Keyboard disabled after user logon

Hello All,

 

I'm having a problem with one users computer (actually account)- after this user logs on his keyboard is disabled.

 

The keyboard works fine at the logon screen, he can enter his username and password without any problems. If I log on as another user then there is no problem, keyboard works as expected.

 

The user account is a roaming domain account, and logging on to another computer with his accountcauses the same problem there. To rule out the physical keyboard, I swapped it out for a known good one, but this didn't work either.

 

So it's not the computer, or the keybaord. [but for the record, the computer is an Optiplex GX280, Windows XP SP2, all recent software updates - excluding IE7]. When I press a key, the computer beeps.

 

 I initially suspected something was loading in his profile, so I disabled all start up items using MSConfig (selected the Diagnostic Startup option on the general tab) with the intention of enabling items one by one to find the rogue app, but even with everything diasabled, the keyboard still doesn't work.

[I also disabled all the browser helper objects in IE]

 

I've tried booting in Safe mode, but this doesn't work either.

 

In Device Manager - Keyboards - Keyboard Properties - Details Tab, I've checked the following:

 

Device Upper Filters

Device Lower Filters

Class Upper Filters

Class Lower Filters

 

to see if there was a filter that was intercepting the keystrokes, but the only entry is "kbdlass" under "Class Upper Filters". The kbdclass.sys file is located in c:\windows\system32\drivers\  and has a file size of 24576 KB and a modified date of 04/08/2004 which looks OK [even if this file was the culprit I would expect to see the problem under all profiles].

 

 

I ran rootkit revealer from sysinternals to see if there was anything hidden from the GUI, but the only thing it picked up was the Media Player recently used files list.

 

Lastly, if I VNC to the user's computer when the keyboard doesn't work locally, it works fine over VNC.

 

I've googled for ways to disable a users keyboard to see if I could get any hints as to how I could reverse it, but the only information I can find is on disabling specific keys (like the windows key), not every sindle key on the keyboard.

 

Deleting the users saved profile on the server and the locally cached copy will fix the problem, but he will loose all his settings, so that is the last resort.