The Basics

Today was a good reminder that even in technology, the basics still matter.

I spent some time troubleshooting a laptop that appeared to be experiencing erratic keyboard behavior for several weeks. Endless pasting, phantom key presses, applications triggering shortcuts repeatedly, so on and so forth. At first glance it looked like something more serious such as a driver issue, failing keyboard controller, or even malicious like a misbehaving keylogger or other malware.

I went through a full troubleshooting process that included several avenues:

• Restarting the laptop
• General cleanup of the interior of the laptop
• Reinstalling HID drivers
• Isolating the offending driver only to have it reinitialize later
• Updating the operating system and drivers
• Looking for suspicious startup processes
• Packet capture and review with Wireshark during episodes
• Checking active connections with netstat
• Reviewing Event Viewer logs

After all of that investigation, the root cause turned out to be something much simpler. I had left a small wireless USB receiver plugged into the laptop, and while the external mouse that it was connected to was off, its matching keyboard does not have an on/off switch and was tucked inside a backpack. The keyboard connects to the reciever via Bluetooth and wakes during keypresses, which happen due to being smashed inside the backpack. Once the receiver was removed, the problem disappeared immediately.

It’s a good reminder that no matter how long someone has grown up around technology, no matter how experienced someone becomes with hardware, troubleshooting still starts with the fundamentals:

• Check the obvious.
• Verify hardware first.
• Eliminate simple causes before assuming complex ones (I chased a wild goose for quite a long time).
• Sometimes the issue really is just the equivalent of a loose cable.

Even after years around technology, the basics still win, and this is one of several reasons we still ask our end users if they’ve tried a computer restart before we proceed with other troubleshooting steps.

Technical Expansion

#

For people that appreciate less sensationalism.

While the root cause turned out to be simple, the investigation process that led to the discovery was still valuable. The behavior of the system initially suggested something far more complex. Below is a slight technical expansion on the last few moments of troubleshooting, after packet capture and review, malware scans and Event Viewer logs already ruled out device infection.

Observed Behavior

#

• Endless clipboard pasting in applications such as Notepad
• Repeated triggering of Find/Find and Replace in applications like Word and Chrome

Opening Notepad revealed a continuous stream of clipboard pastes occurring without any user interaction for current time and date. This suggested that the operating system was receiving repeated Ctrl + V input events. At this stage, several possibilities were considered:

• Keyboard hardware failure
• Corrupt HID driver
• A malfunctioning touchpad or touchscreen controller
• A background process injecting input
• Malicious software such as a keylogger

Initial Driver Isolation

#

Device Manager showed multiple keyboard interfaces:

Keyboards
    HID Keyboard Device
    HID Keyboard Device
    Standard 101/102-Key or Microsoft Natural PS/2 Keyboard for HP Hotkey Support

Removing keyboard devices temporarily resolved the behavior until Windows automatically reinstalled them during hardware enumeration. This indicated that the issue was tied to one of the HID interfaces, not the physical keyboard itself.

Device Identification

#

Looking at the device properties and events for the specific interface causing the issues revealed the following information:

Driver Name: keyboard.inf 
Class Guid: {4d36e96b-e325-11ce-bfc1-08002be10318} 
Driver Date: 06/21/2006 Driver Version: 10.0.22621.3672 
Driver Provider: Microsoft 
Driver Section: HID_Keyboard_Inst.NT 
Driver Rank: 0xFF1003 Matching Device Id: 
HID_DEVICE_SYSTEM_KEYBOARD Outranked 
Drivers: input.inf:HID_DEVICE:00FF1005 
Device Updated: false 
Parent Device: USB\VID_046D&PID_C534&MI_00\6&3ad477ac&0&0000

The identifier is important because VID values map directly to hardware vendors, and I ended up using that to have that “aha!” moment in the end. The breakdown for the elements of the Parent Device string:

USB\VID_046D&PID_C534&MI_00\6&3ad477ac&0&0000

USB = Device discovered on USB bus (not inherently a giveaway due to internal USB possibility)
VID_046D = Vendor ID is Logitech
PID_C534 = Product ID is specified from the vendor, model C534
MI_00 - Interface number
6&3ad477ac&0&0000 = Device instance path, generated by Windows

Once the vendor ID was identified as Logitech, the root cause was fairly obvious. The laptop itself obviously does not contain any internal Logitech hardware, therefore the device had to be coming from an external USB interface.

Addressing Possible Malware Concern

#

The reason this initially appeared to be a system-level problem was because the symptoms manifested in multiple applications simultaneously and under several concerning conditions:

• Clipboard paste loops
• Search dialogs appearing
• Unexpected spaces appearing while typing
• Driver reinstallations temporarily masking the issue

All of these are consistent with phantom keyboard input, which can originate from failing hardware or external HID devices and even misbehaving malware manifesting obvious symptoms, such as keylogging activity. Because the receiver was small and unobtrusive, it was easy to overlook during the initial troubleshooting process and I failed to catch it. Although, in my opinion, the real crime here is that the associated keyboard lacks a dedicated on/off switch, but that’s an argument for another time.