Need help with a tricky repair

Toggle sidebar Toggle sidebar
S

Savvy_01

Distinguished
Feb 24, 2013
113
0
18,690
The specs: Laptop
Acer Aspire 5534
AMD Anthlon 64 X2 Processor
ATI Radeon HD3200
15.6" 16:9 HD LCD
4 GB RAM
320 GB HDD
DVD Super-Multi DL Drive
Acer Nplify 802.11/b/g/Draft-N
6-Cell Li-ion Battery
Windows 7 Professional, SP 1 (It was fully updated before repairs began, hasn't been updated yet since the problem persists regardless of Service pack.)

The Problem: It present itself as a malfunctioning keyboard and touchpad lock button. Specifically, the touchpad locks on its on after a few minutes and refuses to unlock, forcing the use of another external mouse. Specific keys on the keyboard don't work, and won't register a key press (Always the same keys too, s, g, h, \, left-shift, and the . on the keypad.). Other keyboards plugged in work fine.

Solutions Attempted before the laptop came to me: A reinstall of windows, which gave me the go ahead for any additional wipes or modifications.

Solutions and diagnosis I've come up with:
Outdated/Corrupt Drivers: Using Device Manager to Update Drivers (Already updated). Downloaded Acer Aspire 5534 Keyboard drivers and no change in the issue.

Virus: Ran Hiren's Boot CD and found a trojan Crypt-426 on the keybtray.exe process using Clamwin. The keybtray.exe process is only on the X:/ drive which is reserved for booting off of CDs or USBs (HBCD and the Windows Installer used it.) No other virus removal program detected it (AVG and Malwarebytes used). Final Solution attempted was to wipe the drive entirely (System Partition included) using DiskPart in the command prompt while using the Mini-XP OS booted off the HBCD. Assumed that the virus was a false positive. No change in the issue.

Partition Table: Startup repair detected errors in the partition repair, but failed to repair the issue after 5 attempts. Diagnosed the computer with hard drive failure and installed alternate drive (new). After reinstalling windows, problem persists anyways.

Hardware failure: Dismissed because the keyboard and touch pad work perfectly in Mini-Xp and Ubuntu. If it was hardware, it would consistently malfunction regardless of what OS was being used.

Software Failure: Dismissed after repeated reinstallations and a new hard drive was installed. (500 GB Hard drive to be specific).

RamDisk containing a virus: Noticed a RamDrive when initially using Mini-xp but dismissed it as nothing, but considered that the virus could be hiding there. Removed RAM for a few seconds and reinstalled. No change in issue.

Evil Spirit: Blessed the computer with Garlic Bread and Sunlight. No Change in issue.

Ran GMER and returned this error:
---- Kernel code sections - GMER 1.0.15 ----

? \I386\SYSTEM32\NTKRNLMP.EXE kernel module suspicious modification
? \I386\SYSTEM32\NTKRNLMP.EXE The system cannot find the file specified. !

Unsure of how to proceed with these errors, and they persisted throughout each installation and both hard drives.

As you can see, I was very thorough in listing everything that has occurred. Since I've ruled out hardware or software, I'm at a complete loss so listed literally everything I could think of. The only thing that I'm lost at is the Kernel errors, or why they persisted along with the problem. It's possible that they are related, but anything that survives a new hard drive is beyond my knowledge.
 
Sort by date Sort by votes
Chicano

Chicano

Judicious
Aug 29, 2011
5,071
29
35,490
Some viruses disable or disrupt keyboard and mouse... your external keyboard and mouse work because they are probably USBs, and the infected file is the i8042prt driver that controlls PS2 keyboard and mouse or Laptop counterparts.. and as you may know, USB devices don't need drivers, so they are immune to such viruses. Clamwin is not so effective and it may have deleted a trojan but may have missed the actual virus that's affecting keyboard and touchpad... So, my suggestion is to scan with a Live CD Antivirus that's better than Clamwin, most antivirus have a live cd version so google for "Bootable Live CD Antivirus" and pick any of the best known antivirus to download the ISO, burn the Live CD and do a boot scan to remove whatever virus is causing the problem..

You dismissed hardware issues because keyboard and touchpad work perfectly in the HBCD, but the drivers are in the CD and can't be infected... Ramdrive is also part of the HBCD and the infections you found in both the keybtray and Ramdrive of the HBCD may be explained as being burned from an infected computer to the CD... and though drivers on the CD cant be infected, or the infection removed from the CD, it can be removed from the HD or RAM cache... If this is possible, it would be obviously expected that keyboard and mouse be affected during a Live CD session, but just as well their drivers could be refreshed from the CD, or they may even be false positives in the CD so Laptop Hardware can be excluded but not their drivers.

I would suggest you test how the issue behaves in a Linux installation. That may very well clear up as to whether or not it's a software (Windows drivers) or Hardware issue.

You dismissed software because the issue persists after formatting your harddrives.. so Software and Hardware may be dismissed but the BIOS still remains to be cleared... and I imagine a BIOS virus can infect a system and hardware drivers and even the Partition Table. So, you may have to reset the BIOS with the CR-2032 battery removed, the Laptop battery removed and power disconnected, hardware removed or partitions deleted. Next press the Start button holding it for a full minute to remove residual power from components that may sustain a virus.

Read Method 3 of 3: Removing the CMOS Battery in Laptops
http://www.wikihow.com/Reset-Your-BIOS

The NTKRNLMP.EXE error is said to be caused by a wrong BIOS setting (ACPI setting) or deffective RAM. I have experienced it during several Windows XP installations from CD... and solved it installing from a USB drive. On an installed OS the ntkrnlmp.exe error can be caused by infected drivers.

Resolving Ntkrnlmp.exe Could Not Be Loaded Error Code 7
http://www.instant-registry-fixes.org/resolving-ntkrnlmpexe-could-not-be-loaded-error-code-7/

Solution for Ntkrnlmp Rootkit on installed Win7x64
http://www.bleepingcomputer.com/forums/t/396967/possible-rootkit-on-win7x64/

"Ntkrnlmp.exe Could Not Be Loaded. The Error Code Is 7" Error Message Occurs During Windows Setup
http://support.microsoft.com/kb/318729/en

After reading these articles, and from own experience on keyboard infection and ntkrnlmp errors during Windows installations, my suggestions are. Reset the BIOS and install Windows from a USB pendrive on a formatted hard drive.
1. Start deleting the hard drive partition or partitions so the HD cant be infected from the BIOS or reinfect the BIOS
2. Reset the BIOS, this would remove any BIOS virus and reset the default ACPI settings.
3. Format the Hard drive in NTFS
4. Install Windows from a USB Pendrive
 
Upvote 0 Downvote
S

Savvy_01

Distinguished
Feb 24, 2013
113
0
18,690


Unfortunately, as much sense as that sounded and as much as I agreed with you, it didn't work. I did it 4 separate times, had to unsolder the cmos battery from the laptop each time and no change at all. My final last ditch effort is gonna be to actually install Win 8 on this hard drive and see if it works.
 
Upvote 0 Downvote
Chicano

Chicano

Judicious
Aug 29, 2011
5,071
29
35,490
If not hardware, not software, not BIOS corruption or infection, but the problem happening on a new intallation on a new hard drive, from the same Windows 7 installer(?), I would suppose it is the cause... and Windows 8 may finally solve it... and if not, a stronger source of garlic, incense, holy water, exorcism.
 
Upvote 0 Downvote
S

Savvy_01

Distinguished
Feb 24, 2013
113
0
18,690


having a hard time finding a copy of windows 8 to use lol. I downloaded a pirated iso just to see if it works (no sense in paying for the real deal yet if I'm not certain yet that it'll make a difference) but the iso doesn't work... just wasted my time lol. But interestingly enough, now the touchpad doesn't lock up. It's been like 30 minutes or so and it hasn't locked once (that I'm aware of). This is definitely confusing...

UPDATE: Just found out that holy water is just as conductive as normal water... Awkward!
 
Upvote 0 Downvote
Chicano

Chicano

Judicious
Aug 29, 2011
5,071
29
35,490
lol... didn't mean to pour holy water straight on the laptop, rather to wipe or spray lightly on it..

• My guess is your copy of Windows 7 is causing issues so you could download a fresh copy from Digitalriver.com. I don't think Windows 8 is necessary to diagnose issues but you may still be able to download a copy of Windows 8.1 Blue Preview from some source as it's no longer available from Microsoft, I haven't deleted the copy I downloaded so I may still have it somewhere if you want to install it but as I said, it doesn't matter which Windows you install as long as it's not from the copy you have. If you want to install Windows 8.1 Preview it may install but keep restarting every 2 hours but it may be enough to test the computer and diagnose the problem.
• What installation method did you use on Windows 8.. DVD, USB?
• You mean the computer has worked for 30 minutes without issues... is this in Windows 7?.

Download a fresh copy of Windows 7 and use your product key for activation.
http://www.w7forums.com/threads/official-windows-7-sp1-iso-image-downloads.12325/
 
Upvote 0 Downvote
S

Savvy_01

Distinguished
Feb 24, 2013
113
0
18,690


I meant that the touchpad hasn't bugged out (locked up specificially) since I've tried to install Win 8 (a few hours now). The problem remains that not all the keys on the keyboard work (but they continue to function normally in other environments). Originally, i thought that there could have been two problems (a driver issue for the touchpad and a virus/broken keyboard. As of right now, I'm tempted to say that is the issue.

A corrupt Win 7 installer is very unlikely. The person I received the laptop from also attempted to repair it using her own CD, I used two different CDs to install, followed by a bootable USB (all different versions of Win 7 (Home, pro x64, pro x86).). Personally, I've never heard of a computer that only trips out when Win 7 is run, but that is the case here. I figured if Win 8 ran with no issues, then the problem could just fester into oblivion for all I care, as long as I can return a working PC. Which I can't right now because Win 8's anti-pirate measures are pretty much forcing me to buy a key first. I'll try that Win 8 blue preview thing though.

UPDATE: [strike]the touchpad started locking up again when I connected to my wifi, but unlocked when I disconnected and hasn't locked up since... Curious...[/strike] No it's just locking up randomly...

Btw, would 70% Holy Water work? You need to be a licensed Priest, Pastor, or Bartender to get the pure stuff.

UPDATE: The errors (keyboard not working and freezing touchpad) don't occur until a specific point in the Win 7 installation path (I'm assuming the part where the OS takes over) and this point is when it asks for a User name/PC name. In order to enter a key or anything, i've had to use an alternate keyboard/mouse.

The drivers used in safe mode are only slightly identical (as in there is no synaptics driver in safe mode, whereas both a default driver and synaptics are loaded in normal OS conditions). I've tried deleting and replacing the drivers to no avail. for some reason, they keep resetting themselves. I delete the synaptics driver and it reappears on restart ( i used a batch file to install it).
 
Upvote 0 Downvote
Chicano

Chicano

Judicious
Aug 29, 2011
5,071
29
35,490
What if you remap the troublesome keys? Try with "Key Tweak" either from the HBCD running from Windows or installing the program on Windows.. this would make corrections in the Windows registry that may have corrupted data caused by corrupted system files or whatever reason. Reassigning the keys to the registry data may make them work correctly. I mean as long as the troublesome keys type any characters... right or wrong, they are working and can possibly be remaped with the correct characters.
http://www.softpedia.com/get/System/OS-Enhancements/KeyTweak.shtml

For the touchpad try installing the Sinaptics Touchpad Driver. This is the failproof fix for all touchpad issues. A usb mouse may also help.
http://synaptics-touchpad-driver.en.softonic.com/
 
Upvote 0 Downvote
S

Savvy_01

Distinguished
Feb 24, 2013
113
0
18,690
I completely forgot to mention that there are no problems in safe mode. This led us (me and cousin at the time) to believe that it was driver issues, but I've updated the drivers and no cigar.
 
Upvote 0 Downvote
S

Savvy_01

Distinguished
Feb 24, 2013
113
0
18,690
YAY! New problem! Now the keys aren't just not working, now they're doing whatever the hell they want. I press 'a', nothing, i press 'c', it proceeds to type dozens of 'c's. It's doing this with random letters and none of the keys work properly now. This is getting strange. I noticed it a week ago, but it hasn't done this since then.

UPDATE: Being connected to a router is definitely affecting the problem. When I'm connected, the keyboard wants to do it's own thing: it presses it's own buttons randomly, and sporadically (however, it only seems to like the 's' key and 'Caps Lock'.). When disconnected, I regain control of the keyboard, but not all the keys work. And while I thought that it was coincidence that being connected caused the touchpad to lock up, it did stay unlocked for hours until I connected to wifi, and then it started glitching again. (atm, it's fine).
 
Upvote 0 Downvote
Chicano

Chicano

Judicious
Aug 29, 2011
5,071
29
35,490
Ran out of ideas so searched for coincidences. Many indicate hardware damage.

Keyboard gone wild
https://www.google.com/?hl=en&gws_rd=ssl#hl=en&q=laptop+keyboard+going+wild

laptop keyboard: every key typing wrong letters
https://www.google.com/?hl=en&gws_rd=ssl#hl=en&q=laptop+keyboard+every+key+typing+wrong+letter

The same person answered in these two different forum threads indicating a registry error, check your registry and if necessary edit the registry data
http://en.kioskea.net/forum/affich-513405-lenovo-laptop-keys-doing-the-wrong-things
http://forums.lenovo.com/t5/Lenovo-3000-and-Essential/FN-key-probelms/td-p/4106
 
Upvote 0 Downvote
S

Savvy_01

Distinguished
Feb 24, 2013
113
0
18,690
Alright, I think we should go back to basics. We have a simple issue that only persists in the Windows 7 OS. Safe mode works, as well as booting off USB/CD. Everything points to drivers. Installing all the latest drivers didn't work (I'm going to do it once more since that was before the bios reset), so something other than virus is consistently affecting drivers. What else could it be?
 
Upvote 0 Downvote
Chicano

Chicano

Judicious
Aug 29, 2011
5,071
29
35,490
Analizing what Safe Mode might have to do:
- Drivers are disabled,
- Most Windows Services don't run,
- Most programs don't work,
- Startup Programs don't run,
- Infections and hack tools are disabled (viruses, trojans, hackers, malware, adware, etc.)...

- You have discarded drivers, and infections of any type,
- Windows Services: Check if the Human Interface Device Service is enabled, Disable Remote Access service and all related.. basically any service referring to "Remote" except for Remote Procedure Call and all related to RPC.
- Programs: In case you have installed any programs since a fresh installation, disable startup programs and uninstall all installed programs. Some programs have trojans included among their files. The idea is that due to the problem being disabled or inactive when disconnected from the router, you may be cutting off a trojan or hack tool from connecting home or from being remotely managed. I know you discarded infections but security programs don't locate 100% of existing threats so there's always the chance that your scans have missed a bug or hack tool. Something you have not mentioned or I may have missed, is how long after a clean installation does the issue start?. Don't know about you but I have a group of favorite programs that I install right after a fresh install, programs like a file shredder, a file search tool, a uninstaller, a screen capture, etc... so if you have installed favorite programs after eac clean installation, remove them.
 
Upvote 0 Downvote
S

Savvy_01

Distinguished
Feb 24, 2013
113
0
18,690
It's not my laptop I'm repairing so there's literally no programs installed right now. However, a bunch of services are "Stopped" and I'm not sure why.

Just had a genius idea. Safe mode runs it's own generic drivers right? The keyboard and mouse work fine in safe mode, meaning that those drivers, for whatever reason, work better than the Synaptics driver. Why not remove the Synaptics driver and use the generic ones?
 
Upvote 0 Downvote
Chicano

Chicano

Judicious
Aug 29, 2011
5,071
29
35,490
• Can you post a list of the "Disabled" services?.. "Stopped" is normal for some of them because they only start when needed.
• You would have to check in the Device Manager (in Safe Mode)/ Devices / Properties / Driver / Driver Details.. and make a note of the driver names which are in use for the keyboard, touchpad, mouse and network card. Then repeat in Normal Mode and compare the list of drivers being used.
• The Sinaptics driver usually gets rid of touchpad issues but if it made things worse, go ahead and remove it. It may be better that you check it's the right Sinaptics driver for the laptop make and model and install the right one before giving up on it... and if it's the right one then remove it.
 
Upvote 0 Downvote
S

Savvy_01

Distinguished
Feb 24, 2013
113
0
18,690
Sorry, had some issues in other aspects of life but this problem is proving to be very difficult to solve. it's been through 3 techs (including chicano here) and no one really has a clue why it doesn't work. However, I've noticed new things that I thought I should both here and in the original post:

The errors (keyboard not working and freezing touchpad) don't occur until a specific point in the Win 7 installation path (I'm assuming the part where the OS takes over) and this point is when it asks for a User name/PC name. In order to enter a key or anything, i've had to use an alternate keyboard/mouse.

The drivers used in safe mode are only slightly identical (as in there is no synaptics driver in safe mode, whereas both a default driver and synaptics are loaded in normal OS conditions). I've tried deleting and replacing the drivers to no avail. for some reason, they keep resetting themselves. I delete the synaptics driver and it reappears on restart ( i used a batch file to install it).
 
Upvote 0 Downvote
Chicano

Chicano

Judicious
Aug 29, 2011
5,071
29
35,490
Those drivers that keep resetting themselves... that's not normal and if you install synaptics using a batch file... the batch file may be infected. Why haven't you installed from a regular synaptics exe installer?.

What you should do is disable System Restore so the possibly infected drivers do not restore themselves... Uninstall the stubborn drivers and delete the driver files from the Windows / System32 / Drivers folder, and Driver store... and do the same in folder SysWOW64. Install a search tool I'd suggest Everything, to find and delete all copies of the bugged drivers including batch file. Next shutdown the computer, reset the BIOS with hard reset (holding the PWR button 1 minute) and allowing 15 minutes for the BIOS to reset (longer would be best), start the computer with USB mouse and keyboard, download and install drivers from legitimate and reputable sources. Don't reenable System Restore untill the issues have not returned and a few days have gone by.
 
Upvote 0 Downvote
S

Savvy_01

Distinguished
Feb 24, 2013
113
0
18,690
I used a batch file to install the set of drivers used in safe mode, drivers that aren't readily available with an installer. At any rate, the laptop is going back today without being repaired. Although, now that I've sat on it so long (not literally... most days) I'm starting to think it could've been the network card all along. I mentioned how being connected to the wifi made problems worse with the keyboard, what if the card itself is doing it? The only thing I never tried was doing all this resetting/reformatting with the card removed, although I did remove the card and see if the problem went away (it didn't). If there is memory on the network card, in theory it could be infected right? At least enough to reinstall a virus on both the BIOS and Hard drive after every format and BIOS reset.

At any rate, it's out of my hands now. Two other techs couldn't help me solve it so, I gave it my best.
 
Upvote 0 Downvote
Chicano

Chicano

Judicious
Aug 29, 2011
5,071
29
35,490
The only type of drivers that aren't available with an installer that I know off, have a .inf script not .bat.
Don't think the Wi-Fi card can be infected... it has memory but to write on it takes special conditions so it can only be done at the factory.

The only way a card can be related to an issue is if it has a deffect or if the connection to internet activates a connection between a virus/malware and it's home or if it sends away information or copies of itself... and once a virus/malware is on the hard disk, it can act no matter if the connection is active or not. Such bugs can use-up a high percentage of the installed resources, enough to make the computer lag, lock, freeze. Why scans, formats. etc. did not remove it permanently may have been due to inadequate procedures, reinfection, or lockups may have been caused by some deffective hardware component.. any component. The only similar case I have experienced was a deffective CD-Rom.
 
Upvote 0 Downvote
S

Savvy_01

Distinguished
Feb 24, 2013
113
0
18,690
i figured as much, but if the method (Format, remove drive, hard reset of BIOS by removing battery/holding power button for FIVE minutes, formatting the drive again afterwards, and installing windows) I used didn't work, then the only thing I could think of would be hardware malfunction. But since there is no hardware problem (evidenced by safe mode working), it's impossible (for me at least) to tell what it would be. A problem that can't be hardware or software... My cousin suggested that it was just a bad laptop, hence why no conventional fixes work.

UPDATE: (I didn't post it when I thought I did so technically, this is an update): She didn't pick it up today so I'm going to try something new. What if it genuinely is the network card but not in the way that we think. The keyboard and touchpad work without issue before windows installation, and during safe mode. What happens during installation? Windows connects to the internet. Now, what if it's automatically updating/being infected during this process? I'm going to unplug the network card and try one last time. Which means that I need to heat up my solder iron.
 
Upvote 0 Downvote
Chicano

Chicano

Judicious
Aug 29, 2011
5,071
29
35,490
If it were hardware malfunction, Safe Mode disables all but most basic drivers, so it becomes obvious why the issue is not present in Safe Mode. So it's possible hardware is the cause.. and as I said, any hardware component including any motherboard capacitor, chip, resistance, etc. Could even be the keyboard or touchpad has damage... did you by any chance try it with a mouse.

Another possibility is the Windows installer if it's not the original Windows Disk, a Copy or a USB installer could contain some malware/virus.

Infection during installation?.. I would have to search for related information.. The possibility would be obvious but since Microsoft suggests activating during installation which means you need to be connected to internet, I assume the connection to Windows Update and Activation servers, must be through secure connections or the suggestion would be irresponsible.

What if you just disable the network card from the Device Manager? Not sure that would make a difference but if the issue is not present during Safe Mode, disabling the network card driver would serve the same purpose. You could connect to Internet through cable or USB Wi-Fi adapter.
 
Upvote 0 Downvote
S

Savvy_01

Distinguished
Feb 24, 2013
113
0
18,690
I disabled the wifi driver in the Device Manager. I dismissed this option before because I had actually disconnected the wifi card physically; I assumed wrongly that it meant the driver would also be disabled. When I did, the problem rectified itself. I updated the driver and enabled it, but a new problem has arisen: The touchpad functions perfectly, but the keyboard no longer works at all: not a single key. Disabling the driver (and restarting) fixes the issue, but I'm sure my client wants wifi. My initial guess is that it's just an outdated driver; I'll update them all later tonight when I return home. The only thing bugging me now is the fact that I'll have to repeat the entire solution since I used a bogus copy of win 7 to diagnose and fix the problem. The previous tech has the key and CD so I have to wait on that, but it seems as though I'm one step away from finally being rid of this problem.

Note to self: Disable the drivers instead of just removing the component/hardware.
 
Upvote 0 Downvote
S

Savvy_01

Distinguished
Feb 24, 2013
113
0
18,690
Okay Chicano, we're like, one step away from this months long problem being solved. Updating the drivers did nothing (to be fair, I only updated the touchpad/keyboard drivers.). The touchpad no longer locks up, but while the network driver is enabled (Qualcomm Atheros AR5B93 Wireless Network Adapter), the keyboard does not function whatsoever. While disabled, it functions 100% normal. It should be noted that there are two network drivers, the second being Realtek RTL868C(P)/8111C(P) Family PCI-E Gigabit Ethernet NIC (NDIS 6.20). This driver is enabled and does not interfere with normal operations.
 
Upvote 0 Downvote
Chicano

Chicano

Judicious
Aug 29, 2011
5,071
29
35,490
I would disable the Qualcomm Atheros AR5B93 Wireless Network Adapter and delete the driver file/files from the computer... the files should be at
C:\Windows\System32\Drivers and DriverStore\FileRepository folders...

and if a 64bit OS from also look in
C:\Windows\System32 and the C:\SysWOW64\ folders, same drivers and driverstore sub folders... you will have to identify the .sys file in "drivers", and the driver installer files inside the FileRepository folder. The folder would be named for example, something like "drivername.inf_1a2e3o4u".

After you have removed the Wireless driver and associated files, install a fresh driver for the Wireless card. You could also try installing an alternate driver from those in the computer possibly one from a similar but different model Atheros card.

I had mentioned this before but don't know if I sugggested scanning the computer for virus and malware to make sure a possible infection is removed.
 
Upvote 0 Downvote
S

Savvy_01

Distinguished
Feb 24, 2013
113
0
18,690
I had done the virus scan initially in several different ways, but I'm going to go on ahead and delete the drivers and install one from an earlier model, and if that fails, a later model. The virus scan turned up zilch everytime, but i'm going to run it again just in case I missed something.
 
Upvote 0 Downvote
You must log in or register to reply here.

TRENDING THREADS

Latest posts

Moderators online

Share this page

COMPANY
RESOURCES
FOLLOW
Top Bottom