How to Fix HPQKBFILTR.SYS Keylogger
Found by Kaspersky

What is the HPQKBFILTR.SYS Keylogger?
One of my customers recently purchased an HP Pavilion Notebook computer and installed Kaspersky Internet Security 2009 on it. After installing the security suite and rebooting, Kaspersky alerted them to a suspicious file called HPQKBFILTR.SYS. It was labeled a keylogger and popped up each time the computer was rebooted.  

HP computers contain what they call "Quick Launch" buttons for accessing the web, email, etc. These buttons are located separately on the keyboard for easy access. The file hpqkbfiltr.sys is the keyboard filter from HP that is associated with these quick launch buttons
. Other antivirus programs did not flag the file as a keylogger but for whatever reason Kaspersky did. Even though the file is legitimate.

Unfortunately, when I disabled them in the registry or in MSConfig, it also disabled the keyboard and I was forced to use the built in on screen keyboard in Vista to re-enable the file.

Instead of disabling the HP keyboard filter, a better approach is to exclude the file from the Kaspersky scan. However, there is a problem with this procedure. When you try to add the file to the Trusted Applications in Kaspersky, you can only add .exe files, the keyboard filter is a .sys file. This presents a problem, however there is a workaround.

Add HPQKBFILTR.SYS to Trusted Zone in Kaspersky

Follow the steps below to add the file to the trusted zone in Kaspersky and remove the popup warnings.

1) Right-click on the Kaspersky icon in the System Tray and choose Settings

2) Under the Options section, click on Threats and exclusions

3) Under Exclusions on the right side, click on Trusted zone...

4) On the Rules Tab, click Add 

5) Check the Object box in Properties, and then click on Select Object.

6) Browse to the file C:\Windows\System32\Drivers\HPQKBFILTR.SYS, select it and click OK

7) Click on the Any option next to Protection Components and choose Selected Components

8) Check everything on the selected components screen and click Ok

9) Click Ok twice and the rule should be present in the box

10) Click Ok twice more to close Kaspersky 

Now the HPQKBFILTR.SYS file should be excluded from any Kaspersky scans and the warnings will disappear.

space.gif (58 bytes)


site search by freefind advanced


Tools for Removing Spyware, Adware, and Malware

Other Pages

Spyware/Adware Removal Help

MSBlast.exe Worm Removal

Welchia (Dllhost.exe and SVCHost.exe) Worm Removal

Uninstall McAfee Instructions

Uninstall Norton Instructions

Uninstall Avast Instructions

Uninstall AVG Instructions

Uninstall Antivir Instructions

Uninstall Panda Instructions

How to Manually Run the Microsoft Malicious Software Removal Tool

Bloodhound.Exploit.6 Virus Removal

MyDoom Virus Removal

MiMail.C Virus Removal

Swen Worm Virus Removal

SoBig.F Worm Removal

Dumaru Virus Removal

BugBear.B Worm Removal

SoBig.E Worm Removal

Pop Up Ad Removal Info

KAK Worm Removal

MiMail.A Worm Removal

W95.MTX Virus Removal

Snow White Virus Removal

BadTrans Trojan Removal

Wininit Virus (Bymer Trojan)

Happy99 Worm Removal

VBS Netlog Worm Removal

Pretty Park Worm Removal

Sasser Worm Virus Removal

Backdoor SDBot.H Trojan Removal

VBS.Loveletter Help

Computer Security Information

Back Orifice Information

PC HELL Main Page


iPadastic - News, Tutorials, Help, Tips, and Hints for the iPad

Download Hoyle Games
including Casino 3D, Card, Board, and Solitaire games.

Written by Mark Hasting

Recommended Software for PC Hell Visitors
Malwarebytes Anti-Malware
Malwarebytes Anti-Malware
iolo System Mechanic® - Fix, Speed Up Your PC
iolo System Mechanic®
Emsisoft Anti Malware
Emsisoft Anti Malware
space.gif (58 bytes)


Return to PC Hell
Return to PC Hell