Keyboard Boot Virus?

I recently ran into a major problem.

I have been having problems with 100% cpu overload on Youtube. This cripples the video playback. I tried numerous methods to try to solve the problem. None of them worked.

I then looked at the Window firewall. Since I have numerous NAT firewalls between my computer and the internet, I felt this was not necessary and I disabled it.

A short while later, I ran into very serious problems. When I tried to reboot, the screen would go absolutely crazy, and continually reboot itself.

I tried to diagnose the problem. I switched motherboards. This did not help.

I next examined the power supply to see if faulty voltages could cause the problem.

But after 3 decades and trillions of power supplied delivered, you would conclude if there was a problem with the power on signal, someone would have found it by now.

I examined the onboard memory. You can't do much with this since any information disappears when power is turned off.

I examined the cmos ram. This is not much help, since it only contains 64 bytes of memory. Even so, I removed the battery. This did not help.

The only thing left after all this was the keyboard. I replaced it, and lo and behold, the problem disappeard.

  1. Is it possible that some kind of virus could be written to the keyboard ROM? There is plenty of memory available since it has to map all the keypresses to USB. And it does have some sort of writeable memory since you can turn off NumLock during boot.

  1. If there is some kind of new virus coming around, it could be deadly. It completly disables any computer, since it attacks the most elementary component. Remember the "Press F2 to continue" of the DOS days? It showed up when there was no keyboard connected!

Whatever the source, the problem completely obliterated the ssd drive I was using at the time. ChkDsk found numerous errors on the drive and it would not boot. I replaced it with a backup and this enabled me to get back on line.

Recommendations:

  1. Keep a spare keyboard available.
  2. Turn on Windows firewall.
  3. Keep a backup computer updated and available at all times.

Good Luck.

Reply to
Mike Monett
Loading thread data ...
[...]

trillions of power supplies delivered

S and D keys are too close

Reply to
Mike Monett

Have you tried RE-plugging the keyboard to see if that causes the problem to RE-appear? Are you sure the problem wasn't transient?

Possible? Sure. Likely? I'd have a better chance of winning the lottery WITHOUT buying a ticket!

That's usually handled in the PC.

That's the case with any (every?) machine. It's a standing joke for those of us that run headless boxes... (machine won't boot? attach a monitor and see a complaint about CNOS battery "Press F2 to continue" -- "Crap! Now I've got to drag out a keyboard...")

Keep a spare *monitor* available (so when your monitor craps out, you'll be able to navigate an orderly shutdown)

Configure boot order to allow network boot (assuming you have the skillset to make that happen) so you can get the machine "up" even with a bad disk.

Keep a bootable USB and CD-ROM on hand (also good for "resetting" forgotten passwords)

Don't have valuable "stuff" on an exposed computer. So, *if* you are ever a victim (or suspect that to be the case), you can simply restore the ORIGINAL DISK IMAGE (that you took time to save when you built the computer) -- which takes just a few minutes.

[The machine that I use as "console" for my cold archive just experienced a disk failure. It took longer to get it disassembled -- to remove/replace the hard disk -- than it took to restore the original disk image!]

A "common" boot problem is having a USB storage device installed at boot time AND the boot order configured to query it as a potential boot source. (you can likely alter your boot order to eliminate this problem; ditto with optical media that happen to remain in the drive at boot time)

It's possible that your keyboard was responding to the boot query with enough "garbage" to confuse the system (think "buggy implementation").

Reply to
Don Y

So you had the same problem with the new back-up HDD?

I've had situations where unscheduled and unexplained power-downs eventually killed sectors in a HDD, making it unbootable.

I also replaced a lot of hardware before the HDD eventually failed. This included motherboard and PSU.

A dual-boot system, I lost the microsoft OS first (booted into power-off), then the Linux install (sector errors).

neither chkdsk or HDD brand tools could access the final HDD.

Linux advisor suggested checking firewall shortly before Linux 'went out'.

RL

Reply to
legg

Thanks. I know how to power down my computer.

The problems started before I rebooted. The computer behaved very strangely. Using the down cursor would cause an endless loop where the only solution was to power off the computer. When I powered up, it would go back into the endless loop.

I run Win7 on VirtualBox. I have numerous backup files on a separate ssd. These show up as .VDI files, which I organise by date.

Changing the motherboard and loading the most recent backup solved the problem and allowed me to get back online.

Reply to
Mike Monett

Have a look through the logs? I'm always amused that folks don't take the first steps to see what the *software* managed to observe (and record) in a problem situation! This is particularly valuable as it will often give you a picture into the recent past from which you might be able to see a failure starting to develop...

Duplicate disk. Replace. See if problem persists (you have the original disk -- in whatever state it happened to have degraded -- to return to).

The disks can be removed from most of my machines pretty easily (removable carriers) -- except the AiO's (PITA). A USB dock (or, external USB disk that's been gutted) lets you mount the removed disk and examine/retrieve it from a fresh disk.

[Also handy to have other bootable media -- optical, USB -- that you can use to examine a disk before removing it]

I've never replaced a PSU, motherboard or RAM (40 years of PCs). And, only 3 disk drives. But, the disk is much easier to swap out (or, replace with an externally mounted drive) than anything else!

Perhaps because it was seeing "inexplicable activities" (GIGO) and assumed they were the result of an "illegal actor" having corrupted the system in an unforseeable way?

Reply to
Don Y
[...]

Changing the motherboard showed the problem was not with the system. Changing the keyboard solved the problem. Can you write into the keyboard prom?

Reply to
Mike Monett

are you related to Skybuck ?

Reply to
TTman

This may have been a warning that something hardware related was amiss.

I have seen CPU cores go to 100% usage doing nothing in a browser but only when the old MS IE got itself into a stupid crazy state.

The other one was a portable where after a while a keyboard or mouse would stop working and then all keys including the on off button would cease responding. This was a pure hardware fault - race condition since it occurred originally on Windows but was exactly reproducible (except with different diagnostic reports) from a Linux bootable CD.

Booting from a Linux CD isn't a bad way to proceed if you think a PC has been badly compromised. Very few viruses can damage a physical CD. There are bootable AV CD ROM images available for this sort of battle.

Likewise with tools to detect obvious hardware glitched. Most common is spurious interrupts generated by a design fault/race condition.

Faults which appear in both Windows and an independent Linux implementation are usually hardware related.

Bad capacitors around the memory PSU is my first suspicion for unexplained BSODs - at rakish angles if they are on their last legs.

Having a spare keyboard and mouse is always handy. I would never rely on Windows Firewall for anything.

Most people these days have at least one previous computer still in working condition and/or a portable or tablet or smartphone.

Granted Usenet support on some of these is less than stellar.

Reply to
Martin Brown

This happened suddenly. Can you write to the keyboard?

The power supply is fine. I am running on it now.

I have the Ubuntu installation cd. I would try it except I wouldn't know how to interpret the results. I'd be happy to send the keyboard to anyone who has the tools to analyze the problem.

Reply to
Mike Monett

  1. Use a PS2-style keyboard.

Cheers

Phil Hobbs

Reply to
Phil Hobbs

Accessing the logs was the power-off trigger for the final two successful Linux re-starts. Sector errors reported on next boot attempt.

Fairly simple matter for a single OS/disk. I'm at sea after Linux reformats/repartitions the disk for dual boot.

I stopped using carriers for bootable OS about ten years ago, greatly reducing the number of dead/scrambled OS/HDD events.

'neither chkdsk or HDD brand tools could access the final HDD.' This was an option I never got around to doing while OS ran - the HDD was scarcely 8mo old.

I suppose I'm more used to a lower quality hardware.

Motherboards regularly require cap replacement (2-3yrs) in both Dell and ECS motherboards (symptom is 'no boot' with bulging caps). I've replaced those in the Dell Optiplexes two or three times with the best-to-be-had, as well as some inside their custom PSUs.

Motherboards were replaced in three instances in various machines; when USB connex became unpredictable, when a video processor chip developed an open crater in its body, and in the final case - this unexplained power-off.

I would have done it also, if I couldn't get keyboards to act predictably (after doing the usual driver reinstall) as in your case, though you don't actually mention changing keyboards (?).

Motherboards are obviously subject to insertion wear and static damage on user accessible hardware.

Linux advisor was humint 'LXLE' while trying to get venerable deskjet to print. All connections made, gui's successfully engaged - printer queue reporting - just no printing on LTP1. Other OS had no issues with the same hardware. So; OT

RL

Reply to
legg

Ah. Most (Windows) folks seem to be ignorant of the fact that they even exist!

*BSD (ditto Linux) are considerably easier to access/grep/preserve/etc.

I don't understand why that would be the case?

Make a literal copy (while the disk is still bootable) and try that, in place of the "suspect" disk. If problem goes away, put suspect disk back in place and verify problem

*returns*.

I.e., the contents of the disks are identical so any difference in bahavior is related to physical/mechanical issues.

{reinstalling the suspect component is essential to verify the fault follows it. Otherwise, things may have "magically" improved -- because of a cable that got jiggled in the process, because something had a chance to cool down, because a different memory frame is hosting a particular part of the code, etc.)

??? Huh? The carrier is a part of the computer -- like having the right "mounting rails" was decades back. The disk fits in the carrier and the carrier fits *inside* the computer. For my HPs:

formatting link

For my Sun boxen:

formatting link

For my Dell boxen:

formatting link

Perhaps you are thinking more in terms of:

formatting link

I incrementally build an image of the disk as I am building the original. Install OS, take image. Install first few aps, take image on a SECOND medium (so first image is still available as a fallback if you later decide to roll back to "just after OS install"). Install next group of apps, take image (overwriting/supplementing first image).

So, if I change my mind about installing Application #46 on the machine, I can restore the image closest to -- but prior to -- application #46's installation (I don't like uninstalling application on a Windows box as I don't think it completely removes everything)

[This works fine for reasonably small system disks. Once you get up to ~1TB, then the imaging process becomes time-intensive (do it while sleeping)]

Once I am happy with the build, I move the image into an offline storage area and put a label on it. E.g., the machine whose disk recently died required me to drag out it's image disk to recreate a new disk for the machine. Then, put the failing (but not yet completely dead) disk in a USB dock and pull off any files that I may consider "precious" that weren't present in the image. Then, move the failing disk into the sanitizer before destruction.

Dunno. I've been running rescued Dells/HPs/Suns for about 25 years. I've had to recap a neighbor's IBM machine. And, an old Dell server with redundant power supplies ~15 years ago.

I haven't noticed any suspect caps in any of my current herd (I open them up to vacuum the various active heat sinks periodically).

I keep a pile of spare power supplies for those machines that have oddball power supplies as I'd rather replace than repair (at least in the short-run). Z800 1100W:

formatting link

Sun Blade 2000 670W:

formatting link

(these are *big*/heavy)

Keyboards regularly develop "faulty keys" and need a good cleaning. So, I keep a pile (literally!) of them on hand to swap out -- and arrange to clean the flakey one(s) at my leisure.

Likewise, monitors (I have ~20 "spare" monitors on hand -- a consequence of having configured workstations to use 4 or 6 monitors, each, in the past). I remind SWMBO just how *spoiled* she is in that if she has a "problem" with any of her computers, it's "remedied" in a matter of minutes! (This is worth doing, periodically, to counter her complaints about all the shi^H^Htuff that I have! :> )

I'm not the OP complaining of a bad keyboard :> I *have* swapped out mice (esp wireless ones) while using them. But, usually the problem is "low batteries" in the mouse, leading to erratic behavior. Keyboards just develop bad key (groups).

While most of my primary machines support hot swapping (of nonsystem disk), I've never been excited to *try* that! :> (OTOH, I do it all the time on my disk sanitizer -- but, I wrote the code for that so KNOW when the disk is "safe" -- and, the disk is *wiped* at that point!)

The memory sockets on many motherboards are also rated for a very low number of insertion cycles (like "single digits")! One reason I avoid rescued "beige boxes" -- who knows how often the previous owner dicked with the memory!

I've been moving to turn everything into a network appliance so all a workstation needs is a keyboard, mouse and NIC. E.g., I PXE boot USFF boxes and use them as NASs, print over the wire, serve my SAS and SCSI drives via a SAN, etc. It's a big win when you have multiple machines that could want to access those resources (and connector/cable wear-and-tear can become a latent problem)

Reply to
Don Y

On Mon, 18 Apr 2022 10:35:13 -0700, Don Y snipped-for-privacy@foo.invalid wrote: <snip>

The HDD is definitely dead. Tried to probe it in a non-OS slot of a different machine and the bios reported 'smart' info at start - 'damaged-backup-replace', refusing to boot with the drive present.

I started with SNT brand hardware - uniformity allowing swaps between different brands of PC. These were the ones that accompanied most of my woes. I have some startech hardware now which doesn't seem immediately to be any better. So there may be an SNT (for IDE) and a startech (for SATA) in my built boxes.

All carriers add an extra few failure modes. Airflow and fan failure are pretty common - case grounding another issue, but there are extra connectors and harnesses that suffer as discs are swapped into and out of the caddies themselves.

After a while, I expect the MS windows Hardware Abstraction Layer to start complaining and misbehaving. With linux, I'm at the mercy of whatever advice/gui is available at the time.

I used to use a ternary back-up system; newest cloned on top of oldest at regular intervals. With the carriers, I think I did more harm than good.

Now I just back-up the systems regularly to an external drive, and replace the internal drive every so often.

I find myself, at present, unable to locate the previous known-good version of the dead HDD (required to restore the back-up). There's no place for it to hide. Must be going senile.

I suspect that I own these models and brands precisely because they do fail for simple reasons - availability and low price aftermarket.

Power supplies I know, having designed and developed similar stuff over the years. Seldom saw anything novel or interesting in the off-shore stuff, for the PC market, regardless of the paint job or marketing.

I've revived my acer monitors twice (dead electrolytics both times). It's silly.

My bad. Waiting for OP to change the frigging keyboard.

Cloning a previous HDD from 2016 (ouch!) in order to restore last back-up.

If this boots the PC into a power-off situation, it will be a stickler.

RL

Reply to
legg

Dead is good -- it limits the effort you'll have to expend on it! :>

(and, if you can't find any backups, that limits *that* effort, as well!)

Mine use the SATA connector on the *drive* to mate to the SATA cable

*in* the PC. So, it's essentially like a non-removable disk installation; there's no ADDITIONAL intermediate "cable adapter/assembly". The carrier/sled is just a mechanical convenience (instead of using screws to fasten the drive to the chassis, you fasten the drive to the carrier/sled)

As the PCs were designed *with* these carriers, they've taken whatever steps in the rest of the design to ensure adequate air flow, grounding, etc. -- it's not like an "aftermarket" product that has to try to be compatible with every PC out there.

The problem with MS is that it tries REALLY HARD to hide errors. E.g., it will retry operations far more often than *I* would tolerate; let me know you're having a problem BEFORE it becomes so severe that you're retries don't save my ass!

I designed my disk sanitizer to monitor the performance of the DUT throughout the process. I.e., sectors should take *roughly* the same amount of time (locally) to process. If sector X takes t and sector X+1 takes 1.5t, then I have to wonder if the disk is having a problem and trying to hide that from me!

Drives don't come out of my workstations unless they are being replaced (upgraded) or fail.

I don't backup the workstations themselves; I can *rebuild* them from the images created when they were built (for the system disk) and then reinstall any additional "support files" on the other spindles (I use 1T system disks and ~4T of additional "support" spindles). As the support files are usually just copied from original install media, there is no need to image those spindles -- just "recopy" from the archived original media.

Any precious "working files" I just push onto some other machine when the mood strikes. If there are multiple files related to <whatever>

I happen to be working on, I wrap them in an archive (ZIP, ISO, RAR, etc.) and push *that*.

I have a daemon that watches the various machines and keeps a centralized database updated so I can find copies of various files regardless of where they may reside (it looks *into* each archive to see what it contains so I can search for specific files instead of having to HOPE a particular archive contains a particular file). Having synchronized time means I can determine which copy is "most recent" just from timestamps (and, the daemon computes a hash for each so I can verify that a file/archive is intact at any time)

[I don't like incremental backups and full backups are too costly in terms of time and space]

Similar except my "external drive" is just some other host that happens to be "up" when I push the copy across to it.

I tend to be working in reasonably "focused" areas so it's usually one *type* of (set of) files that I'll be backing up. E.g., if I'm designing a board, there will be datasheets, schematics, VHDL and layouts that are all related. If doing an animation, then models, materials and scripts. etc. It's too hard to try to work in multiple disciplines simultaneously...

OTOH, one can often get sidetracked before a task is completed so you need to be able to figure out where you *were* on a particular task...

Welcome to the club!

The "save ONE image" approach means I can store all of the images in a single place (I use a large "camera bag") and know where they are. And, finding specific backups of *files* relies on my "catalog" (which runs on my "network controller appliance" -- DNS, font server, PXE server, NTP, etc. -- so it is always available via TELNET)

I just rescue "discards". No one wants BIG boxes (e.g., the Z800's weigh

60+ pounds; the SB2000 is over 70!) so they have no "market value", *locally*. While there may be an eBay value, the cost of shipping makes that awkward. And, I usually need big boxes for the various add-in cards that I use (SAS and SCSI HBAs, dual GPUs, etc.) as well as multiple spindles (the Z800s have 4 internal plus 3 exposed bays)

As these are "odd" mechanical configurations, I can't run down and pick up a $49 special in the event of a failure. So, to keep MTTR short, I just plan on swapping a defective unit out and worry about fixing it at a later time.

Yes. I acquired mine for similar problems. And, once you've fixed ONE of a Model X, fixing *10* is a piece of cake (you already know how to disassemble quickly, board layout, component part numbers, etc.) STORING them is the bigger issue! (I've got the shelves in both of my closets full, the tops of my bookcases, etc. -- and, that doesn't include the 10 that are "in service"!)

In the past, I've rescued monitors that were perfectly operational -- but had some particular quirks that made them not *obvious* to use. E.g., requiring dual link DVI and the bozo was using a single link cable or video card and wondering why it didn't work. Another model had a bug that required you to *reset* the monitor to restore functionality, etc.

(sigh) Lots of stuff gets scrapped that still has considerable useful life!

I'm waiting for him to change it *back* (to "prove" the fault was in the keyboard; dubious diagnostic skills...)

That;s where windows sucks big time! I can *pull* a disk from a

*BSD box and install it in another BSD box and not have to worry about the "changed hardware" upsetting the kernel.

Likewise with applications; no need to worry about apps that weave themselves into the system! "rm -r /app_directory"

Reply to
Don Y
<snip>

Booted into power-off, then powered on into the OS log-in screen and POWERED OFF AGAIN - within the count of a few chimpanzees.

Trying to figure out if a power button or harness failure can be responsible. Surely those signals are processed up the wazoo after they hit the motherboard - can't just shut it down cold?

Vibration around the procesor? Processor itself ? (carried over to replacement MB) Dirty processor socket?

Wouldn't be surprised if the new HDD is now toast.

RL

Reply to
legg

But the MB is known good?

Did it seem to deliberately shut itself down? Or, just "die" (e.g., like a power supply shutting down due to load)? IIRC, the "4 second shutdown" is (was?) implemented in hardware; that can be a low-end figure for how long you might expect the system to stay up, at a minimum.

Remove all loads (disks, PCI/PCIe/etc. cards). Remove *memory*. EXPECT it to complain about "no memory" when it boots. If this doesn't happen, then the fundamentals aren't working.

[You can also pull the CPU and some MBs will signal an error based on that, as well]

If it was at 4 seconds, you could hypothesize the power button was "stuck"/shorted/miswired (one problem I've seen with generic MBs is the sheer number of connections that have to be made... disk activity indicator, power button, reset (sometimes), pigtails to USB and serial ports, etc.

For the hell of it, try removing the processor to see if it alerts. Or, if the symptoms change.

Unplug it for the time being. Easy to check that on another machine (I prefer a USB enclosure so the disk is isolated from the test machines power, SATA controller, etc.)

Reply to
Don Y

If you have an expensive one, maybe, I think the cheap ones have a mask ROM.

Reply to
Jasen Betts

I think a stuck key is a more likely fault and by several orders of magnitude.

Reply to
Martin Brown

Or anything else that can generate multiple/spurious events. I've seen USB devices disconnect and reconnect, repeatedly, without "human intervention". This could be a problem *in* the device (intermittent connection, failing power, firmware bug) *or* in the host (perhaps a lack of resources that cause a repeated attempt to reconnect after aborting the previous connection).

[I just discarded a thumb drive that behaved in this way. I'm pretty sure it is a mechanical issue -- broken solder joint? -- as I can make things better or worse by applying pressure to the device while it is installed (but I have no desire to keep my finger on a drive just to use it "reliably"]

Surely simple to test if a device *is* the source of a problem (remove, replace, verify, reinstall) -- though by no means a guarantee given the number of variables that can come into play in the software.

Reply to
Don Y

ElectronDepot website is not affiliated with any of the manufacturers or service providers discussed here. All logos and trade names are the property of their respective owners.