\McAfee\VirusScan Enterprise\mcshield.exe
C:\Program Files\McAfee\VirusScan Enterprise\vstskmgr.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\UPHClean\uphclean.exe
C:\Program Files\1E\WakeUp\Agent\WakeUpAgt.exe
C:\Program Files\Funk Software\Proxy Host\ph32svc.exe
C:\WINDOWS\system32\CCM\CcmExec.exe
C:\WINDOWS\Explorer.EXE
c:\Program Files\CheckPoint\SecuRemote\bin\SR_GUI.Exe
C:\Program Files\Apoint\Apoint.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\stsystra.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Funk Software\Proxy Host\phtray.exe
C:\Program Files\Apoint\HidFind.exe
C:\Program Files\McAfee\Common Framework\UdaterUI.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE
C:\Program Files\McAfee\Common Framework\McTray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Explorer\iexplore.exe
c:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\IEExec.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = [url="http://equip/"]http://equip/[/url]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = [url="http://go.microsoft.com/fwlink/?LinkId=69157"]http://go.microsoft.com/fwlink/?LinkId=69157[/url]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = [url="http://go.microsoft.com/fwlink/?LinkId=54896"]http://go.microsoft.com/fwlink/?LinkId=54896[/url]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = [url="http://go.microsoft.com/fwlink/?LinkId=54896"]http://go.microsoft.com/fwlink/?LinkId=54896[/url]
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = [url="http://go.microsoft.com/fwlink/?LinkId=69157"]http://go.microsoft.com/fwlink/?LinkId=69157[/url]
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = wmplayer.exe //ICWLaunch
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer provided by Freehills
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = sydproxy.freehills.com.au:8080
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [Freehills_Time_Zone] C:\WINDOWS\system32\SetTimeZone.vbs
O4 - HKLM\..\Run: [Freehills_Power_CFG] C:\WINDOWS\system32\Freehills_Power_CFG.vbs
O4 - HKLM\..\Run: [PspUsbCf] pspusbcf.exe
O4 - HKLM\..\Run: [ProxyHostTrayIcon] "C:\Program Files\Funk Software\Proxy Host\phtray.exe"
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\McAfee\Common Framework\UdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [iPCCheck] "C:\Program Files\iPass\iPassConnect Freehills\downloader\ipccheck.exe" /startup
O4 - HKLM\..\Run: [Discovery User Input] c:\Discovery\User Input\userin32.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [VSTOTemplateLoader] "C:\Program Files\FreeDA\VSTOTemplateLoader.vbs"
O4 - HKLM\..\Run: [XBootMgrLaunch] "E:\Trace\xbootmgrSleep.exe" 180000 "E:\Trace\xbootmgr.exe"
O4 - HKCU\..\Run: [adxregaddin.exe] C:\Program Files\FreeDA\Installation Support\adxregaddin.vbs
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://*.equip
O15 - Trusted Zone: http://*.sydhrisweb1
O16 - DPF: {4BECECDE-E494-4F69-A3DE-DA0B77726307} (WebTransferCtrl Class) - [url="http://sydwsweb1/WorkSite/includes/iManFile.cab"]http://sydwsweb1/WorkSite/includes/iManFile.cab[/url]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = freehills.com.au
O17 - HKLM\Software\..\Telephony: DomainName = freehills.com.au
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = freehills.com.au
O23 - Service: CentennialClientAgent - Centennial Software Limited - c:\centenn.ial\audit\CAgent32.exe
O23 - Service: CentennialIPTransferAgent - Centennial Software Limited - c:\centenn.ial\audit\xferwan.exe
O23 - Service: DM1Service - OLYMPUS IMAGING CORP. - C:\Program Files\Olympus\DeviceDetector\DM1Service.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\McAfee\Common Framework\FrameworkService.exe
O23 - Service: McAfee McShield (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\mcshield.exe
O23 - Service: McAfee Task Manager (McTaskManager) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\vstskmgr.exe
O23 - Service: Proxy Host Service (ProxyHostService) - Funk Software, Inc. - C:\Program Files\Funk Software\Proxy Host\ph32svc.exe
O23 - Service: Check Point VPN-1 Securemote service (SR_Service) - Check Point Software Technologies - c:\Program Files\CheckPoint\SecuRemote\bin\SR_Service.exe
O23 - Service: Check Point VPN-1 Securemote watchdog (SR_Watchdog) - Check Point Software Technologies - c:\Program Files\CheckPoint\SecuRemote\bin\SR_Watchdog.exe
O23 - Service: 1E WakeUp Agent (WakeUpAgt) - 1E - C:\Program Files\1E\WakeUp\Agent\WakeUpAgt.exe
–
End of file - 7206 bytes