Solved What is WirelessKeyboardFilter_01?

[ineuw]

Does anyone know what this is?

The first time this was installed on my desktop about 10 days ago through Windows update where it appeared as "Microsoft - Keyboard - Wireless Keyboard Filter Device". It has no KB number, is not listed in the registry, but is listed in the Device manager, indicating that the driver is missing.

It easily uninstalls and disappears from the manager until the next boot. There are a couple posts on the web about this device, and it seems to be a key logging software, and may not even be from Microsoft. So I removed it using Unlocker by searching for "WirelessKeyboardFilter". The folder was found at:

C:\Windows\System32\DriverStore\FileRepository\wirelesskeyboardfilter.inf_x86_neutral_588a2494ded85523 which contains the following files:

WirelessKeyboardFilter.cat
WirelessKeyboardFilter.inf
WirelessKeyboardFilter.PNF
WirelessKeyboardFilter.sys

and as WirelessKeyboardFilter.sys in C:\Windows\System32\Drivers

Today it reinstalled again and was not listed in the optional updates, as I monitor all Windows updates.

 

[Digital Life]

Here is the advisory about it.

Microsoft is announcing the availability of an update to improve input filtering for certain Microsoft wireless mouse devices. The update enhances security by filtering out QWERTY key packets in keystroke communications issued from receiving USB wireless dongles to wireless mouse devices. This improvement is part of ongoing efforts to improve the effectiveness of security in Windows and Microsoft devices. For more information, see Microsoft Knowledge Base Article 3152550.
A vulnerability has been discovered that allows keyboard HID packets to be injected into Microsoft wireless mouse devices through USB dongles. USB dongles will accept keyboard HID packets transmitted to the RF addresses of wireless mouse devices.
Recommendation
Microsoft recommends installing a filter driver available as an optional update for customers who use wireless mouse devices affected by this vulnerability. For the list of affected devices, see the Affected Devices section. For more information about affected operating systems, see the Affected Software section.
Microsoft recommends that customers test any new settings prior to implementation in their environments. Please see the Suggested Actionssection of this advisory for more information.
Source:
https://technet.microsoft.com/library/security/3152550

More info:
https://support.microsoft.com/en-us/kb/3152550


Where did you get the idea it was a key logger, its to stop people hacking your wireless keyboard or mouse

 

[ineuw]

sml156, much thanks for the info. I was concerned only because there was no KB to the update. I found two posts on the web from a much earlier date mentioning this package that this is a key logger. Will look again and post the links, if you are interested. Although the affected devices mentioned in the list don't apply to me, (only Win 7 SP1), I will install it with the next update.

 

[FuturDreamz]

The update is not for a keyboard, but for a mouse.

If you have a Microsoft mouse, the USB receiver is vulnerable to accepting keystrokes pretending to come from the mouse. The Wireless Keyboard Filter is Microsoft's solution to blocking that exploit, as the receiver itself cannot be patched.

 

[ineuw]

FuturDreamz, many thanks. you cleared up a mystery. I have a spare MS mouse and will install the software.