Unspecified devices(?)

iMaStEr · 17 Mar 2012

Well, today I opened "Devices and Printers" under Control panel, an there's such a weird thing. There are like two "unspecified" devices: Keyboard_Filter_01 and Mouse_Filter_01 (see below).

Clicking Properties shows absolutely nothing about it - details are either "unknown" or "unavailable".
Googling a bit I've found that these might have to do something with HP notebooks and their drivers. However, I'm using a PC and it has nothing to do with HP, neither any of the other devices connected.

I wonder how these icons got there and how do I remove them?

TVeblen · 18 Mar 2012

What does your Device Manager look like? Are there any problem devices showing there?

Is you mouse and keyboard wireless?

Some ideas:

Easy: Perform a System Restore to a date before you noticed the devices and see if they go away.

And/Or:
In Device Manager, for the device(s) with the yellow "Bam!", (or in Devices and Printers) > right click on the device, then click "Properties". Go to the Details Tab, then click the drop down box under "Property" and select "Hardware ID's".

The result will be a string of codes, but you just want to write down the 4 digit codes next to VEN and DEV.

Then go here:
PCI Vendor and Device Lists
Enter the 4 digit VEN code in the box marked "Vendor Search", and click "Search", then
Enter the 4 digit DEV code in the box marked "Device Search" and click "Search".
Note you results.

You now know the brand and model of the problem devices. You could then try and reinstall install the drivers for them.

iMaStEr · 19 Mar 2012

Everything in Device Manager looks normal: https://i.imgur.com/ij4nb.png

My mouse and keyboard are wired.

I don't have Sys Restore enabled.

In Device Manager, nothing shows up with yellow and these devices (looking from Devices and Printers in Control Panel) don't have any properties, as I mentioned: https://i.imgur.com/eK9SR.png & https://i.imgur.com/KpXx2.png

I've tried running the troubleshooter (it is available to choose as you can see from my first post), it tries searching for drivers, but eventually says there's "no available drivers for this product" or smth like that.

Would it be possible to find if some entries are linked to these devices in the registry?

:/

TVeblen · 19 Mar 2012

iMaStEr said:

Would it be possible to find if some entries are linked to these devices in the registry?

:/

Only if you knew what they were, had device names, or Hardware ID's!
Not advisable.

Try Removing or Uninstalling them. See if they come back.

iMaStEr · 19 Mar 2012

Removing or uninstalling what? There's no option to remove/uninstall them in the Control Panel, dunno where else to look :/

fseal · 19 Mar 2012

Keyboard and mouse filters are extremely useful "devices" (Really JUST a software driver, no hardware involved) for some specific legitimate uses. They are also exceptionally dangerous if used by the wrong people. Basically it's how keyloggers work, but is also used by programs for recording KB/Mouse at a very low level for other purposes. The drivers may come in as part of a package for your gaming KB and mouse if you installed those drivers. Or if you have a barcode reader embedded in your keyboard or any number of other possibilities.

SO, it could be 100% legitimate or it could be a sign of a virus infection. Might be hard to tell exactly, but I would do a full virus and malware scan just to try to rule that probability out first...

Also, did you notice exactly when they appeared? Have you installed any new hardware or software lately?

iMaStEr · 20 Mar 2012

Well I've noticed them when I wanted to share my printer on the network and opened Control Panel. That was a about a week ago. On the same time, there was some kind of virus infection that I think I dealt with.
Any software that I installed lately and that could have something to do with that could probably be Evolve (Games VPN/tracking software https://www.evolvehq.com/), but I couldn't find anything about the "filters" neither on their faq nor on the forums.
Well then I guess I'll do some scanning in safe mode and/or with Hiren's BootCD.

fseal · 20 Mar 2012

Well they could easily have been installed by the virus, if the virus has actually been cleaned out then they may not pose a danger any more (Something needs to use the filters to gather you keystrokes). But I'd be extra careful :/ Personally I'd consider a reinstall.

iMaStEr · 21 Mar 2012

I've managed to find these two in the Device Manger by clicking "Show hidden devices". I disabled and uninstalled them, but after reboot they came up again. Then went back to Device Manager, and done some digging in the Details tab, and I've found this: https://i.imgur.com/lD52x.png
The highlighted sentence contains EVOLVE (as I mentioned before, I have installed it lately, it's a game tracking software). I wrote them to confirm that, hope it's no kind of spyware...

fseal · 21 Mar 2012

Ok, well that makes sense then. In order for those kinds of programs to get keystrokes in order to control them during game play which is using Direct X, they HAVE to pre-filter the keyboard "stack" before even direct X gets the keystrokes and passes them directly to the game. The mouse filter is interesting though, unless you can also use the mouse to control the program as well.

That's an example of a "good" reason for KB filters to exist... Assuming they aren't also key logging your passwords! :)