This problem is on a Toshiba Laptop, model A55 S1063 running WinXP. At the time of the problem it was up to date, both with WinXP updates and Norton AntiVirus updates, with regularly run virus scans.

While I was at work, my wife was cruising the internet and accidentally clicked on a popup (she doesn't remember what the popup was). The computer reboots, and upon rebooting begins beeping like mad - as in a key is stuck. Any key pressed makes a beeping sound half the time, the other half the wrong characters are displayed.

Upon getting home, I check into things. I notice Norton is disabled, and check it's logs - over 200 attacks in a second by vsmon.exe, a component of zonelabs firewall - which is NOT installed on this pc. Restart norton, only to have it periodically attacked by winlogon.exe and wmiprvse.exe. All three of these files have viruses associated with them - but registry info and other files they drop are oddly missing. Norton of course detects nothing at this point.

I manage to do a complete system wipe using toshibas recovery software (formatted hdd) - no small task being unable to type c for continue! The reformat and reinstall of windows does not cure the problem - keyboard doesn't make obnoxious beeping sounds when any key is pressed anymore, only outputs completely wrong characters, and combinations of characters - such as "e" displaying system date and time. I'm able to use the onscreen keyboard for limited functionality.

I install AdAware, SpyBotSD, HijackThis, and AVG AV. All come up empty handed. I have downloaded the Rootkit Revealer from Microsoft, and it displays 3 items - embeded nulls in HKLM\Security\Policy\Secrects\SAI* and SAC*, and a data mismatch between Windows Api and Hive data in HKLM\Software\Classes\webcal\URL Protocol. I am honestly unsure if this points at anything important.

The problem exists in Bios as well - I was able to access bios, and had no keyboard functionality outside of page up and down.

I purchased a USB keyboard this evening, and am able to use it on the system.

My train of thought is: The attacks on norton, research on the files hitting it, and unasked for reboot indicate to me it is a virus. The full reformat and reinstall of windows suggest that it may be hiding in the MBR or Bios. However, nothing I do is revealing the nature of the problem.

I'm at my wits end with this - any help or ideas or things i've overlooked would be greatly appreciated. I've take more steps then this, but felt the post was getting too long as it is :)

"I purchased a USB keyboard this evening, and am able to use it on the system."

If by that you mean the external keyboard functions normally, then that is a pretty solid indication that your laptop keyboard is defective - - whatever other problems you are experiencing, a "keyboard virus" is not one of them

"The full reformat and reinstall of windows suggest that it may be hiding in the MBR or Bios."

Really? Not to my mind - for a fact, that whole "BIOS virus" thing is a (popular) myth - virus neither hide nor reside there - virus that attack the BIOS generally render it useless or corrupt. I doubt if "it" is in the MBR either

"However, nothing I do is revealing the nature of the problem"

You might consider that a clue.

I'm not one of those who think Bill Gates is the devil. I simply suspect that if Microsoft ever met up with the devil, it wouldn't need an interpreter

Report Offensive Follow Up For Removal

"My train of thought is: The attacks on norton, research on the files hitting it, and unasked for reboot indicate to me it is a virus."

The initial attack was by a virus, known viruses that have the capability to disable the keyboard. Which they did. But the three items that attacked are from 3 different viruses, and whatever did this left none of the signature that those three are supposed to have. Registry keys, file drops, nothing.

Believe me, I too have thought it was something as simple as a dead keyboard at times when nothing was showing up. But I keep going back to the initial attack. Which occured with someone there to see it happening. Shrug, I suppose it is possible for the keyboard to blow at the *exact* same time a virus slams the system. Possible, not probable.

If another keyboard works, then there can be no disputing the source of that problem - isn't that what you claimed?

""I purchased a USB keyboard this evening, and am able to use it on the system.""

I won't pretend to know exactly what's going on in your (sight unseen) computer, but I do find much of your reasoning 'questionable'

You've formatted & reinstalled - it's not terribly feasible that anything with the attributes you describe could have survived that, but feel free to 'do over'.

If your version of XP is pre 'SP2' and your firewall wasn't enabled when online, it's my understanding that you would be vulnerable to re-infection

"known viruses that have the capability to disable the keyboard."

Like what? ... and, is the keyboard really 'disabled' (not really, if the USB one works)

Beeping and incorrect character output strongly suggests a bad keyboard - every "keyboard virus" reported here turns out to be a hardware fault or the wrong language layout loaded

I'm not one of those who think Bill Gates is the devil. I simply suspect that if Microsoft ever met up with the devil, it wouldn't need an interpreter

Report Offensive Follow Up For Removal